feat(auth): restrict sensitive data visibility for team members

Hide database passwords, connection URLs, and debug logs from team members:
- Database components: hide passwords and connection URLs for members
- Deployment UI: gate debug log toggle behind update permission
- Debug logs: prevent members from viewing debug output
- Storage/services: hide sensitive credentials from members

Members can still view non-sensitive configuration while admins retain full access to all data.
This commit is contained in:
Andras Bacsai committed 2026-02-27 22:42:48 +01:00
1 parent 0636789071
commit c924655999
27 files changed
+382 -119

No files matched your search

+2 -2
View File
@@ -21,9 +21,9 @@ class ApiAbility extends CheckForAnyAbility
{
try {
$token = $request->user()->currentAccessToken();
$teamId = (int) data_get($token, 'team_id');
$teamId = data_get($token, 'team_id');
if ($teamId && ! $request->user()->isAdminOfTeam($teamId)) {
if ($teamId !== null && ! $request->user()->isAdminOfTeam((int) $teamId)) {
$tokenAbilities = $token->abilities ?? [];
$disallowed = array_intersect($tokenAbilities, self::MEMBER_DISALLOWED_ABILITIES);