fix(auth): enforce authorization checks across API and Livewire components

- Add authorization checks to API controller endpoints (view, create, update, delete)
- Wrap Livewire component methods with try-catch for consistent error handling
- Add AuthorizesRequests trait to components requiring authorization checks
- Ensure all sensitive operations verify user permissions before execution
- Implement unified error handling with handleError() helper function

app/Policies/ApiTokenPolicy.php

@@ -12,11 +12,6 @@ class ApiTokenPolicy
      */
     public function viewAny(User $user): bool
     {
-        // Authorization temporarily disabled
-        /*
-        // Users can view their own API tokens
-        return true;
-        */
         return true;
     }
 
@@ -25,12 +20,7 @@ class ApiTokenPolicy
      */
     public function view(User $user, PersonalAccessToken $token): bool
     {
-        // Authorization temporarily disabled
-        /*
-        // Users can only view their own tokens
         return $user->id === $token->tokenable_id && $token->tokenable_type === User::class;
-        */
-        return true;
     }
 
     /**
@@ -38,11 +28,6 @@ class ApiTokenPolicy
      */
     public function create(User $user): bool
     {
-        // Authorization temporarily disabled
-        /*
-        // All authenticated users can create their own API tokens
-        return true;
-        */
         return true;
     }
 
@@ -51,12 +36,7 @@ class ApiTokenPolicy
      */
     public function update(User $user, PersonalAccessToken $token): bool
     {
-        // Authorization temporarily disabled
-        /*
-        // Users can only update their own tokens
         return $user->id === $token->tokenable_id && $token->tokenable_type === User::class;
-        */
-        return true;
     }
 
     /**
@@ -64,12 +44,7 @@ class ApiTokenPolicy
      */
     public function delete(User $user, PersonalAccessToken $token): bool
     {
-        // Authorization temporarily disabled
-        /*
-        // Users can only delete their own tokens
         return $user->id === $token->tokenable_id && $token->tokenable_type === User::class;
-        */
-        return true;
     }
 
     /**
@@ -77,11 +52,6 @@ class ApiTokenPolicy
      */
     public function manage(User $user): bool
     {
-        // Authorization temporarily disabled
-        /*
-        // All authenticated users can manage their own API tokens
-        return true;
-        */
         return true;
     }
 
@@ -90,7 +60,6 @@ class ApiTokenPolicy
      */
     public function useRootPermissions(User $user): bool
     {
-        // Only admins and owners can use root permissions
         return $user->isAdmin() || $user->isOwner();
     }
 
@@ -99,11 +68,14 @@ class ApiTokenPolicy
      */
     public function useWritePermissions(User $user): bool
     {
-        // Authorization temporarily disabled
-        /*
-        // Only admins and owners can use write permissions
         return $user->isAdmin() || $user->isOwner();
-        */
-        return true;
+    }
+
+    /**
+     * Determine whether the user can use deploy permissions for API tokens.
+     */
+    public function useDeployPermissions(User $user): bool
+    {
+        return $user->isAdmin() || $user->isOwner();
     }
 }

app/Policies/ApplicationPolicy.php

@@ -13,10 +13,6 @@ class ApplicationPolicy
      */
     public function viewAny(User $user): bool
     {
-        // Authorization temporarily disabled
-        /*
-        return true;
-        */
         return true;
     }
 
@@ -25,11 +21,9 @@ class ApplicationPolicy
      */
     public function view(User $user, Application $application): bool
     {
-        // Authorization temporarily disabled
-        /*
-        return true;
-        */
-        return true;
+        $teamId = $this->getTeamId($application);
+
+        return $teamId !== null && $user->teams->contains('id', $teamId);
     }
 
     /**
@@ -37,15 +31,7 @@ class ApplicationPolicy
      */
     public function create(User $user): bool
     {
-        // Authorization temporarily disabled
-        /*
-        if ($user->isAdmin()) {
-            return true;
-        }
-
-        return false;
-        */
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -53,15 +39,17 @@ class ApplicationPolicy
      */
     public function update(User $user, Application $application): Response
     {
-        // Authorization temporarily disabled
-        /*
-        if ($user->isAdmin()) {
+        $teamId = $this->getTeamId($application);
+
+        if ($teamId === null) {
+            return Response::deny('Application team not found.');
+        }
+
+        if ($user->isAdminOfTeam($teamId)) {
             return Response::allow();
         }
 
-        return Response::deny('As a member, you cannot update this application.<br/><br/>You need at least admin or owner permissions.');
-        */
-        return Response::allow();
+        return Response::deny('You need at least admin or owner permissions to update this application.');
     }
 
     /**
@@ -69,15 +57,9 @@ class ApplicationPolicy
      */
     public function delete(User $user, Application $application): bool
     {
-        // Authorization temporarily disabled
-        /*
-        if ($user->isAdmin()) {
-            return true;
-        }
+        $teamId = $this->getTeamId($application);
 
-        return false;
-        */
-        return true;
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -85,11 +67,7 @@ class ApplicationPolicy
      */
     public function restore(User $user, Application $application): bool
     {
-        // Authorization temporarily disabled
-        /*
-        return true;
-        */
-        return true;
+        return false;
     }
 
     /**
@@ -97,11 +75,7 @@ class ApplicationPolicy
      */
     public function forceDelete(User $user, Application $application): bool
     {
-        // Authorization temporarily disabled
-        /*
-        return $user->isAdmin() && $user->teams->contains('id', $application->team()->first()->id);
-        */
-        return true;
+        return false;
     }
 
     /**
@@ -109,11 +83,9 @@ class ApplicationPolicy
      */
     public function deploy(User $user, Application $application): bool
     {
-        // Authorization temporarily disabled
-        /*
-        return $user->teams->contains('id', $application->team()->first()->id);
-        */
-        return true;
+        $teamId = $this->getTeamId($application);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -121,11 +93,9 @@ class ApplicationPolicy
      */
     public function manageDeployments(User $user, Application $application): bool
     {
-        // Authorization temporarily disabled
-        /*
-        return $user->isAdmin() && $user->teams->contains('id', $application->team()->first()->id);
-        */
-        return true;
+        $teamId = $this->getTeamId($application);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -133,11 +103,9 @@ class ApplicationPolicy
      */
     public function manageEnvironment(User $user, Application $application): bool
     {
-        // Authorization temporarily disabled
-        /*
-        return $user->isAdmin() && $user->teams->contains('id', $application->team()->first()->id);
-        */
-        return true;
+        $teamId = $this->getTeamId($application);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -145,10 +113,11 @@ class ApplicationPolicy
      */
     public function cleanupDeploymentQueue(User $user): bool
     {
-        // Authorization temporarily disabled
-        /*
         return $user->isAdmin();
-        */
-        return true;
+    }
+
+    private function getTeamId(Application $application): ?int
+    {
+        return $application->team()?->id;
     }
 }

app/Policies/ApplicationPreviewPolicy.php

@@ -21,8 +21,9 @@ class ApplicationPreviewPolicy
      */
     public function view(User $user, ApplicationPreview $applicationPreview): bool
     {
-        // return $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($applicationPreview);
+
+        return $teamId !== null && $user->teams->contains('id', $teamId);
     }
 
     /**
@@ -30,21 +31,25 @@ class ApplicationPreviewPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
      * Determine whether the user can update the model.
      */
-    public function update(User $user, ApplicationPreview $applicationPreview)
+    public function update(User $user, ApplicationPreview $applicationPreview): Response
     {
-        // if ($user->isAdmin()) {
-        //    return Response::allow();
-        // }
+        $teamId = $this->getTeamId($applicationPreview);
 
-        // return Response::deny('As a member, you cannot update this preview.<br/><br/>You need at least admin or owner permissions.');
-        return true;
+        if ($teamId === null) {
+            return Response::deny('Application preview team not found.');
+        }
+
+        if ($user->isAdminOfTeam($teamId)) {
+            return Response::allow();
+        }
+
+        return Response::deny('You need at least admin or owner permissions to update this preview.');
     }
 
     /**
@@ -52,8 +57,9 @@ class ApplicationPreviewPolicy
      */
     public function delete(User $user, ApplicationPreview $applicationPreview): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($applicationPreview);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -61,8 +67,7 @@ class ApplicationPreviewPolicy
      */
     public function restore(User $user, ApplicationPreview $applicationPreview): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
-        return true;
+        return false;
     }
 
     /**
@@ -70,8 +75,7 @@ class ApplicationPreviewPolicy
      */
     public function forceDelete(User $user, ApplicationPreview $applicationPreview): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
-        return true;
+        return false;
     }
 
     /**
@@ -79,8 +83,9 @@ class ApplicationPreviewPolicy
      */
     public function deploy(User $user, ApplicationPreview $applicationPreview): bool
     {
-        // return $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($applicationPreview);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -88,7 +93,13 @@ class ApplicationPreviewPolicy
      */
     public function manageDeployments(User $user, ApplicationPreview $applicationPreview): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($applicationPreview);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
+    }
+
+    private function getTeamId(ApplicationPreview $applicationPreview): ?int
+    {
+        return $applicationPreview->application?->team()?->id;
     }
 }

app/Policies/ApplicationSettingPolicy.php

@@ -20,8 +20,9 @@ class ApplicationSettingPolicy
      */
     public function view(User $user, ApplicationSetting $applicationSetting): bool
     {
-        // return $user->teams->contains('id', $applicationSetting->application->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($applicationSetting);
+
+        return $teamId !== null && $user->teams->contains('id', $teamId);
     }
 
     /**
@@ -29,8 +30,7 @@ class ApplicationSettingPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -38,8 +38,9 @@ class ApplicationSettingPolicy
      */
     public function update(User $user, ApplicationSetting $applicationSetting): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $applicationSetting->application->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($applicationSetting);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -47,8 +48,9 @@ class ApplicationSettingPolicy
      */
     public function delete(User $user, ApplicationSetting $applicationSetting): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $applicationSetting->application->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($applicationSetting);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -56,8 +58,7 @@ class ApplicationSettingPolicy
      */
     public function restore(User $user, ApplicationSetting $applicationSetting): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $applicationSetting->application->team()->first()->id);
-        return true;
+        return false;
     }
 
     /**
@@ -65,7 +66,11 @@ class ApplicationSettingPolicy
      */
     public function forceDelete(User $user, ApplicationSetting $applicationSetting): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $applicationSetting->application->team()->first()->id);
-        return true;
+        return false;
+    }
+
+    private function getTeamId(ApplicationSetting $applicationSetting): ?int
+    {
+        return $applicationSetting->application?->team()?->id;
     }
 }

app/Policies/DatabasePolicy.php

@@ -20,8 +20,9 @@ class DatabasePolicy
      */
     public function view(User $user, $database): bool
     {
-        // return $user->teams->contains('id', $database->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($database);
+
+        return $teamId !== null && $user->teams->contains('id', $teamId);
     }
 
     /**
@@ -29,21 +30,25 @@ class DatabasePolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
      * Determine whether the user can update the model.
      */
-    public function update(User $user, $database)
+    public function update(User $user, $database): Response
     {
-        // if ($user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id)) {
-        //    return Response::allow();
-        // }
+        $teamId = $this->getTeamId($database);
 
-        // return Response::deny('As a member, you cannot update this database.<br/><br/>You need at least admin or owner permissions.');
-        return true;
+        if ($teamId === null) {
+            return Response::deny('Database team not found.');
+        }
+
+        if ($user->isAdminOfTeam($teamId)) {
+            return Response::allow();
+        }
+
+        return Response::deny('You need at least admin or owner permissions to update this database.');
     }
 
     /**
@@ -51,8 +56,9 @@ class DatabasePolicy
      */
     public function delete(User $user, $database): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($database);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -60,8 +66,7 @@ class DatabasePolicy
      */
     public function restore(User $user, $database): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
-        return true;
+        return false;
     }
 
     /**
@@ -69,8 +74,7 @@ class DatabasePolicy
      */
     public function forceDelete(User $user, $database): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
-        return true;
+        return false;
     }
 
     /**
@@ -78,8 +82,9 @@ class DatabasePolicy
      */
     public function manage(User $user, $database): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($database);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -87,8 +92,9 @@ class DatabasePolicy
      */
     public function manageBackups(User $user, $database): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($database);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -96,7 +102,17 @@ class DatabasePolicy
      */
     public function manageEnvironment(User $user, $database): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($database);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
+    }
+
+    private function getTeamId($database): ?int
+    {
+        if (method_exists($database, 'team')) {
+            return $database->team()?->id;
+        }
+
+        return null;
     }
 }

app/Policies/EnvironmentPolicy.php

@@ -20,8 +20,9 @@ class EnvironmentPolicy
      */
     public function view(User $user, Environment $environment): bool
     {
-        // return $user->teams->contains('id', $environment->project->team_id);
-        return true;
+        $teamId = $this->getTeamId($environment);
+
+        return $teamId !== null && $user->teams->contains('id', $teamId);
     }
 
     /**
@@ -29,8 +30,7 @@ class EnvironmentPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -38,8 +38,9 @@ class EnvironmentPolicy
      */
     public function update(User $user, Environment $environment): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $environment->project->team_id);
-        return true;
+        $teamId = $this->getTeamId($environment);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -47,8 +48,9 @@ class EnvironmentPolicy
      */
     public function delete(User $user, Environment $environment): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $environment->project->team_id);
-        return true;
+        $teamId = $this->getTeamId($environment);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -56,8 +58,7 @@ class EnvironmentPolicy
      */
     public function restore(User $user, Environment $environment): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $environment->project->team_id);
-        return true;
+        return false;
     }
 
     /**
@@ -65,7 +66,11 @@ class EnvironmentPolicy
      */
     public function forceDelete(User $user, Environment $environment): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $environment->project->team_id);
-        return true;
+        return false;
+    }
+
+    private function getTeamId(Environment $environment): ?int
+    {
+        return $environment->project?->team_id;
     }
 }

app/Policies/EnvironmentVariablePolicy.php

@@ -20,7 +20,9 @@ class EnvironmentVariablePolicy
      */
     public function view(User $user, EnvironmentVariable $environmentVariable): bool
     {
-        return true;
+        $teamId = $this->getTeamId($environmentVariable);
+
+        return $teamId !== null && $user->teams->contains('id', $teamId);
     }
 
     /**
@@ -28,7 +30,7 @@ class EnvironmentVariablePolicy
      */
     public function create(User $user): bool
     {
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -36,7 +38,9 @@ class EnvironmentVariablePolicy
      */
     public function update(User $user, EnvironmentVariable $environmentVariable): bool
     {
-        return true;
+        $teamId = $this->getTeamId($environmentVariable);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -44,7 +48,9 @@ class EnvironmentVariablePolicy
      */
     public function delete(User $user, EnvironmentVariable $environmentVariable): bool
     {
-        return true;
+        $teamId = $this->getTeamId($environmentVariable);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -52,7 +58,7 @@ class EnvironmentVariablePolicy
      */
     public function restore(User $user, EnvironmentVariable $environmentVariable): bool
     {
-        return true;
+        return false;
     }
 
     /**
@@ -60,7 +66,7 @@ class EnvironmentVariablePolicy
      */
     public function forceDelete(User $user, EnvironmentVariable $environmentVariable): bool
     {
-        return true;
+        return false;
     }
 
     /**
@@ -68,6 +74,19 @@ class EnvironmentVariablePolicy
      */
     public function manageEnvironment(User $user, EnvironmentVariable $environmentVariable): bool
     {
-        return true;
+        $teamId = $this->getTeamId($environmentVariable);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
+    }
+
+    private function getTeamId(EnvironmentVariable $environmentVariable): ?int
+    {
+        $resource = $environmentVariable->resourceable;
+
+        if (! $resource || ! method_exists($resource, 'team')) {
+            return null;
+        }
+
+        return $resource->team()?->id;
     }
 }

app/Policies/GithubAppPolicy.php

@@ -20,8 +20,11 @@ class GithubAppPolicy
      */
     public function view(User $user, GithubApp $githubApp): bool
     {
-        // return $user->teams->contains('id', $githubApp->team_id) || $githubApp->is_system_wide;
-        return true;
+        if ($githubApp->is_system_wide) {
+            return true;
+        }
+
+        return $user->teams->contains('id', $githubApp->team_id);
     }
 
     /**
@@ -29,8 +32,7 @@ class GithubAppPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -39,12 +41,10 @@ class GithubAppPolicy
     public function update(User $user, GithubApp $githubApp): bool
     {
         if ($githubApp->is_system_wide) {
-            // return $user->isAdmin();
-            return true;
+            return $user->canAccessSystemResources();
         }
 
-        // return $user->isAdmin() && $user->teams->contains('id', $githubApp->team_id);
-        return true;
+        return $user->isAdminOfTeam($githubApp->team_id);
     }
 
     /**
@@ -53,12 +53,10 @@ class GithubAppPolicy
     public function delete(User $user, GithubApp $githubApp): bool
     {
         if ($githubApp->is_system_wide) {
-            // return $user->isAdmin();
-            return true;
+            return $user->canAccessSystemResources();
         }
 
-        // return $user->isAdmin() && $user->teams->contains('id', $githubApp->team_id);
-        return true;
+        return $user->isAdminOfTeam($githubApp->team_id);
     }
 
     /**

app/Policies/NotificationPolicy.php

@@ -12,13 +12,11 @@ class NotificationPolicy
      */
     public function view(User $user, Model $notificationSettings): bool
     {
-        // Check if the notification settings belong to the user's current team
         if (! $notificationSettings->team) {
             return false;
         }
 
-        // return $user->teams()->where('teams.id', $notificationSettings->team->id)->exists();
-        return true;
+        return $user->teams->contains('id', $notificationSettings->team->id);
     }
 
     /**
@@ -26,14 +24,13 @@ class NotificationPolicy
      */
     public function update(User $user, Model $notificationSettings): bool
     {
-        // Check if the notification settings belong to the user's current team
         if (! $notificationSettings->team) {
             return false;
         }
 
-        // Only owners and admins can update notification settings
-        //  return $user->isAdmin() || $user->isOwner();
-        return true;
+        $teamId = $notificationSettings->team->id;
+
+        return $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -41,8 +38,7 @@ class NotificationPolicy
      */
     public function manage(User $user, Model $notificationSettings): bool
     {
-        // return $this->update($user, $notificationSettings);
-        return true;
+        return $this->update($user, $notificationSettings);
     }
 
     /**
@@ -50,7 +46,6 @@ class NotificationPolicy
      */
     public function sendTest(User $user, Model $notificationSettings): bool
     {
-        // return $this->update($user, $notificationSettings);
-        return true;
+        return $this->update($user, $notificationSettings);
     }
 }

app/Policies/ProjectPolicy.php

@@ -20,8 +20,7 @@ class ProjectPolicy
      */
     public function view(User $user, Project $project): bool
     {
-        // return $user->teams->contains('id', $project->team_id);
-        return true;
+        return $user->teams->contains('id', $project->team_id);
     }
 
     /**
@@ -29,8 +28,7 @@ class ProjectPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -38,8 +36,7 @@ class ProjectPolicy
      */
     public function update(User $user, Project $project): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $project->team_id);
-        return true;
+        return $user->isAdminOfTeam($project->team_id);
     }
 
     /**
@@ -47,8 +44,7 @@ class ProjectPolicy
      */
     public function delete(User $user, Project $project): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $project->team_id);
-        return true;
+        return $user->isAdminOfTeam($project->team_id);
     }
 
     /**
@@ -56,8 +52,7 @@ class ProjectPolicy
      */
     public function restore(User $user, Project $project): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $project->team_id);
-        return true;
+        return false;
     }
 
     /**
@@ -65,7 +60,6 @@ class ProjectPolicy
      */
     public function forceDelete(User $user, Project $project): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $project->team_id);
-        return true;
+        return false;
     }
 }

app/Policies/ResourceCreatePolicy.php

@@ -38,8 +38,7 @@ class ResourceCreatePolicy
      */
     public function createAny(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -51,8 +50,7 @@ class ResourceCreatePolicy
             return false;
         }
 
-        //  return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**

app/Policies/ServerPolicy.php

@@ -28,8 +28,7 @@ class ServerPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -37,8 +36,7 @@ class ServerPolicy
      */
     public function update(User $user, Server $server): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
-        return true;
+        return $user->isAdminOfTeam($server->team_id);
     }
 
     /**
@@ -46,8 +44,7 @@ class ServerPolicy
      */
     public function delete(User $user, Server $server): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
-        return true;
+        return $user->isAdminOfTeam($server->team_id);
     }
 
     /**
@@ -71,8 +68,7 @@ class ServerPolicy
      */
     public function manageProxy(User $user, Server $server): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
-        return true;
+        return $user->isAdminOfTeam($server->team_id);
     }
 
     /**
@@ -80,8 +76,7 @@ class ServerPolicy
      */
     public function manageSentinel(User $user, Server $server): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
-        return true;
+        return $user->isAdminOfTeam($server->team_id);
     }
 
     /**
@@ -89,8 +84,7 @@ class ServerPolicy
      */
     public function manageCaCertificate(User $user, Server $server): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
-        return true;
+        return $user->isAdminOfTeam($server->team_id);
     }
 
     /**
@@ -98,7 +92,6 @@ class ServerPolicy
      */
     public function viewSecurity(User $user, Server $server): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
-        return true;
+        return $user->isAdminOfTeam($server->team_id);
     }
 }

app/Policies/ServiceApplicationPolicy.php

@@ -21,8 +21,7 @@ class ServiceApplicationPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -30,8 +29,7 @@ class ServiceApplicationPolicy
      */
     public function update(User $user, ServiceApplication $serviceApplication): bool
     {
-        // return Gate::allows('update', $serviceApplication->service);
-        return true;
+        return Gate::allows('update', $serviceApplication->service);
     }
 
     /**
@@ -39,8 +37,7 @@ class ServiceApplicationPolicy
      */
     public function delete(User $user, ServiceApplication $serviceApplication): bool
     {
-        // return Gate::allows('delete', $serviceApplication->service);
-        return true;
+        return Gate::allows('delete', $serviceApplication->service);
     }
 
     /**
@@ -48,8 +45,7 @@ class ServiceApplicationPolicy
      */
     public function restore(User $user, ServiceApplication $serviceApplication): bool
     {
-        // return Gate::allows('update', $serviceApplication->service);
-        return true;
+        return false;
     }
 
     /**
@@ -57,7 +53,6 @@ class ServiceApplicationPolicy
      */
     public function forceDelete(User $user, ServiceApplication $serviceApplication): bool
     {
-        // return Gate::allows('delete', $serviceApplication->service);
-        return true;
+        return false;
     }
 }

app/Policies/ServiceDatabasePolicy.php

@@ -13,7 +13,7 @@ class ServiceDatabasePolicy
      */
     public function view(User $user, ServiceDatabase $serviceDatabase): bool
     {
-        return true;
+        return Gate::allows('view', $serviceDatabase->service);
     }
 
     /**
@@ -21,8 +21,7 @@ class ServiceDatabasePolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -30,9 +29,7 @@ class ServiceDatabasePolicy
      */
     public function update(User $user, ServiceDatabase $serviceDatabase): bool
     {
-
-        // return Gate::allows('update', $serviceDatabase->service);
-        return true;
+        return Gate::allows('update', $serviceDatabase->service);
     }
 
     /**
@@ -40,8 +37,7 @@ class ServiceDatabasePolicy
      */
     public function delete(User $user, ServiceDatabase $serviceDatabase): bool
     {
-        // return Gate::allows('delete', $serviceDatabase->service);
-        return true;
+        return Gate::allows('delete', $serviceDatabase->service);
     }
 
     /**
@@ -49,8 +45,7 @@ class ServiceDatabasePolicy
      */
     public function restore(User $user, ServiceDatabase $serviceDatabase): bool
     {
-        // return Gate::allows('update', $serviceDatabase->service);
-        return true;
+        return false;
     }
 
     /**
@@ -58,12 +53,14 @@ class ServiceDatabasePolicy
      */
     public function forceDelete(User $user, ServiceDatabase $serviceDatabase): bool
     {
-        // return Gate::allows('delete', $serviceDatabase->service);
-        return true;
+        return false;
     }
 
+    /**
+     * Determine whether the user can manage database backups.
+     */
     public function manageBackups(User $user, ServiceDatabase $serviceDatabase): bool
     {
-        return true;
+        return Gate::allows('update', $serviceDatabase->service);
     }
 }

app/Policies/ServicePolicy.php

@@ -20,7 +20,9 @@ class ServicePolicy
      */
     public function view(User $user, Service $service): bool
     {
-        return true;
+        $teamId = $this->getTeamId($service);
+
+        return $teamId !== null && $user->teams->contains('id', $teamId);
     }
 
     /**
@@ -28,8 +30,7 @@ class ServicePolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -37,13 +38,9 @@ class ServicePolicy
      */
     public function update(User $user, Service $service): bool
     {
-        $team = $service->team();
-        if (! $team) {
-            return false;
-        }
+        $teamId = $this->getTeamId($service);
 
-        // return $user->isAdmin() && $user->teams->contains('id', $team->id);
-        return true;
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -51,12 +48,9 @@ class ServicePolicy
      */
     public function delete(User $user, Service $service): bool
     {
-        // if ($user->isAdmin()) {
-        //    return true;
-        // }
+        $teamId = $this->getTeamId($service);
 
-        // return false;
-        return true;
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -64,8 +58,7 @@ class ServicePolicy
      */
     public function restore(User $user, Service $service): bool
     {
-        // return true;
-        return true;
+        return false;
     }
 
     /**
@@ -73,23 +66,17 @@ class ServicePolicy
      */
     public function forceDelete(User $user, Service $service): bool
     {
-        // if ($user->isAdmin()) {
-        //    return true;
-        // }
-
-        // return false;
-        return true;
+        return false;
     }
 
+    /**
+     * Determine whether the user can stop the service.
+     */
     public function stop(User $user, Service $service): bool
     {
-        $team = $service->team();
-        if (! $team) {
-            return false;
-        }
+        $teamId = $this->getTeamId($service);
 
-        // return $user->teams->contains('id', $team->id);
-        return true;
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -97,13 +84,9 @@ class ServicePolicy
      */
     public function manageEnvironment(User $user, Service $service): bool
     {
-        $team = $service->team();
-        if (! $team) {
-            return false;
-        }
+        $teamId = $this->getTeamId($service);
 
-        // return $user->isAdmin() && $user->teams->contains('id', $team->id);
-        return true;
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -111,18 +94,23 @@ class ServicePolicy
      */
     public function deploy(User $user, Service $service): bool
     {
-        $team = $service->team();
-        if (! $team) {
-            return false;
-        }
+        $teamId = $this->getTeamId($service);
 
-        // return $user->teams->contains('id', $team->id);
-        return true;
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
+    /**
+     * Determine whether the user can access the terminal.
+     */
     public function accessTerminal(User $user, Service $service): bool
     {
-        // return $user->isAdmin() || $user->teams->contains('id', $service->team()->id);
-        return true;
+        $teamId = $this->getTeamId($service);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
+    }
+
+    private function getTeamId(Service $service): ?int
+    {
+        return $service->team()?->id;
     }
 }

app/Policies/SharedEnvironmentVariablePolicy.php

@@ -28,8 +28,7 @@ class SharedEnvironmentVariablePolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -37,8 +36,7 @@ class SharedEnvironmentVariablePolicy
      */
     public function update(User $user, SharedEnvironmentVariable $sharedEnvironmentVariable): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $sharedEnvironmentVariable->team_id);
-        return true;
+        return $user->isAdminOfTeam($sharedEnvironmentVariable->team_id);
     }
 
     /**
@@ -46,8 +44,7 @@ class SharedEnvironmentVariablePolicy
      */
     public function delete(User $user, SharedEnvironmentVariable $sharedEnvironmentVariable): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $sharedEnvironmentVariable->team_id);
-        return true;
+        return $user->isAdminOfTeam($sharedEnvironmentVariable->team_id);
     }
 
     /**
@@ -55,8 +52,7 @@ class SharedEnvironmentVariablePolicy
      */
     public function restore(User $user, SharedEnvironmentVariable $sharedEnvironmentVariable): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $sharedEnvironmentVariable->team_id);
-        return true;
+        return false;
     }
 
     /**
@@ -64,8 +60,7 @@ class SharedEnvironmentVariablePolicy
      */
     public function forceDelete(User $user, SharedEnvironmentVariable $sharedEnvironmentVariable): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $sharedEnvironmentVariable->team_id);
-        return true;
+        return false;
     }
 
     /**
@@ -73,7 +68,6 @@ class SharedEnvironmentVariablePolicy
      */
     public function manageEnvironment(User $user, SharedEnvironmentVariable $sharedEnvironmentVariable): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $sharedEnvironmentVariable->team_id);
-        return true;
+        return $user->isAdminOfTeam($sharedEnvironmentVariable->team_id);
     }
 }

app/Policies/StandaloneDockerPolicy.php

@@ -28,8 +28,7 @@ class StandaloneDockerPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -37,7 +36,7 @@ class StandaloneDockerPolicy
      */
     public function update(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        return $user->teams->contains('id', $standaloneDocker->server->team_id);
+        return $user->isAdminOfTeam($standaloneDocker->server->team_id);
     }
 
     /**
@@ -45,7 +44,7 @@ class StandaloneDockerPolicy
      */
     public function delete(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        return $user->teams->contains('id', $standaloneDocker->server->team_id);
+        return $user->isAdminOfTeam($standaloneDocker->server->team_id);
     }
 
     /**

app/Policies/SwarmDockerPolicy.php

@@ -28,8 +28,7 @@ class SwarmDockerPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -37,7 +36,7 @@ class SwarmDockerPolicy
      */
     public function update(User $user, SwarmDocker $swarmDocker): bool
     {
-        return $user->teams->contains('id', $swarmDocker->server->team_id);
+        return $user->isAdminOfTeam($swarmDocker->server->team_id);
     }
 
     /**
@@ -45,7 +44,7 @@ class SwarmDockerPolicy
      */
     public function delete(User $user, SwarmDocker $swarmDocker): bool
     {
-        return $user->teams->contains('id', $swarmDocker->server->team_id);
+        return $user->isAdminOfTeam($swarmDocker->server->team_id);
     }
 
     /**