171 lines
7.1 KiB
Markdown
171 lines
7.1 KiB
Markdown
# User API
|
|
|
|
## Scope
|
|
|
|
This file documents the externally reachable API and webhook surfaces discovered in the repository.
|
|
|
|
Primary files:
|
|
|
|
- `Panel/ogp_api.php`
|
|
- `Panel/status_api.php`
|
|
- `Website/api/create_order.php`
|
|
- `Website/api/capture_order.php`
|
|
- `Website/api/log_error.php`
|
|
- `Website/webhook.php`
|
|
- `Website/paypal/webhook.php`
|
|
|
|
## Panel Automation API
|
|
|
|
Main endpoint:
|
|
|
|
- `Panel/ogp_api.php`
|
|
|
|
Transport:
|
|
|
|
- GET, POST, or JSON request body
|
|
- response is usually JSON
|
|
- `setting/get` returns plain text
|
|
|
|
Authentication:
|
|
|
|
- token-based
|
|
- token created through `token/create`
|
|
- host allowlist can be enforced with `api_authorized.hosts` and `api_authorized.fwd_hosts`
|
|
|
|
Important notes:
|
|
|
|
- the API is not a public anonymous API
|
|
- some routes are meaningful for normal users
|
|
- many routes are effectively admin-only because they mutate remote servers, create homes, or manage users
|
|
|
|
### Authentication Endpoints
|
|
|
|
| Endpoint | Auth | Purpose | Parameters | Returns |
|
|
|---|---|---|---|---|
|
|
| `ogp_api.php?token/create` | panel username/password | issue API token | `user`, `password` | JSON token payload |
|
|
| `ogp_api.php?token/test` | token | verify token | `token` | role/status |
|
|
|
|
### User-Visible Game Server Actions
|
|
|
|
| Endpoint | Auth | Purpose | Parameters | Returns |
|
|
|---|---|---|---|---|
|
|
| `gamemanager/start` | token + home access | start server | `ip`, `port`, optional `mod_key` | JSON status |
|
|
| `gamemanager/stop` | token + home access | stop server | `ip`, `port`, optional `mod_key` | JSON status |
|
|
| `gamemanager/restart` | token + home access | restart server | `ip`, `port`, optional `mod_key` | JSON status |
|
|
| `gamemanager/rcon` | token + home access | send RCON/console command | `ip`, `port`, optional `mod_key`, `command` | JSON command result |
|
|
| `gamemanager/update` | token + home access | update server | `ip`, `port`, optional `mod_key`, `type`, optional `manual_url` | JSON status |
|
|
| `litefm/list` | token + home access | list files | `ip`, `port`, `relative_path` | JSON listing |
|
|
| `litefm/get` | token + home access | read file | `ip`, `port`, `relative_path` | JSON file content |
|
|
| `litefm/save` | token + home access | write file | `ip`, `port`, `relative_path`, `contents` | JSON status |
|
|
| `litefm/remove` | token + home access | delete file | `ip`, `port`, `relative_path` | JSON status |
|
|
| `addonsmanager/list` | token | list add-on templates | `token` | JSON list |
|
|
| `addonsmanager/install` | token + home access | install named add-on | `ip`, `port`, `addon_id` | JSON status |
|
|
| `steam_workshop/install` | token + home access | legacy Workshop install | `ip`, `port`, optional `mod_key`, `mods_list` | JSON status |
|
|
| `server_content/run_scheduled_action` | token + home access | trigger typed server-content action | `home_id`, `action`, optional `options` | JSON status |
|
|
|
|
### Admin-Oriented API Routes
|
|
|
|
| Endpoint | Auth | Purpose | Parameters | Returns |
|
|
|---|---|---|---|---|
|
|
| `server/list` | admin token | list remote agents | `token` | JSON list |
|
|
| `server/status` | admin token | status of remote agent | `remote_server_id` | JSON status |
|
|
| `server/restart` | admin token | restart agent | `remote_server_id` | JSON status |
|
|
| `server/create` | admin token | create remote agent record | agent connection fields | JSON status |
|
|
| `server/remove` | admin token | remove remote agent record | `remote_server_id` | JSON status |
|
|
| `server/add_ip` | admin token | add IP to agent | `remote_server_id`, `ip` | JSON status |
|
|
| `server/remove_ip` | admin token | remove IP from agent | `remote_server_id`, `ip` | JSON status |
|
|
| `server/list_ips` | admin token | list assigned IPs | `remote_server_id` | JSON list |
|
|
| `server/edit_ip` | admin token | edit assigned IP | `remote_server_id`, `old_ip`, `new_ip` | JSON status |
|
|
| `user_games/list_games` | token | list game configs | `system`, `architecture` | JSON list |
|
|
| `user_games/list_servers` | token | list homes visible to token | none | JSON list |
|
|
| `user_games/create` | admin token | create game home | remote server, config, port, passwords, slots, affinity, nice | JSON status |
|
|
| `user_games/clone` | admin token | clone home | origin + new home fields | JSON status |
|
|
| `user_games/set_expiration` | admin token | change home expiry | `home_id`, `timestamp` | JSON status |
|
|
| `user_admin/*` | admin token | user CRUD and assignments | varies | JSON status |
|
|
| `gamemanager_admin/reorder` | admin token | reorder homes in UI | token | JSON status |
|
|
| `setting/get` | token | read setting | `setting_name` | plain text or `-1` |
|
|
|
|
## Public Status API
|
|
|
|
Endpoint:
|
|
|
|
- `Panel/status_api.php?token=...`
|
|
|
|
Authentication:
|
|
|
|
- shared query token stored in `status_api_local.php`
|
|
|
|
Purpose:
|
|
|
|
- public, read-only node summary
|
|
- intended for lightweight dashboards or public status pages
|
|
|
|
Behavior:
|
|
|
|
- caches agent stats locally for 30 seconds
|
|
- probes agents with TCP reachability
|
|
- normalizes CPU, memory, and disk stats when available
|
|
|
|
Returns:
|
|
|
|
- JSON object with `generated_at` and `nodes[]`
|
|
|
|
## Scheduler-As-API
|
|
|
|
The scheduler does not call agents directly at runtime. It stores cron lines on the agent that usually call back into:
|
|
|
|
- `Panel/ogp_api.php?gamemanager/*`
|
|
- `Panel/ogp_api.php?server_content/run_scheduled_action`
|
|
|
|
This makes `ogp_api.php` part of the internal scheduler runtime contract.
|
|
|
|
## Website API Endpoints
|
|
|
|
### Payment Creation And Capture
|
|
|
|
| Endpoint | Auth | Purpose | Parameters | Returns |
|
|
|---|---|---|---|---|
|
|
| `Website/api/create_order.php` | storefront session / checkout context | create PayPal order | checkout/cart payload | JSON PayPal order response |
|
|
| `Website/api/capture_order.php` | storefront session / checkout context | capture approved PayPal order | order/capture payload | JSON capture result |
|
|
|
|
These are thin compatibility wrappers that dispatch into the current billing runtime selected by:
|
|
|
|
- `Website/_compat_include.php`
|
|
- `website_billing_runtime_file(...)`
|
|
|
|
### Client Error Logging
|
|
|
|
| Endpoint | Auth | Purpose | Parameters | Returns |
|
|
|---|---|---|---|---|
|
|
| `Website/api/log_error.php` | none | receive cart/client JS error payloads | JSON body | JSON `{status: logged}` or error |
|
|
|
|
Security note:
|
|
|
|
- this endpoint is intentionally open
|
|
- it writes to `Website/logs/client_errors.log`
|
|
- rate limiting is not obvious in the current implementation
|
|
|
|
### Webhooks
|
|
|
|
| Endpoint | Source | Purpose | Auth Model |
|
|
|---|---|---|---|
|
|
| `Website/webhook.php` | PayPal | verify and process payment webhook | PayPal OAuth + webhook signature verification |
|
|
| `Website/paypal/webhook.php` | PayPal | compatibility entrypoint forwarding to `Website/webhook.php` runtime | same |
|
|
| `Panel/modules/billing/webhook.php` | payment runtime compatibility | billing-side webhook entrypoint | gateway-specific |
|
|
|
|
## Security Controls
|
|
|
|
| Control | Where |
|
|
|---|---|
|
|
| token auth | `Panel/ogp_api.php` |
|
|
| host allowlist | `api_authorized.hosts`, `api_authorized.fwd_hosts`, `settings/api_hosts.php` |
|
|
| role / ownership checks | inside `api_*` handlers in `ogp_api.php` |
|
|
| webhook signature verification | `Website/webhook.php` |
|
|
|
|
## Search Coverage Used For This Document
|
|
|
|
- `rg -n "^function api_" Panel/ogp_api.php`
|
|
- `sed -n '1,240p' Panel/ogp_api.php`
|
|
- `sed -n '1,240p' Panel/status_api.php`
|
|
- `find Website/api -maxdepth 1 -type f`
|
|
- `sed -n '1,220p' Website/webhook.php`
|