fix(security): enforce team access on mutable actions

Authorize cloud provider token access, audit sensitive operations, and
standardize public IDs across deployment and resource flows.

app/Livewire/Security/CloudProviderTokens.php

@@ -4,6 +4,7 @@ namespace App\Livewire\Security;
 
 use App\Models\CloudProviderToken;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\Http;
 use Livewire\Component;
 
 class CloudProviderTokens extends Component
@@ -57,6 +58,14 @@ class CloudProviderTokens extends Component
             } else {
                 $this->dispatch('error', 'Unknown provider.');
             }
+
+            auditLog('ui.cloud_token.validated', [
+                'team_id' => currentTeam()->id,
+                'cloud_token_uuid' => $token->uuid,
+                'cloud_token_name' => $token->name,
+                'provider' => $token->provider,
+                'valid' => $isValid ?? false,
+            ]);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -65,7 +74,7 @@ class CloudProviderTokens extends Component
     private function validateHetznerToken(string $token): bool
     {
         try {
-            $response = \Illuminate\Support\Facades\Http::withToken($token)
+            $response = Http::withToken($token)
                 ->timeout(10)
                 ->get('https://api.hetzner.cloud/v1/servers?per_page=1');
 
@@ -78,7 +87,7 @@ class CloudProviderTokens extends Component
     private function validateDigitalOceanToken(string $token): bool
     {
         try {
-            $response = \Illuminate\Support\Facades\Http::withToken($token)
+            $response = Http::withToken($token)
                 ->timeout(10)
                 ->get('https://api.digitalocean.com/v2/account');
 
@@ -102,9 +111,19 @@ class CloudProviderTokens extends Component
                 return;
             }
 
+            $tokenUuid = $token->uuid;
+            $tokenName = $token->name;
+            $tokenProvider = $token->provider;
             $token->delete();
             $this->loadTokens();
 
+            auditLog('ui.cloud_token.deleted', [
+                'team_id' => currentTeam()->id,
+                'cloud_token_uuid' => $tokenUuid,
+                'cloud_token_name' => $tokenName,
+                'provider' => $tokenProvider,
+            ]);
+
             $this->dispatch('success', 'Cloud provider token deleted successfully.');
         } catch (\Throwable $e) {
             return handleError($e, $this);