fixes #2355 implement API key management system

- Added API key get, creation, editing, and revocation methods.

- Updated the profile template to include API key management features.

- Updated the database schema to support the new API key system, including additional fields for key management.

- Added client-side JavaScript functionality to handle API key operations and display responses.

- Update tools/htm.ws with the new way to authenticate.

- Restriction of certain api methods when used with an api key

- Backward compatibility with older apps

include/user.inc.php

@@ -56,6 +56,44 @@ if (isset($_GET['auth']))
   auth_key_login($_GET['auth']);
 }
 
+// HTTP_AUTHORIZATION api_key
+if (
+  defined('IN_WS')
+  and isset($_SERVER['HTTP_AUTHORIZATION'])
+  and !empty($_SERVER['HTTP_AUTHORIZATION']) 
+  and isset($_REQUEST['method'])
+)
+{
+  $auth_header = pwg_db_real_escape_string($_SERVER['HTTP_AUTHORIZATION']) ?? null;
+  
+  if ($auth_header)
+  {
+    $authenticate = auth_key_login($auth_header, true);
+    if (!$authenticate)
+    {
+      include_once(PHPWG_ROOT_PATH.'include/ws_init.inc.php');
+      $service->sendResponse(new PwgError(401, 'Invalid api_key'));
+      exit;
+    }
+    define('PWG_API_KEY_REQUEST', true);
+
+    // set pwg_token for api_key request
+    if (isset($_POST['pwg_token']))
+    {
+      $_POST['pwg_token'] = get_pwg_token();
+    }
+
+    if (isset($_GET['pwg_token']))
+    {
+      $_GET['pwg_token'] = get_pwg_token();
+    }
+
+    // logger
+    global $logger;
+    $logger->info('[api_key][pkid='.explode(':', $auth_header)[0].'][method='.$_REQUEST['method'].']');
+  }
+}
+
 if (
   defined('IN_WS')
   and isset($_REQUEST['method'])
@@ -70,6 +108,7 @@ if (
     $service->sendResponse(new PwgError(999, 'Invalid username/password'));
     exit();
   }
+  $_SESSION['connected_with'] = 'pwg.images.uploadAsync';
 }
 
 $page['user_use_cache'] = true;