Massively simplify API binding logic

Changes the API internals to use normal Laravel binding which automatically supports nested-models and can determine their relationships. This removes a lot of confusingly complex internal logic and replaces it with standard Laravel code.

This also removes a deprecated "getModel" method and fully replaces it with a "parameter" method that does stricter type-checking.

app/Http/Middleware/Api/ApiSubstituteBindings.php

@@ -1,87 +0,0 @@
-<?php
-
-namespace Pterodactyl\Http\Middleware\Api;
-
-use Closure;
-use Pterodactyl\Models\Egg;
-use Pterodactyl\Models\Nest;
-use Pterodactyl\Models\Node;
-use Pterodactyl\Models\User;
-use Pterodactyl\Models\Server;
-use Pterodactyl\Models\Database;
-use Pterodactyl\Models\Location;
-use Pterodactyl\Models\Allocation;
-use Illuminate\Routing\Middleware\SubstituteBindings;
-use Illuminate\Database\Eloquent\ModelNotFoundException;
-
-class ApiSubstituteBindings extends SubstituteBindings
-{
-    /**
-     * Mappings to automatically assign route parameters to a model.
-     *
-     * @var array
-     */
-    protected static $mappings = [
-        'allocation' => Allocation::class,
-        'database' => Database::class,
-        'egg' => Egg::class,
-        'location' => Location::class,
-        'nest' => Nest::class,
-        'node' => Node::class,
-        'server' => Server::class,
-        'user' => User::class,
-    ];
-
-    /**
-     * @var \Illuminate\Routing\Router
-     */
-    protected $router;
-
-    /**
-     * Perform substitution of route parameters without triggering
-     * a 404 error if a model is not found.
-     *
-     * @param \Illuminate\Http\Request $request
-     *
-     * @return mixed
-     */
-    public function handle($request, Closure $next)
-    {
-        $route = $request->route();
-
-        foreach (self::$mappings as $key => $model) {
-            if (!is_null($this->router->getBindingCallback($key))) {
-                continue;
-            }
-
-            $this->router->model($key, $model, function () use ($request) {
-                $request->attributes->set('is_missing_model', true);
-            });
-        }
-
-        $this->router->substituteBindings($route);
-
-        // Attempt to resolve bindings for this route. If one of the models
-        // cannot be resolved do not immediately return a 404 error. Set a request
-        // attribute that can be checked in the base API request class to only
-        // trigger a 404 after validating that the API key making the request is valid
-        // and even has permission to access the requested resource.
-        try {
-            $this->router->substituteImplicitBindings($route);
-        } catch (ModelNotFoundException $exception) {
-            $request->attributes->set('is_missing_model', true);
-        }
-
-        return $next($request);
-    }
-
-    /**
-     * Return the registered mappings.
-     *
-     * @return array
-     */
-    public static function getMappings()
-    {
-        return self::$mappings;
-    }
-}

app/Http/Middleware/Api/Client/SubstituteClientApiBindings.php

@@ -1,62 +0,0 @@
-<?php
-
-namespace Pterodactyl\Http\Middleware\Api\Client;
-
-use Closure;
-use Pterodactyl\Models\User;
-use Pterodactyl\Models\Backup;
-use Pterodactyl\Models\Database;
-use Illuminate\Container\Container;
-use Pterodactyl\Contracts\Extensions\HashidsInterface;
-use Pterodactyl\Http\Middleware\Api\ApiSubstituteBindings;
-use Pterodactyl\Exceptions\Repository\RecordNotFoundException;
-use Pterodactyl\Contracts\Repository\ServerRepositoryInterface;
-
-class SubstituteClientApiBindings extends ApiSubstituteBindings
-{
-    /**
-     * Perform substitution of route parameters without triggering
-     * a 404 error if a model is not found.
-     *
-     * @param \Illuminate\Http\Request $request
-     *
-     * @return mixed
-     */
-    public function handle($request, Closure $next)
-    {
-        // Override default behavior of the model binding to use a specific table
-        // column rather than the default 'id'.
-        $this->router->bind('server', function ($value) use ($request) {
-            try {
-                $column = 'uuidShort';
-                if (preg_match('/^[0-9A-F]{8}-[0-9A-F]{4}-4[0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i', $value)) {
-                    $column = 'uuid';
-                }
-
-                return Container::getInstance()->make(ServerRepositoryInterface::class)->findFirstWhere([
-                    [$column, '=', $value],
-                ]);
-            } catch (RecordNotFoundException $ex) {
-                $request->attributes->set('is_missing_model', true);
-
-                return null;
-            }
-        });
-
-        $this->router->bind('database', function ($value) {
-            $id = Container::getInstance()->make(HashidsInterface::class)->decodeFirst($value);
-
-            return Database::query()->where('id', $id)->firstOrFail();
-        });
-
-        $this->router->bind('backup', function ($value) {
-            return Backup::query()->where('uuid', $value)->firstOrFail();
-        });
-
-        $this->router->bind('user', function ($value) {
-            return User::query()->where('uuid', $value)->firstOrFail();
-        });
-
-        return parent::handle($request, $next);
-    }
-}

app/Http/Middleware/Api/Client/SubstituteClientBindings.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace Pterodactyl\Http\Middleware\Api\Client;
+
+use Closure;
+use Pterodactyl\Models\Server;
+use Illuminate\Routing\Middleware\SubstituteBindings;
+
+class SubstituteClientBindings extends SubstituteBindings
+{
+    /**
+     * @param \Illuminate\Http\Request $request
+     *
+     * @return mixed
+     */
+    public function handle($request, Closure $next)
+    {
+        // Override default behavior of the model binding to use a specific table
+        // column rather than the default 'id'.
+        $this->router->bind('server', function ($value) {
+            return Server::query()->where(strlen($value) === 8 ? 'uuidShort' : 'uuid', $value)->firstOrFail();
+        });
+
+        $this->router->bind('user', function ($value, $route) {
+            /** @var \Pterodactyl\Models\Subuser $match */
+            $match = $route->parameter('server')
+                ->subusers()
+                ->whereRelation('user', 'uuid', '=', $value)
+                ->firstOrFail();
+
+            return $match->user;
+        });
+
+        return parent::handle($request, $next);
+    }
+}

app/Http/Middleware/Api/IsValidJson.php

@@ -3,6 +3,7 @@
 namespace Pterodactyl\Http\Middleware\Api;
 
 use Closure;
+use JsonException;
 use Illuminate\Http\Request;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
 
@@ -18,10 +19,10 @@ class IsValidJson
     public function handle(Request $request, Closure $next)
     {
         if ($request->isJson() && !empty($request->getContent())) {
-            json_decode($request->getContent(), true);
-
-            if (json_last_error() !== JSON_ERROR_NONE) {
-                throw new BadRequestHttpException(sprintf('The JSON data passed in the request appears to be malformed. err_code: %d err_message: "%s"', json_last_error(), json_last_error_msg()));
+            try {
+                json_decode($request->getContent(), true, 512, JSON_THROW_ON_ERROR);
+            } catch (JsonException $exception) {
+                throw new BadRequestHttpException('The JSON data passed in the request appears to be malformed: ' . $exception->getMessage());
             }
         }