fixes #2355 implement API key management system

- Added API key get, creation, editing, and revocation methods.

- Updated the profile template to include API key management features.

- Updated the database schema to support the new API key system, including additional fields for key management.

- Added client-side JavaScript functionality to handle API key operations and display responses.

- Update tools/htm.ws with the new way to authenticate.

- Restriction of certain api methods when used with an api key

- Backward compatibility with older apps

include/ws_core.inc.php

@@ -517,6 +517,11 @@ Request format: ".@$this->_requestFormat." Response format: ".@$this->_responseF
       return new PwgError(401, 'Access denied');
     }
 
+    if (!$this->isAuthorizedMethodForAPIKEY())
+    {
+      return new PwgError(401, 'Access denied');
+    }
+
     // parameter check and data correction
     $signature = $method['signature'];
     $missing_params = array();
@@ -679,5 +684,27 @@ Request format: ".@$this->_requestFormat." Response format: ".@$this->_responseF
     }
     return $res;
   }
+
+  function isAuthorizedMethodForAPIKEY()
+  {
+    global $conf;
+
+    // if the request is made with an API key (via header or session API key),
+    // we check whether the requested method is on the 
+    // list of prohibited methods ($conf['api_key_forbidden_methods']) for API keys
+    // if it is, access is refused (false)
+    if (
+      defined('PWG_API_KEY_REQUEST')
+      OR (isset($_SESSION['connected_with']) AND 'ws_session_login_api_key' === $_SESSION['connected_with'])
+    )
+    {
+      if (in_array($_REQUEST['method'], $conf['api_key_forbidden_methods']))
+      {
+        return false;
+      }
+    }
+
+    return true;
+  }
 }
 ?>