From 47920f1191b45c9d5d9ac3c8fa77a63a72c4b26a Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Thu, 26 Sep 2024 10:32:12 +0200
Subject: [PATCH 1/2] Feat: If API is disabeled do not show API token creation
 stuff

---
 app/Livewire/Security/ApiTokens.php           |   8 +-
 .../livewire/security/api-tokens.blade.php    | 106 ++++++++----------
 2 files changed, 56 insertions(+), 58 deletions(-)

diff --git a/app/Livewire/Security/ApiTokens.php b/app/Livewire/Security/ApiTokens.php
index ff8679d21..1a0ca51ef 100644
--- a/app/Livewire/Security/ApiTokens.php
+++ b/app/Livewire/Security/ApiTokens.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Security;
 
+use App\Models\InstanceSettings;
 use Livewire\Component;
 
 class ApiTokens extends Component
@@ -16,13 +17,18 @@ class ApiTokens extends Component
 
     public array $permissions = ['read-only'];
 
+    public $instanceSettings;
+
     public function render()
     {
-        return view('livewire.security.api-tokens');
+        return view('livewire.security.api-tokens', [
+            'instanceSettings' => $this->instanceSettings,
+        ]);
     }
 
     public function mount()
     {
+        $this->instanceSettings = InstanceSettings::get();
         $this->tokens = auth()->user()->tokens->sortByDesc('created_at');
     }
 
diff --git a/resources/views/livewire/security/api-tokens.blade.php b/resources/views/livewire/security/api-tokens.blade.php
index 48f68d9d7..a73a9ca1a 100644
--- a/resources/views/livewire/security/api-tokens.blade.php
+++ b/resources/views/livewire/security/api-tokens.blade.php
@@ -1,79 +1,71 @@
 <div>
     <x-slot:title>
         API Tokens | Coolify
-    </x-slot>
-    <x-security.navbar />
-    <div class="pb-4 ">
-        <h2>API Tokens</h2>
-        <div>Tokens are created with the current team as scope. You will only have access to this team's resources.
-        </div>
-    </div>
-    <h3>New Token</h3>
-    <form class="flex flex-col gap-2 pt-4" wire:submit='addNewToken'>
-        <div class="flex items-end gap-2">
-            <x-forms.input required id="description" label="Description" />
-            <x-forms.button type="submit">Create New Token</x-forms.button>
-        </div>
-        <div class="flex">
-            Permissions <x-helper class="px-1" helper="These permissions will be granted to the token." /><span
-                class="pr-1">:</span>
-            <div class="flex gap-1 font-bold dark:text-white">
-                @if ($permissions)
-                    @foreach ($permissions as $permission)
-                        @if ($permission === '*')
-                            <div>All (root/admin access), be careful!</div>
-                        @else
-                            <div>{{ $permission }}</div>
-                        @endif
-                    @endforeach
-                @endif
+        </x-slot>
+        <x-security.navbar />
+        <div class="pb-4 ">
+            <h2>API Tokens</h2>
+            @if (!$instanceSettings->is_api_enabled)
+            <strong>API is disabled. If you want to use API, please enable it in the Instance Settings.</strong>
+            @else
+            <div>Tokens are created with the current team as scope. You will only have access to this team's resources.
             </div>
         </div>
-        <h4>Token Permissions</h4>
-        <div class="w-64">
-            <x-forms.checkbox label="Read-only" wire:model.live="readOnly"></x-forms.checkbox>
-            <x-forms.checkbox label="View Sensitive Data" wire:model.live="viewSensitiveData"></x-forms.checkbox>
-        </div>
-    </form>
-    @if (session()->has('token'))
+        <h3>New Token</h3>
+        <form class="flex flex-col gap-2 pt-4" wire:submit='addNewToken'>
+            <div class="flex items-end gap-2">
+                <x-forms.input required id="description" label="Description" />
+                <x-forms.button type="submit">Create New Token</x-forms.button>
+            </div>
+            <div class="flex">
+                Permissions
+                <x-helper class="px-1" helper="These permissions will be granted to the token." /><span class="pr-1">:</span>
+                <div class="flex gap-1 font-bold dark:text-white">
+                    @if ($permissions)
+                    @foreach ($permissions as $permission)
+                    @if ($permission === '*')
+                    <div>All (root/admin access), be careful!</div>
+                    @else
+                    <div>{{ $permission }}</div>
+                    @endif
+                    @endforeach
+                    @endif
+                </div>
+            </div>
+            <h4>Token Permissions</h4>
+            <div class="w-64">
+                <x-forms.checkbox label="Read-only" wire:model.live="readOnly"></x-forms.checkbox>
+                <x-forms.checkbox label="View Sensitive Data" wire:model.live="viewSensitiveData"></x-forms.checkbox>
+            </div>
+        </form>
+        @if (session()->has('token'))
         <div class="py-4 font-bold dark:text-warning">Please copy this token now. For your security, it won't be shown
             again.
         </div>
         <div class="pb-4 font-bold dark:text-white"> {{ session('token') }}</div>
-    @endif
-    <h3 class="py-4">Issued Tokens</h3>
-    <div class="grid gap-2 lg:grid-cols-1">
-        @forelse ($tokens as $token)
+        @endif
+        <h3 class="py-4">Issued Tokens</h3>
+        <div class="grid gap-2 lg:grid-cols-1">
+            @forelse ($tokens as $token)
             <div class="flex flex-col gap-1 p-2 border dark:border-coolgray-200 hover:no-underline">
                 <div>Description: {{ $token->name }}</div>
                 <div>Last used: {{ $token->last_used_at ? $token->last_used_at->diffForHumans() : 'Never' }}</div>
                 <div class="flex gap-1">
                     @if ($token->abilities)
-                        Abilities:
-                        @foreach ($token->abilities as $ability)
-                            <div class="font-bold dark:text-white">{{ $ability }}</div>
-                        @endforeach
+                    Abilities:
+                    @foreach ($token->abilities as $ability)
+                    <div class="font-bold dark:text-white">{{ $ability }}</div>
+                    @endforeach
                     @endif
                 </div>
 
-                <x-modal-confirmation 
-                    title="Confirm API Token Revocation?"
-                    isErrorButton
-                    buttonTitle="Revoke token"
-                    submitAction="revoke({{ data_get($token, 'id') }})"
-                    :actions="['This API Token will be revoked and permanently deleted.', 'Any API call made with this token will fail.']"
-                    confirmationText="{{ $token->name }}"
-                    confirmationLabel="Please confirm the execution of the actions by entering the API Token Description below"
-                    shortConfirmationLabel="API Token Description"
-                    :confirmWithPassword="false"
-                    step2ButtonText="Revoke API Token"
-                />
+                <x-modal-confirmation title="Confirm API Token Revocation?" isErrorButton buttonTitle="Revoke token" submitAction="revoke({{ data_get($token, 'id') }})" :actions="['This API Token will be revoked and permanently deleted.', 'Any API call made with this token will fail.']" confirmationText="{{ $token->name }}" confirmationLabel="Please confirm the execution of the actions by entering the API Token Description below" shortConfirmationLabel="API Token Description" :confirmWithPassword="false" step2ButtonText="Revoke API Token" />
             </div>
-        @empty
+            @empty
             <div>
                 <div>No API tokens found.</div>
             </div>
-        @endforelse
-    </div>
-
+            @endforelse
+        </div>
+        @endif
 </div>

From 111e9ba3a33b9398a04ea2ad60bebe08cfa0a44f Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Thu, 26 Sep 2024 10:45:18 +0200
Subject: [PATCH 2/2] Fix: Disable API by default

---
 ...024_09_26_083441_disable_api_by_default.php | 18 ++++++++++++++++++
 .../livewire/security/api-tokens.blade.php     |  2 +-
 2 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 database/migrations/2024_09_26_083441_disable_api_by_default.php

diff --git a/database/migrations/2024_09_26_083441_disable_api_by_default.php b/database/migrations/2024_09_26_083441_disable_api_by_default.php
new file mode 100644
index 000000000..d0803f751
--- /dev/null
+++ b/database/migrations/2024_09_26_083441_disable_api_by_default.php
@@ -0,0 +1,18 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->boolean('is_api_enabled')->default(false)->change();
+        });
+    }
+};
diff --git a/resources/views/livewire/security/api-tokens.blade.php b/resources/views/livewire/security/api-tokens.blade.php
index a73a9ca1a..3da3a2dbe 100644
--- a/resources/views/livewire/security/api-tokens.blade.php
+++ b/resources/views/livewire/security/api-tokens.blade.php
@@ -6,7 +6,7 @@
         <div class="pb-4 ">
             <h2>API Tokens</h2>
             @if (!$instanceSettings->is_api_enabled)
-            <strong>API is disabled. If you want to use API, please enable it in the Instance Settings.</strong>
+            <strong>API is disabled. If you want to use the API, please enable it in the Coolify Instance Settings.</strong>
             @else
             <div>Tokens are created with the current team as scope. You will only have access to this team's resources.
             </div>