fix(security): enforce GitLab App authorization parity with GitHub

GitlabAppPolicy previously allowed any authenticated user to update,
delete, and create GitLab sources. Align it with GithubAppPolicy, require
Application create authorization on the private-repo wizard, and reject
OAuth callbacks from non-admins so members cannot escalate privileges.

app/Http/Controllers/Webhook/Gitlab.php

@@ -40,6 +40,11 @@ class Gitlab extends Controller
 
             $gitlabApp = GitlabApp::whereKey(data_get($payload, 'gitlab_app_id'))->firstOrFail();
 
+            // Only users who may administer the source can complete OAuth and store tokens.
+            if (! $request->user()->can('update', $gitlabApp)) {
+                return redirect()->route('source.all')->with('error', 'You are not authorized to connect this GitLab App.');
+            }
+
             $baseUrl = rtrim($gitlabApp->html_url, '/');
 
             $response = Http::asForm()->post("{$baseUrl}/oauth/token", [

app/Livewire/Project/New/GitlabPrivateRepository.php

@@ -7,11 +7,14 @@ use App\Models\GitlabApp;
 use App\Models\Project;
 use App\Rules\ValidGitBranch;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Route;
 use Livewire\Component;
 
 class GitlabPrivateRepository extends Component
 {
+    use AuthorizesRequests;
+
     public $current_step = 'gitlab_apps';
 
     public $gitlab_apps;
@@ -158,6 +161,8 @@ class GitlabPrivateRepository extends Component
     public function submit()
     {
         try {
+            $this->authorize('create', Application::class);
+
             $validator = validator([
                 'selected_repository_path' => $this->selected_repository_path,
                 'selected_branch_name' => $this->selected_branch_name,

app/Policies/GitlabAppPolicy.php

@@ -7,44 +7,69 @@ use App\Models\User;
 
 class GitlabAppPolicy
 {
+    /**
+     * Determine whether the user can view any models.
+     */
     public function viewAny(User $user): bool
     {
         return true;
     }
 
+    /**
+     * Determine whether the user can view the model.
+     */
     public function view(User $user, GitlabApp $gitlabApp): bool
     {
-        return true;
+        if ($gitlabApp->is_system_wide) {
+            return true;
+        }
+
+        return $user->teams->contains('id', $gitlabApp->team_id);
     }
 
+    /**
+     * Determine whether the user can create models.
+     */
     public function create(User $user): bool
     {
-        return true;
+        return $user->isAdmin();
     }
 
+    /**
+     * Determine whether the user can update the model.
+     */
     public function update(User $user, GitlabApp $gitlabApp): bool
     {
         if ($gitlabApp->is_system_wide) {
-            return true;
+            return $user->canAccessSystemResources();
         }
 
-        return true;
+        return $user->isAdminOfTeam($gitlabApp->team_id);
     }
 
+    /**
+     * Determine whether the user can delete the model.
+     */
     public function delete(User $user, GitlabApp $gitlabApp): bool
     {
         if ($gitlabApp->is_system_wide) {
-            return true;
+            return $user->canAccessSystemResources();
         }
 
-        return true;
+        return $user->isAdminOfTeam($gitlabApp->team_id);
     }
 
+    /**
+     * Determine whether the user can restore the model.
+     */
     public function restore(User $user, GitlabApp $gitlabApp): bool
     {
         return false;
     }
 
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
     public function forceDelete(User $user, GitlabApp $gitlabApp): bool
     {
         return false;