Protected API for October CMS website status, authenticated users, etc

Question

I don't believe anything exists in this area yet, but correct me if I'm wrong. I'd like to create an API for October CMS with endpoints to GET a response for things like the website status (already on October Dashboard), users that are currently authenticated, log feeds, and several other possibilities. The idea is to have an external dashboard to pull this data into.

The issue is it should be protected. I found this for vanilla Laravel to add API keys. Has anyone out there tried created protected API endpoints for October?

I'm realistically trying to find a starting point if anyone has built something, and I'm looking to turn this into an open source project to help expand October with a plugin of some sort.

Answer 1

You can use middleware to do the authentication yourself. It's quite simple actually.

You need to apply the middleware class to the route in question:

Route::group(['prefix' => 'api/v1', 'middleware' => 'Author\Plugin\classes\ApiMiddleware'], function () {
    Route::get('info', ['uses' => 'Author\Plugin\Controllers\Api\v1\Info@index']);
});

In the ApiMiddleware handle() function you can define the authentication rules however you want (IP restriction, basic auth etc)

public function handle($request, Closure $next)
{
    // check if the IP is in the whitelist
    if (!in_array($request->ip(), $this->whitelist)) {
        return response("IP address rejected\n" . $request->ip(), 403);
    }

    // check for errors thrown in the other controllers
    $response = $next($request);
    $errors = $request->getSession()->get('errors');

    // no errors - return the response
    if (empty($errors))
        return $response;

    // return the error
    $message = $errors->getBag('default')->first();
    return response()->json(['code' => '400', 'message' => $message]);
}