65 lines
3.8 KiB
PHP
65 lines
3.8 KiB
PHP
<?php
|
|
|
|
use App\Http\Controllers\Api\AnalyticsController;
|
|
use App\Http\Controllers\Api\AppController;
|
|
use App\Http\Controllers\Api\AuditLogController;
|
|
use App\Http\Controllers\Api\AuthorizedAppController;
|
|
use App\Http\Controllers\Api\ClientController;
|
|
use App\Http\Controllers\Api\PersonalAccessTokenController;
|
|
use App\Http\Controllers\Api\UserController;
|
|
use App\Http\Controllers\Api\WebhookController;
|
|
use App\Http\Controllers\Api\UserSessionController;
|
|
use Illuminate\Support\Facades\Route;
|
|
|
|
// Usuario del token actual (whoami) + roles.
|
|
Route::get('/user', [UserController::class, 'me'])->middleware('auth:api');
|
|
|
|
// Directorio de usuarios (admin) — self-service para uno mismo, permiso users.* para el resto.
|
|
// "/users/trashed" tiene que registrarse ANTES de la apiResource: si no, Laravel
|
|
// intenta bindear "trashed" como {user} de la ruta show y nunca llega acá.
|
|
Route::get('/users/trashed', [UserController::class, 'trashed']);
|
|
Route::get('/users/pending', [UserController::class, 'pending']);
|
|
Route::post('/users/{id}/restore', [UserController::class, 'restore'])->whereNumber('id');
|
|
Route::delete('/users/{id}/force', [UserController::class, 'forceDelete'])->whereNumber('id');
|
|
Route::apiResource('users', UserController::class);
|
|
Route::post('/users/{user}/approve', [UserController::class, 'approve']);
|
|
Route::get('/users/{user}/app-roles', [UserController::class, 'appRoles']);
|
|
Route::post('/users/{user}/app-roles', [UserController::class, 'assignAppRole']);
|
|
Route::delete('/users/{user}/app-roles/{clientId}/{role}', [UserController::class, 'revokeAppRole']);
|
|
|
|
// Sesiones (tokens OAuth activos) de un usuario.
|
|
Route::get('/users/{user}/sessions', [UserSessionController::class, 'index']);
|
|
Route::delete('/users/{user}/sessions/{tokenId}', [UserSessionController::class, 'destroy']);
|
|
Route::delete('/users/{user}/sessions', [UserSessionController::class, 'destroyAll']);
|
|
|
|
// Apps registradas en el sistema (admin, para el selector de roles-por-app).
|
|
Route::get('/apps', [AppController::class, 'index']);
|
|
|
|
// Analíticas de uso: sesiones, logins por app, actividad reciente.
|
|
Route::get('/analytics/summary', [AnalyticsController::class, 'summary']);
|
|
|
|
// Audit log: altas/bajas de usuarios, cambios de rol y de clientes OAuth.
|
|
Route::get('/audit-log', [AuditLogController::class, 'index']);
|
|
|
|
// Cuenta propia: clientes OAuth, personal access tokens y apps autorizadas.
|
|
// Todo esto es lo mismo que ofrece la SPA Vue por sesión (routes/web.php), pero
|
|
// vía Bearer token — para que cualquier cliente (Angular, Flutter, etc.) pueda
|
|
// construir su propio panel sin depender de la sesión de Laravel.
|
|
Route::apiResource('clients', ClientController::class)->except(['show'])->names('api.clients');
|
|
Route::post('/clients/{client}/rotate-secret', [ClientController::class, 'rotateSecret']);
|
|
|
|
// Webhooks salientes de un client propio (token.revoked, user.deactivated).
|
|
Route::get('/clients/{client}/webhooks', [WebhookController::class, 'index']);
|
|
Route::post('/clients/{client}/webhooks', [WebhookController::class, 'store']);
|
|
Route::put('/clients/{client}/webhooks/{webhook}', [WebhookController::class, 'update']);
|
|
Route::delete('/clients/{client}/webhooks/{webhook}', [WebhookController::class, 'destroy']);
|
|
Route::get('/clients/{client}/webhooks/{webhook}/deliveries', [WebhookController::class, 'deliveries']);
|
|
Route::post('/clients/{client}/webhooks/{webhook}/deliveries/{delivery}/retry', [WebhookController::class, 'retryDelivery']);
|
|
|
|
Route::get('/personal-access-tokens', [PersonalAccessTokenController::class, 'index']);
|
|
Route::post('/personal-access-tokens', [PersonalAccessTokenController::class, 'store']);
|
|
Route::delete('/personal-access-tokens/{tokenId}', [PersonalAccessTokenController::class, 'destroy']);
|
|
|
|
Route::get('/authorized-apps', [AuthorizedAppController::class, 'index']);
|
|
Route::delete('/authorized-apps/{tokenId}', [AuthorizedAppController::class, 'destroy']);
|