Add base routes for managing servers as a client

app/Http/Controllers/Api/Application/ApplicationApiController.php

@@ -3,12 +3,12 @@
 namespace Pterodactyl\Http\Controllers\Api\Application;
 
 use Illuminate\Http\Request;
+use Webmozart\Assert\Assert;
 use Illuminate\Http\Response;
 use Illuminate\Container\Container;
 use Pterodactyl\Http\Controllers\Controller;
 use Pterodactyl\Extensions\Spatie\Fractalistic\Fractal;
 use Pterodactyl\Transformers\Api\Application\BaseTransformer;
-use Pterodactyl\Exceptions\Transformer\InvalidTransformerLevelException;
 
 abstract class ApplicationApiController extends Controller
 {
@@ -56,8 +56,6 @@ abstract class ApplicationApiController extends Controller
      *
      * @param string $abstract
      * @return \Pterodactyl\Transformers\Api\Application\BaseTransformer
-     *
-     * @throws \Pterodactyl\Exceptions\Transformer\InvalidTransformerLevelException
      */
     public function getTransformer(string $abstract)
     {
@@ -65,9 +63,7 @@ abstract class ApplicationApiController extends Controller
         $transformer = Container::getInstance()->make($abstract);
         $transformer->setKey($this->request->attributes->get('api_key'));
 
-        if (! $transformer instanceof BaseTransformer) {
-            throw new InvalidTransformerLevelException('Calls to ' . __METHOD__ . ' must return a transformer that is an instance of ' . __CLASS__);
-        }
+        Assert::isInstanceOf($transformer, BaseTransformer::class);
 
         return $transformer;
     }

app/Http/Controllers/Api/Client/ClientApiController.php

@@ -1,9 +1,11 @@
 <?php
 
-namespace Pterodactyl\Http\Controllers\Api\Application;
+namespace Pterodactyl\Http\Controllers\Api\Client;
 
+use Webmozart\Assert\Assert;
 use Illuminate\Container\Container;
-use Pterodactyl\Exceptions\Transformer\InvalidTransformerLevelException;
+use Pterodactyl\Transformers\Api\Client\BaseClientTransformer;
+use Pterodactyl\Http\Controllers\Api\Application\ApplicationApiController;
 
 abstract class ClientApiController extends ApplicationApiController
 {
@@ -12,18 +14,15 @@ abstract class ClientApiController extends ApplicationApiController
      *
      * @param string $abstract
      * @return \Pterodactyl\Transformers\Api\Client\BaseClientTransformer
-     *
-     * @throws \Pterodactyl\Exceptions\Transformer\InvalidTransformerLevelException
      */
     public function getTransformer(string $abstract)
     {
         /** @var \Pterodactyl\Transformers\Api\Client\BaseClientTransformer $transformer */
         $transformer = Container::getInstance()->make($abstract);
-        $transformer->setKey($this->request->attributes->get('api_key'));
+        Assert::isInstanceOf($transformer, BaseClientTransformer::class);
 
-        if (! $transformer instanceof self) {
-            throw new InvalidTransformerLevelException('Calls to ' . __METHOD__ . ' must return a transformer that is an instance of ' . __CLASS__);
-        }
+        $transformer->setKey($this->request->attributes->get('api_key'));
+        $transformer->setUser($this->request->user());
 
         return $transformer;
     }

app/Http/Controllers/Api/Client/ClientController.php

@@ -2,8 +2,43 @@
 
 namespace Pterodactyl\Http\Controllers\Api\Client;
 
-use Pterodactyl\Http\Controllers\Api\Application\ClientApiController;
+use Pterodactyl\Models\User;
+use Pterodactyl\Transformers\Api\Client\ServerTransformer;
+use Pterodactyl\Http\Requests\Api\Client\GetServersRequest;
+use Pterodactyl\Contracts\Repository\ServerRepositoryInterface;
 
 class ClientController extends ClientApiController
 {
+    /**
+     * @var \Pterodactyl\Contracts\Repository\ServerRepositoryInterface
+     */
+    private $repository;
+
+    /**
+     * ClientController constructor.
+     *
+     * @param \Pterodactyl\Contracts\Repository\ServerRepositoryInterface $repository
+     */
+    public function __construct(ServerRepositoryInterface $repository)
+    {
+        parent::__construct();
+
+        $this->repository = $repository;
+    }
+
+    /**
+     * Return all of the servers available to the client making the API
+     * request, including servers the user has access to as a subuser.
+     *
+     * @param \Pterodactyl\Http\Requests\Api\Client\GetServersRequest $request
+     * @return array
+     */
+    public function index(GetServersRequest $request): array
+    {
+        $servers = $this->repository->filterUserAccessServers($request->user(), User::FILTER_LEVEL_SUBUSER);
+
+        return $this->fractal->collection($servers)
+            ->transformWith($this->getTransformer(ServerTransformer::class))
+            ->toArray();
+    }
 }

app/Http/Controllers/Api/Client/Servers/ServerController.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace Pterodactyl\Http\Controllers\Api\Client\Servers;
+
+use Pterodactyl\Models\Server;
+use Pterodactyl\Transformers\Api\Client\ServerTransformer;
+use Pterodactyl\Http\Controllers\Api\Client\ClientApiController;
+use Pterodactyl\Http\Requests\Api\Client\Servers\GetServerRequest;
+
+class ServerController extends ClientApiController
+{
+    /**
+     * Transform an individual server into a response that can be consumed by a
+     * client using the API.
+     *
+     * @param \Pterodactyl\Http\Requests\Api\Client\Servers\GetServerRequest $request
+     * @return array
+     */
+    public function index(GetServerRequest $request): array
+    {
+        return $this->fractal->item($request->getModel(Server::class))
+            ->transformWith($this->getTransformer(ServerTransformer::class))
+            ->toArray();
+    }
+}

app/Http/Kernel.php

@@ -34,6 +34,7 @@ use Pterodactyl\Http\Middleware\Server\DatabaseBelongsToServer;
 use Pterodactyl\Http\Middleware\Server\ScheduleBelongsToServer;
 use Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode;
 use Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull;
+use Pterodactyl\Http\Middleware\Api\Client\SubstituteClientApiBindings;
 use Pterodactyl\Http\Middleware\Api\Application\AuthenticateApplicationUser;
 use Pterodactyl\Http\Middleware\DaemonAuthenticate as OldDaemonAuthenticate;
 
@@ -78,7 +79,7 @@ class Kernel extends HttpKernel
         ],
         'client-api' => [
             'throttle:60,1',
-            ApiSubstituteBindings::class,
+            SubstituteClientApiBindings::class,
             SetSessionDriver::class,
             'api..key:' . ApiKey::TYPE_ACCOUNT,
             AuthenticateIPAccess::class,

app/Http/Middleware/Api/ApiSubstituteBindings.php

@@ -32,6 +32,11 @@ class ApiSubstituteBindings extends SubstituteBindings
         'user' => User::class,
     ];
 
+    /**
+     * @var \Illuminate\Routing\Router
+     */
+    protected $router;
+
     /**
      * Perform substitution of route parameters without triggering
      * a 404 error if a model is not found.
@@ -45,6 +50,10 @@ class ApiSubstituteBindings extends SubstituteBindings
         $route = $request->route();
 
         foreach (self::$mappings as $key => $model) {
+            if (! is_null($this->router->getBindingCallback($key))) {
+                continue;
+            }
+
             $this->router->model($key, $model, function () use ($request) {
                 $request->attributes->set('is_missing_model', true);
             });

app/Http/Middleware/Api/Client/SubstituteClientApiBindings.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace Pterodactyl\Http\Middleware\Api\Client;
+
+use Closure;
+use Illuminate\Container\Container;
+use Pterodactyl\Http\Middleware\Api\ApiSubstituteBindings;
+use Pterodactyl\Exceptions\Repository\RecordNotFoundException;
+use Pterodactyl\Contracts\Repository\ServerRepositoryInterface;
+
+class SubstituteClientApiBindings extends ApiSubstituteBindings
+{
+    /**
+     * Perform substitution of route parameters without triggering
+     * a 404 error if a model is not found.
+     *
+     * @param \Illuminate\Http\Request $request
+     * @param \Closure                 $next
+     * @return mixed
+     */
+    public function handle($request, Closure $next)
+    {
+        // Override default behavior of the model binding to use a specific table
+        // column rather than the default 'id'.
+        $this->router->bind('server', function ($value) use ($request) {
+            try {
+                return Container::getInstance()->make(ServerRepositoryInterface::class)->findFirstWhere([
+                    ['uuidShort', '=', $value],
+                ]);
+            } catch (RecordNotFoundException $ex) {
+                $request->attributes->set('is_missing_model', true);
+
+                return null;
+            }
+        });
+
+        return parent::handle($request, $next);
+    }
+}

app/Http/Requests/Api/Client/ClientApiRequest.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace Pterodactyl\Http\Requests\Api\Client;
+
+use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest;
+
+abstract class ClientApiRequest extends ApplicationApiRequest
+{
+    /**
+     * Determine if the current user is authorized to perform
+     * the requested action aganist the API.
+     *
+     * @return bool
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+}

app/Http/Requests/Api/Client/GetServersRequest.php

@@ -0,0 +1,14 @@
+<?php
+
+namespace Pterodactyl\Http\Requests\Api\Client;
+
+class GetServersRequest extends ClientApiRequest
+{
+    /**
+     * @return bool
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+}

app/Http/Requests/Api/Client/Servers/GetServerRequest.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace Pterodactyl\Http\Requests\Api\Client\Servers;
+
+use Pterodactyl\Models\Server;
+use Pterodactyl\Http\Requests\Api\Client\ClientApiRequest;
+
+class GetServerRequest extends ClientApiRequest
+{
+    /**
+     * Determine if a client has permission to view this server on the API. This
+     * should never be false since this would be checking the same permission as
+     * resourceExists().
+     *
+     * @return bool
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine if the user should even know that this server exists.
+     *
+     * @return bool
+     */
+    public function resourceExists(): bool
+    {
+        return $this->user()->can('view-server', $this->getModel(Server::class));
+    }
+}