Leantime's JSON-RPC exposed API-key creation without authorization; a Claude-co-authored refactor added the createApiKeyWithProjects method the advisory names, letting any logged-in user mint an admin key.

+            'user' => $row['username'],+            'phone' => '',+            'status' => ($postValues['status'] ?? $row['status']),+            'role' => ($postValues['role'] ?? $row['role']),

+            'hours' => '',+            'wage' => '',+            'clientId' => '',+            'password' => '',+            'source' => 'api',+            'pwReset' => '',+        ];++        $this->userRepo->editUser($values, $id);++        $this->reconcileProjectRelations($id, $projects);++        return true;+    }++    /**+     * Creates a new API key and reconciles its project relations.+     *+     * @param  array  $values  Basic user/key values (firstname, role, ...)+     * @param  array|null  $projects  Selected project ids, or null when none submitted+     * @return array|false The created key values on success, false on failure+     *+     * @throws Exception

+     *+     * @api+     */+    public function createApiKeyWithProjects(array $values, ?array $projects): array|false+    {+        $apiKeyValues = $this->createAPIKey($values);+

+        if ($apiKeyValues === false) {+            return false;+        }++        if (is_array($projects) && count($projects) > 0) {+            $this->reconcileProjectRelations((int) $apiKeyValues['id'], $projects);+        }++        return $apiKeyValues;+    }++    /**+     * Reconciles the project relations for an API key (user).+     *+     * Mirrors the legacy controller behaviour: a leading "0" selection (or no+     * selection at all) clears all relations, otherwise the relations are set.+     *+     * @param  int  $id  API key (user) id+     * @param  array|null  $projects  Selected project ids+     */+    private function reconcileProjectRelations(int $id, ?array $projects): void+    {+        if (is_array($projects) && isset($projects[0]) && $projects[0] !== '0') {+            $this->projectRepo->editUserProjectRelations($id, $projects);++            return;+        }++        $this->projectRepo->deleteAllProjectRelations($id);+    }++    /**+     * Returns the list of project ids an API key (user) is related to.+     *+     * @param  int  $id  API key (user) id+     * @return array List of project ids+     *+     * @api+     */+    public function getProjectRelationIds(int $id): array+    {+        $projects = $this->projectRepo->getUserProjectRelation($id);++        $relations = [];+        foreach ($projects as $projectId) {+            $relations[] = $projectId['projectId'];+        }++        return $relations;+    }++    /**+     * Returns all projects (for populating the API key form selectors).+     *+     * @api+     */

@@ -6,8 +6,10 @@ use Illuminate\Contracts\Container\BindingResolutionException; use Illuminate\Support\Arr; use Illuminate\Support\Str;+use Leantime\Core\Auth\Permissions\RequiresPermission; use Leantime\Core\Events\DispatchesEvents; use Leantime\Domain\Api\Contracts\StaticAssetType;+use Leantime\Domain\Api\Permissions\ApiPermissions; use Leantime\Domain\Api\Repositories\Api as ApiRepository; use Leantime\Domain\Auth\Services\UserSessionBuilder; use Leantime\Domain\Menu\Repositories\Menu as MenuRepository;

@@ -120,6 +122,7 @@ public function setApiUserSession(array $user, bool $isExternalAuth = false)

      *      * @api      */+    #[RequiresPermission(ApiPermissions::MANAGE, global: true)]     public function createAPIKey(array $values): bool|array     {         $user = $this->randomStr(32);

@@ -148,6 +151,7 @@ public function createAPIKey(array $values): bool|array

      *      * @api      */+    #[RequiresPermission(ApiPermissions::MANAGE, global: true)]     public function getApiKeyFormValues(int $id): array     {         if ($id <= 0) {

@@ -186,6 +190,7 @@ public function getApiKeyFormValues(int $id): array

      *      * @api      */+    #[RequiresPermission(ApiPermissions::MANAGE, global: true)]     public function updateApiKey(int $id, array $postValues, ?array $projects): bool     {         if ($id <= 0) {

@@ -227,6 +232,7 @@ public function updateApiKey(int $id, array $postValues, ?array $projects): bool

      *      * @api      */+    #[RequiresPermission(ApiPermissions::MANAGE, global: true)]     public function createApiKeyWithProjects(array $values, ?array $projects): array|false     {         $apiKeyValues = $this->createAPIKey($values);

@@ -270,6 +276,7 @@ private function reconcileProjectRelations(int $id, ?array $projects): void

      *      * @api      */+    #[RequiresPermission(ApiPermissions::MANAGE, global: true)]     public function getProjectRelationIds(int $id): array     {         $projects = $this->projectRepo->getUserProjectRelation($id);

@@ -322,6 +329,7 @@ public function generateFormToken(): void

      *      * @api      */+    #[RequiresPermission(ApiPermissions::MANAGE, global: true)]     public function getAPIKeys(): false|array     {         $keys = $this->userRepo->getAllBySource('api');

@@ -0,0 +1,37 @@+<?php++namespace Leantime\Domain\Api\Permissions;

++use Leantime\Core\Auth\Permissions\Permission;

+use Leantime\Core\Auth\Permissions\ProvidesPermissions;++/**+ * The API (key management) permission vocabulary — the verbs only.+ *+ * Leantime API keys act as service accounts (a key IS a user row with a role), so creating,+ * listing, and editing them is an installation-wide administrative capability — the management+ * UI (ApiKey / NewApiKey / DelAPIKey controllers) is already `authOrRedirect([owner, admin])`.+ * The single verb below is therefore COMPANY-WIDE (`projectScoped = false`); call sites gate with+ * `#[RequiresPermission(ApiPermissions::MANAGE, global: true)]`, which by the default role map+ * lands on admin/owner only.+ *+ * Note: authenticating WITH an existing key (getAPIKeyUser) is not gated by this — that is the+ * auth primitive itself, invoked by the AuthCheck middleware, not a management action.+ */+final class ApiPermissions implements ProvidesPermissions+{+    /** Create, list, edit, or remove API keys / service-account credentials (company-wide). */+    public const MANAGE = 'api.manage';++    public function domain(): string+    {

+        return 'api';+    }+

+    public function permissions(): array+    {+        return [+            new Permission(self::MANAGE, 'Manage API keys', false),+        ];+    }+}