feat: add proper api with few endpoints

application/config/config.php

@@ -455,7 +455,7 @@
 $config['csrf_cookie_name'] = 'csrf_cookie_name';
 $config['csrf_expire'] = 7200;
 $config['csrf_regenerate'] = TRUE;
-$config['csrf_exclude_uris'] = array('upload/image');
+$config['csrf_exclude_uris'] = array('upload/image', 'api/.*');
 
 /*
 |--------------------------------------------------------------------------

application/config/routes.php

@@ -81,6 +81,9 @@
 $route['admin/campagnes/delete/(:any)'] = 'admin/delete_campaign/$1';
 $route['admin/campagnes/edit/(:any)'] = 'admin/edit_campaign/$1';
 $route['admin/campagnes/toggle'] = 'admin/toggle_campaign_active';
+$route['admin/api-keys'] = 'admin/api_keys';
+$route['admin/api-keys/create'] = 'admin/api_keys_create';
+$route['admin/api-keys/revoke/(:num)'] = 'admin/api_keys_revoke/$1';
 
 
 // MpDashboard
@@ -186,8 +189,28 @@
 $route['parrainages-2022'] = 'parrainages/index';
 // FAQ
 $route['faq'] = 'faq/index';
-// API
-$route['api/(:any)/(:any)'] = 'api/index/$1/$2';
+// API (secured with API key)
+// Votes bruts (votes_info)
+$route['api/votes'] = 'api/votes/index';
+$route['api/votes/meta'] = 'api/votes/meta';
+$route['api/votes/(:any)'] = 'api/votes/index/$1';
+// Votes décryptés (votes_datan)
+$route['api/decrypted_votes'] = 'api/decrypted_votes/index';
+$route['api/decrypted_votes/meta'] = 'api/decrypted_votes/meta';
+$route['api/decrypted_votes/(:num)'] = 'api/decrypted_votes/index/$1';
+// Votes non décryptés
+$route['api/non_decrypted_votes'] = 'api/non_decrypted_votes/index';
+$route['api/non_decrypted_votes/meta'] = 'api/non_decrypted_votes/meta';
+$route['api/non_decrypted_votes/(:any)'] = 'api/non_decrypted_votes/index/$1';
+// Exposés des motifs
+$route['api/exposes'] = 'api/exposes/index';
+$route['api/exposes/meta'] = 'api/exposes/meta';
+$route['api/exposes/stats'] = 'api/exposes/stats';
+$route['api/exposes/by_vote/(:num)/(:num)'] = 'api/exposes/by_vote/$1/$2';
+$route['api/exposes/(:num)'] = 'api/exposes/index/$1';
+
+// API (public)
+$route['api/(:any)/(:any)'] = 'legacy_api/index/$1/$2';
 // LOGIN & REGISTER
 $route['login'] = 'users/login';
 $route['register/(:any)'] = 'users/register/$1';

application/controllers/Admin.php

@@ -868,7 +868,87 @@ public function toggle_campaign_active()
       }
 
       $this->campaign_model->set_active_status($id, $is_active);
-      redirect('admin/campagnes'); 
-    } 
-  }  
+      redirect('admin/campagnes');
+    }
+
+    // API KEYS MANAGEMENT (admin only)
+
+    public function api_keys()
+    {
+      $data = $this->data;
+
+      if ($data['usernameType'] != 'admin') {
+        show_404();
+      }
+
+      $this->load->model('api_key_model');
+      $this->load->model('user_model');
+
+      $data['title'] = 'Gestion des clés API';
+      $data['keys'] = $this->api_key_model->get_all_keys();
+
+      // Meta
+      $data['title_meta'] = $data['title'] . ' - Dashboard | Datan';
+
+      // Views
+      $this->load->view('dashboard/header', $data);
+      $this->load->view('dashboard/api-keys/list', $data);
+      $this->load->view('dashboard/footer');
+    }
+
+    public function api_keys_create()
+    {
+      $data = $this->data;
+
+      if ($data['usernameType'] != 'admin') {
+        show_404();
+      }
+
+      $this->load->model('api_key_model');
+      $this->load->model('user_model');
+
+      $data['title'] = 'Créer une clé API';
+      $data['users'] = $this->user_model->get_team_users();
+
+      // Available endpoints and methods
+      $data['endpoints'] = $this->api_key_model->get_available_endpoints();
+
+      // Form validation
+      $this->form_validation->set_rules('name', 'Nom', 'required');
+      $this->form_validation->set_rules('user_id', 'Utilisateur', 'required');
+
+      if ($this->form_validation->run() === FALSE) {
+        $data['title_meta'] = $data['title'] . ' - Dashboard | Datan';
+        $this->load->view('dashboard/header', $data);
+        $this->load->view('dashboard/api-keys/create', $data);
+        $this->load->view('dashboard/footer');
+      } else {
+        $permissions = $this->input->post('permissions');
+        $result = $this->api_key_model->create_key(
+          $this->input->post('user_id'),
+          $this->input->post('name'),
+          $permissions
+        );
+
+        // Store the key in flash data to show it once
+        $this->session->set_flashdata('new_api_key', $result['key']);
+        redirect('admin/api-keys');
+      }
+    }
+
+    public function api_keys_revoke($id)
+    {
+      $data = $this->data;
+
+      if ($data['usernameType'] != 'admin') {
+        show_404();
+      }
+
+      $this->load->model('api_key_model');
+      $this->api_key_model->revoke_key($id);
+
+      $this->session->set_flashdata('success', 'Clé API révoquée avec succès');
+      redirect('admin/api-keys');
+    }
+  }
 ?>

application/controllers/Api.php → application/controllers/Legacy_api.php

@@ -1,5 +1,5 @@
 <?php
-class Api extends CI_Controller
+class Legacy_api extends CI_Controller
 {
     // FORBIDDEN LIST
     private $modelAllowed = array();