Add groups accounts fetching with dedicated route

app/Http/Controllers/GroupController.php

@@ -8,6 +8,7 @@ use App\Services\GroupService;
 use App\Http\Requests\GroupStoreRequest;
 use App\Http\Requests\GroupAssignRequest;
 use App\Http\Resources\GroupResource;
+use App\Http\Resources\TwoFAccountCollection;
 use Illuminate\Http\Request;
 
 class GroupController extends Controller
@@ -109,6 +110,21 @@ class GroupController extends Controller
     }
 
 
+    /**
+     * Get accounts assign to the group
+     *
+     * @param  \App\Group  $group
+     * @return \App\Http\Resources\TwoFAccountCollection
+     */
+    public function accounts(Group $group)
+    {
+        $groups = $this->groupService->getAccounts($group);
+            
+        return new TwoFAccountCollection($groups);
+
+    }
+
+
     /**
      * Remove the specified resource from storage.
      *

app/Http/Controllers/TwoFAccountController.php

@@ -8,11 +8,12 @@ use App\Classes\Options;
 use App\Http\Requests\TwoFAccountReorderRequest;
 use App\Http\Requests\TwoFAccountStoreRequest;
 use App\Http\Requests\TwoFAccountUpdateRequest;
-use App\Http\Resources\TwoFAccountReadResource;
-use App\Http\Resources\TwoFAccountStoreResource;
 use App\Http\Requests\TwoFAccountBatchRequest;
 use App\Http\Requests\TwoFAccountUriRequest;
 use App\Http\Requests\TwoFAccountDynamicRequest;
+use App\Http\Resources\TwoFAccountCollection;
+use App\Http\Resources\TwoFAccountReadResource;
+use App\Http\Resources\TwoFAccountStoreResource;
 use App\Services\GroupService;
 use App\Services\TwoFAccountService;
 use Illuminate\Support\Arr;
@@ -51,9 +52,7 @@ class TwoFAccountController extends Controller
      */
     public function index(Request $request)
     {
-        $request->merge(['hideSecret' => true]);
-
-        return TwoFAccountReadResource::collection(TwoFAccount::ordered()->get());
+        return new TwoFAccountCollection(TwoFAccount::ordered()->get());
     }
 
 

app/Http/Resources/TwoFAccountCollection.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Resources\Json\ResourceCollection;
+
+class TwoFAccountCollection extends ResourceCollection
+{
+    /**
+     * The resource that this resource collects.
+     *
+     * @var string
+     */
+    public $collects = 'App\Http\Resources\TwoFAccountReadResource';
+
+
+    /**
+     * Transform the resource collection into an array.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return array
+     */
+    public function toArray($request)
+    {
+        // By default we want this collection to not return the secret.
+        // The underlying TwoFAccountReadResource hides the secret only when withSecret == false.
+        // When withSecret is provided the underlying resource will return secret according to the parameter value
+        // If no withSecret is set we force it to false to ensure the secret will not being returned.
+        if (!$request->has('withSecret')) {
+            $request->merge(['withSecret' => false]);
+        }
+
+        return $this->collection;
+    }
+}

app/Http/Resources/TwoFAccountStoreResource.php

@@ -19,7 +19,10 @@ class TwoFAccountStoreResource extends JsonResource
             'account'       => $this->account,
             'service'       => $this->service,
             'icon'          => $this->icon,
-            'secret'        => $this->when((int) filter_var($request->input('hideSecret'), FILTER_VALIDATE_BOOLEAN) == 0, $this->secret),
+            'secret'        => $this->when(
+                                    !$request->has('withSecret') || (int) filter_var($request->input('withSecret'), FILTER_VALIDATE_BOOLEAN) == 1,
+                                    $this->secret
+                                ),
             'digits'        => $this->digits,
             'algorithm'     => $this->algorithm,
             'period'        => $this->period,

app/Services/GroupService.php

@@ -110,6 +110,20 @@ class GroupService
         return $group;
     }
 
+    /**
+     * Finds twofaccounts assigned to the group
+     * 
+     * @param Group $group The group
+     * 
+     * @return Collection The assigned accounts
+     */
+    public function getAccounts(Group $group) : Collection
+    {
+        $twofaccounts = $group->twofaccounts()->where('group_id', $group->id)->get();
+
+        return $twofaccounts;
+    }
+
 
     /**
      * Determines the destination group

routes/api.php

@@ -45,6 +45,7 @@ Route::group(['middleware' => 'auth:api'], function() {
     Route::get('twofaccounts/{id}/otp', 'TwoFAccountController@otp')->where('id', '[0-9]+');;
     Route::post('twofaccounts/otp', 'TwoFAccountController@otp');
     Route::apiResource('twofaccounts', 'TwoFAccountController');
+    Route::get('groups/{group}/twofaccounts', 'GroupController@accounts');
     Route::post('groups/{group}/assign', 'GroupController@assignAccounts');
     Route::apiResource('groups', 'GroupController');