pterodactyl/panel

{
    //
    "require": {
        "php": "^7.4 || ^8.0",
        //
        "lcobucci/jwt": "^4.0"
    },
    //
}

use DateTimeInterface;
use Lcobucci\JWT\Builder;
use Carbon\CarbonImmutable;
use Illuminate\Support\Str;
use Lcobucci\JWT\Signer\Key;
use Pterodactyl\Models\Node;
use Lcobucci\JWT\Signer\Hmac\Sha256;

class NodeJWTService
{
    private $claims = [];

    private $expiresAt;

    public function setClaims(array $claims)
    {
        $this->claims = $claims;

        return $this;
    }

    public function setExpiresAt(DateTimeInterface $date)
    {
        $this->expiresAt = $date->getTimestamp();

        return $this;
    }

    public function handle(Node $node, string $identifiedBy)
    {
        $signer = new Sha256;

        $builder = (new Builder)->issuedBy(config('app.url'))
            ->permittedFor($node->getConnectionAddress())
            ->identifiedBy(hash('sha256', $identifiedBy), true)
            ->issuedAt(CarbonImmutable::now()->getTimestamp())
            ->canOnlyBeUsedAfter(CarbonImmutable::now()->subMinutes(5)->getTimestamp());

        if ($this->expiresAt) {
            $builder = $builder->expiresAt($this->expiresAt);
        }

        foreach ($this->claims as $key => $value) {
            $builder = $builder->withClaim($key, $value);
        }

        return $builder
            ->withClaim('unique_id', Str::random(16))
            ->getToken($signer, new Key($node->getDecryptedKey()));
    }
}

use Carbon\CarbonImmutable;
use Pterodactyl\Models\User;
use Pterodactyl\Models\Server;
use Illuminate\Http\JsonResponse;
use Pterodactyl\Services\Nodes\NodeJWTService;
use Pterodactyl\Http\Controllers\Api\Client\ClientApiController;
use Pterodactyl\Http\Requests\Api\Client\Servers\Files\UploadFileRequest;

class FileUploadController extends ClientApiController
{
    private $jwtService;

    public function __construct(
        NodeJWTService $jwtService
    ) {
        parent::__construct();

        $this->jwtService = $jwtService;
    }

    public function __invoke(UploadFileRequest $request, Server $server)
    {
        return new JsonResponse([
            'object' => 'signed_url',
            'attributes' => [
                'url' => $this->getUploadUrl($server, $request->user()),
            ],
        ]);
    }

    protected function getUploadUrl(Server $server, User $user)
    {
        $token = $this->jwtService
            ->setExpiresAt(CarbonImmutable::now()->addMinutes(15))
            ->setClaims([
                'server_uuid' => $server->uuid,
            ])
            ->handle($server->node, $user->id . $server->uuid);

        return sprintf(
            '%s/upload/file?token=%s',
            $server->node->getConnectionAddress(),
            $token->__toString()
        );
    }
}