squidex/src/Squidex/Areas/Api/Controllers/Apps/AppClientsController.cs

// ==========================================================================
//  Squidex Headless CMS
// ==========================================================================
//  Copyright (c) Squidex UG (haftungsbeschränkt)
//  All rights reserved. Licensed under the MIT license.
// ==========================================================================

using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using Squidex.Areas.Api.Controllers.Apps.Models;
using Squidex.Domain.Apps.Entities.Apps.Commands;
using Squidex.Infrastructure.Commands;
using Squidex.Pipeline;
using Squidex.Shared;

namespace Squidex.Areas.Api.Controllers.Apps
{
    /// <summary>
    /// Manages and configures apps.
    /// </summary>
    [ApiExplorerSettings(GroupName = nameof(Apps))]
    public sealed class AppClientsController : ApiController
    {
        public AppClientsController(ICommandBus commandBus)
            : base(commandBus)
        {
        }

        /// <summary>
        /// Get app clients.
        /// </summary>
        /// <param name="app">The name of the app.</param>
        /// <returns>
        /// 200 => Client keys returned.
        /// 404 => App not found.
        /// </returns>
        /// <remarks>
        /// Gets all configured clients for the app with the specified name.
        /// </remarks>
        [HttpGet]
        [Route("apps/{app}/clients/")]
        [ProducesResponseType(typeof(ClientDto[]), 200)]
        [ApiPermission(Permissions.AppClientsRead)]
        [ApiCosts(0)]
        public IActionResult GetClients(string app)
        {
            var response = App.Clients.Select(ClientDto.FromKvp).ToList();

            Response.Headers["ETag"] = App.Version.ToString();

            return Ok(response);
        }

        /// <summary>
        /// Create a new app client.
        /// </summary>
        /// <param name="app">The name of the app.</param>
        /// <param name="request">Client object that needs to be added to the app.</param>
        /// <returns>
        /// 201 => Client generated.
        /// 404 => App not found.
        /// </returns>
        /// <remarks>
        /// Create a new client for the app with the specified name.
        /// The client secret is auto generated on the server and returned. The client does not exire, the access token is valid for 30 days.
        /// </remarks>
        [HttpPost]
        [Route("apps/{app}/clients/")]
        [ProducesResponseType(typeof(ClientDto), 201)]
        [ApiPermission(Permissions.AppClientsCreate)]
        [ApiCosts(1)]
        public async Task<IActionResult> PostClient(string app, [FromBody] CreateClientDto request)
        {
            var command = request.ToCommand();

            await CommandBus.PublishAsync(command);

            var response = ClientDto.FromCommand(command);

            return CreatedAtAction(nameof(GetClients), new { app }, response);
        }

        /// <summary>
        /// Updates an app client.
        /// </summary>
        /// <param name="app">The name of the app.</param>
        /// <param name="clientId">The id of the client that must be updated.</param>
        /// <param name="request">Client object that needs to be updated.</param>
        /// <returns>
        /// 204 => Client updated.
        /// 400 => Client request not valid.
        /// 404 => Client or app not found.
        /// </returns>
        /// <remarks>
        /// Only the display name can be changed, create a new client if necessary.
        /// </remarks>
        [HttpPut]
        [Route("apps/{app}/clients/{clientId}/")]
        [ApiPermission(Permissions.AppClientsUpdate)]
        [ApiCosts(1)]
        public async Task<IActionResult> PutClient(string app, string clientId, [FromBody] UpdateClientDto request)
        {
            await CommandBus.PublishAsync(request.ToCommand(clientId));

            return NoContent();
        }

        /// <summary>
        /// Revoke an app client
        /// </summary>
        /// <param name="app">The name of the app.</param>
        /// <param name="clientId">The id of the client that must be deleted.</param>
        /// <returns>
        /// 204 => Client revoked.
        /// 404 => Client or app not found.
        /// </returns>
        /// <remarks>
        /// The application that uses this client credentials cannot access the API after it has been revoked.
        /// </remarks>
        [HttpDelete]
        [Route("apps/{app}/clients/{clientId}/")]
        [ApiPermission(Permissions.AppClientsDelete)]
        [ApiCosts(1)]
        public async Task<IActionResult> DeleteClient(string app, string clientId)
        {
            await CommandBus.PublishAsync(new RevokeClient { Id = clientId });

            return NoContent();
        }
    }
}