tiennm99/coolify
1
0 Fork 0
mirror of https://github.com/tiennm99/coolify.git synced 2026-10-15 06:16:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(auth): enforce team member authorization across app

Browse Source 
Restrict sensitive operations to admins/owners and hide sensitive data
from team members:
- Add authorization checks to Livewire components and API endpoints
- Restrict team members from accessing sensitive permissions and data
- Hide environment variable values from non-admin team members
- Update policies to enforce team-level admin status requirement
- Add useSensitivePermissions policy for read:sensitive tokens
- Improve disabled button UX with auth-specific tooltips
- Add authorization checks in middleware for API tokens

Closes authorization gaps in project management, server management,
and settings components.
This commit is contained in:
Andras Bacsai committed 2026-02-27 11:41:01 +01:00
1 parent e82942b387
commit b878dc8102
49 files changed
+919 -136
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

app/Policies/S3StoragePolicy.php
+3 -5
View File
@@ -36,8 +36,7 @@ class S3StoragePolicy
*/
public function update(User $user, S3Storage $storage): bool
{
// return $user->teams->contains('id', $storage->team_id) && $user->isAdmin();
return $user->teams->contains('id', $storage->team_id);
return $user->teams->contains('id', $storage->team_id) && $user->isAdminOfTeam($storage->team_id);
}
/**
@@ -45,8 +44,7 @@ class S3StoragePolicy
*/
public function delete(User $user, S3Storage $storage): bool
{
// return $user->teams->contains('id', $storage->team_id) && $user->isAdmin();
return $user->teams->contains('id', $storage->team_id);
return $user->teams->contains('id', $storage->team_id) && $user->isAdminOfTeam($storage->team_id);
}
/**
@@ -70,6 +68,6 @@ class S3StoragePolicy
*/
public function validateConnection(User $user, S3Storage $storage): bool
{
return $user->teams->contains('id', $storage->team_id);
return $user->teams->contains('id', $storage->team_id) && $user->isAdminOfTeam($storage->team_id);
}
}