Account, security and API keys

return $this->fractal->item($request->user())
    ->transformWith($this->getTransformer(AccountTransformer::class))
    ->toArray();

if ($request->user()->use_totp) {
    throw new BadRequestHttpException('Two-factor authentication is already enabled on this account.');
}

return new JsonResponse([
    'data' => $this->setupService->handle($request->user()),
]);

$validator = $this->validation->make($request->all(), [
    'code' => ['required', 'string', 'size:6'],
    'password' => ['required', 'string'],
]);

$data = $validator->validate();
if (!password_verify($data['password'], $request->user()->password)) {
    throw new BadRequestHttpException('The password provided was not valid.');
}

$tokens = $this->toggleTwoFactorService->handle($request->user(), $data['code'], true);

Activity::event('user:two-factor.create')->log();

return new JsonResponse([
    'object' => 'recovery_tokens',
    'attributes' => [
        'tokens' => $tokens,
    ],
]);

if (!password_verify($request->input('password') ?? '', $request->user()->password)) {
    throw new BadRequestHttpException('The password provided was not valid.');
}

$user = $request->user();

$user->update([
    'totp_authenticated_at' => Carbon::now(),
    'use_totp' => false,
]);

Activity::event('user:two-factor.delete')->log();

return new JsonResponse([], Response::HTTP_NO_CONTENT);

if (!$request->user()->use_totp) {
    throw new BadRequestHttpException('Two-factor authentication is not enabled on this account.');
}

$validator = $this->validation->make($request->all(), [
    'password' => ['required', 'string'],
]);

$data = $validator->validate();
if (!password_verify($data['password'], $request->user()->password)) {
    throw new BadRequestHttpException('The password provided was not valid.');
}

$tokens = $this->recoveryTokenService->handle($request->user());

Activity::event('user:two-factor.regenerate-tokens')->log();

return new JsonResponse([
    'object' => 'recovery_tokens',
    'attributes' => [
        'tokens' => $tokens,
    ],
]);

if (!parent::authorize()) {
    return false;
}

$hasher = Container::getInstance()->make(Hasher::class);

if (!$hasher->check($this->input('password'), $this->user()->password)) {
    throw new InvalidPasswordProvidedException(trans('validation.internal.invalid_password'));
}

return true;

$user = $request->user();

if (RateLimiter::tooManyAttempts($key = "user:update-email:{$user->uuid}", 3)) {
    throw new TooManyRequestsHttpException(message: 'Your email address has been changed too many times today. Please try again later.');
}

$original = $user->email;
if (mb_strtolower($original) !== mb_strtolower($request->validated('email'))) {
    RateLimiter::hit($key, self::EMAIL_UPDATE_THROTTLE);

    $this->updateService->handle($user, $request->validated());

    Activity::event('user:account.email-changed')
        ->property(['old' => $original, 'new' => $request->validated('email')])
        ->log();
}

return new JsonResponse([], Response::HTTP_NO_CONTENT);

if (!parent::authorize()) {
    return false;
}

$hasher = Container::getInstance()->make(Hasher::class);

if (!$hasher->check($this->input('current_password'), $this->user()->password)) {
    throw new InvalidPasswordProvidedException(trans('validation.internal.invalid_password'));
}

return true;

$user = Activity::event('user:account.password-changed')->transaction(function () use ($request) {
    return $this->updateService->handle($request->user(), $request->validated());
});

$guard = $this->manager->guard();

$guard->setUser($user);

if (method_exists($guard, 'logoutOtherDevices')) { // @phpstan-ignore function.alreadyNarrowedType
    $guard->logoutOtherDevices($request->input('password'));
}

return new JsonResponse([], Response::HTTP_NO_CONTENT);

return config('aquadactyl.features.custom_profile_pictures', true) && parent::authorize();

$user = $service->upload($request->user(), $request->file('avatar'));
Activity::event('user:account.avatar-updated')->log();

return $this->fractal->item($user)
    ->transformWith($this->getTransformer(AccountTransformer::class))
    ->toArray();

$user = $service->remove($request->user());
Activity::event('user:account.avatar-removed')->log();

return $this->fractal->item($user)
    ->transformWith($this->getTransformer(AccountTransformer::class))
    ->toArray();

return config('aquadactyl.features.privacy_mode', true) && parent::authorize();

$user = $request->user();
$enabled = $request->boolean('blur_sensitive_data');
if ($user->blur_sensitive_data !== $enabled) {
    $user->forceFill(['blur_sensitive_data' => $enabled])->save();
    Activity::event('user:account.privacy-updated')->subject($user)
        ->property('blur_sensitive_data', $enabled)->log();
}

return $this->fractal->item($user)
    ->transformWith($this->getTransformer(AccountTransformer::class))
    ->toArray();

$user = $request->user();
$user->forceFill(['language' => $request->validated('language')])->save();

return [
    'language' => $user->language,
    'locale' => $languages->forRequest($request, $user->language),
];

$query = $request->user()->activity()
    ->whereNotIn('activity_logs.event', ActivityLog::DISABLED_EVENTS);
$events = $filters->availableEvents($query->getQuery());

$activity = QueryBuilder::for($query)
    ->with('actor')
    ->allowedFilters(...$filters->allowedFilters($request->user()))
    ->allowedSorts('timestamp')
    ->defaultSort('-timestamp')
    ->orderBy('activity_logs.id', 'desc')
    ->paginate(min($request->query('per_page', 25), 100))
    ->appends($request->query());

return $this->fractal->collection($activity)
    ->transformWith($this->getTransformer(ActivityLogTransformer::class))
    ->addMeta(['available_events' => $events])
    ->toArray();

return $this->fractal->collection($request->user()->apiKeys)
    ->transformWith($this->getTransformer(ApiKeyTransformer::class))
    ->toArray();

$validator->after(function (Validator $validator) {
    if (!is_array($ips = $this->input('allowed_ips'))) {
        return;
    }

    foreach ($ips as $index => $ip) {
        $valid = is_string($ip) && Factory::parseRangeString($ip) !== null;
        $validator->errors()->addIf(!$valid, "allowed_ips.{$index}", '"' . $ip . '" is not a valid IP address or CIDR range.');
    }
});

$token = DB::transaction(function () use ($request) {
    if ($request->user()->apiKeys()->lockForUpdate()->count() >= 25) {
        throw new DisplayException('You have reached the account limit for number of API keys.');
    }

    return $request->user()->createToken(
        $request->input('description'),
        $request->input('allowed_ips')
    );
});

Activity::event('user:api-key.create')
    ->subject($token->accessToken)
    ->property('identifier', $token->accessToken->identifier)
    ->log();

return $this->fractal->item($token->accessToken)
    ->transformWith($this->getTransformer(ApiKeyTransformer::class))
    ->addMeta(['secret_token' => $token->plainTextToken])
    ->toArray();

$key = $request->user()->apiKeys()
    ->where('key_type', ApiKey::TYPE_ACCOUNT)
    ->where('identifier', $identifier)
    ->firstOrFail();

Activity::event('user:api-key.delete')
    ->property('identifier', $key->identifier)
    ->log();

$key->delete();

return new JsonResponse([], JsonResponse::HTTP_NO_CONTENT);

return $this->fractal->collection($request->user()->sshKeys)
    ->transformWith($this->getTransformer(UserSSHKeyTransformer::class))
    ->toArray();

$validator->after(function () {
    $publicKey = $this->input('public_key');
    if (!is_string($publicKey)) {
        return;
    }

    $publicKey = trim($publicKey);
    if (!UserSSHKey::isSupportedPublicKeyMaterial($publicKey)) {
        $this->validator->errors()->add('public_key', 'The public key provided is not valid.');

        return;
    }

    try {
        $this->key = PublicKeyLoader::loadPublicKey($publicKey);
    } catch (NoKeyLoadedException $exception) {
        $this->validator->errors()->add('public_key', 'The public key provided is not valid.');

        return;
    }

    if ($this->key instanceof DSA) {
        $this->validator->errors()->add('public_key', 'DSA keys are not supported.');
    }

    if ($this->key instanceof RSA && $this->key->getLength() < 2048) {
        $this->validator->errors()->add('public_key', 'RSA keys must be at least 2048 bytes in length.');
    }

    $fingerprint = $this->key->getFingerprint('sha256');
    if ($this->user()->sshKeys()->where('fingerprint', $fingerprint)->exists()) {
        $this->validator->errors()->add('public_key', 'The public key provided already exists on your account.');
    }
});

$model = $request->user()->sshKeys()->create([
    'name' => $request->input('name'),
    'public_key' => $request->getPublicKey(),
    'fingerprint' => $request->getKeyFingerprint(),
]);

Activity::event('user:ssh-key.create')
    ->subject($model)
    ->property('fingerprint', $request->getKeyFingerprint())
    ->log();

return $this->fractal->item($model)
    ->transformWith($this->getTransformer(UserSSHKeyTransformer::class))
    ->toArray();

$this->validate($request, ['fingerprint' => ['required', 'string']]);

$key = $request->user()->sshKeys()
    ->where('fingerprint', $request->input('fingerprint'))
    ->first();

if (!is_null($key)) {
    $key->delete();

    Activity::event('user:ssh-key.delete')
        ->subject($key)
        ->property('fingerprint', $key->fingerprint)
        ->log();
}

return new JsonResponse([], JsonResponse::HTTP_NO_CONTENT);