Changes auto-committed by Conductor

app/Livewire/Security/PrivateKey/Index.php

@@ -12,7 +12,7 @@ class Index extends Component
 
     public function render()
     {
-        $privateKeys = PrivateKey::ownedByCurrentTeam(['name', 'uuid', 'is_git_related', 'description'])->get();
+        $privateKeys = PrivateKey::ownedByCurrentTeam(['name', 'uuid', 'is_git_related', 'description', 'team_id'])->get();
 
         return view('livewire.security.private-key.index', [
             'privateKeys' => $privateKeys,

app/Livewire/Security/PrivateKey/Show.php

@@ -79,8 +79,14 @@ class Show extends Component
     public function mount()
     {
         try {
-            $this->private_key = PrivateKey::ownedByCurrentTeam(['name', 'description', 'private_key', 'is_git_related'])->whereUuid(request()->private_key_uuid)->firstOrFail();
+            $this->private_key = PrivateKey::ownedByCurrentTeam(['name', 'description', 'private_key', 'is_git_related', 'team_id'])->whereUuid(request()->private_key_uuid)->firstOrFail();
+
+            // Explicit authorization check - will throw 403 if not authorized
+            $this->authorize('view', $this->private_key);
+
             $this->syncData(false);
+        } catch (\Illuminate\Auth\Access\AuthorizationException $e) {
+            abort(403, 'You do not have permission to view this private key.');
         } catch (\Throwable) {
             abort(404);
         }

app/Models/PrivateKey.php

@@ -82,9 +82,10 @@ class PrivateKey extends BaseModel
 
     public static function ownedByCurrentTeam(array $select = ['*'])
     {
+        $teamId = currentTeam()->id;
         $selectArray = collect($select)->concat(['id']);
 
-        return self::whereTeamId(currentTeam()->id)->select($selectArray->all());
+        return self::whereTeamId($teamId)->select($selectArray->all());
     }
 
     public static function validatePrivateKey($privateKey)

app/Models/User.php

@@ -338,6 +338,39 @@ class User extends Authenticatable implements SendsEmail
         return data_get($user, 'pivot.role');
     }
 
+    /**
+     * Check if the user is an admin or owner of a specific team
+     */
+    public function isAdminOfTeam(int $teamId): bool
+    {
+        $team = $this->teams->where('id', $teamId)->first();
+
+        if (! $team) {
+            return false;
+        }
+
+        $role = $team->pivot->role ?? null;
+
+        return $role === 'admin' || $role === 'owner';
+    }
+
+    /**
+     * Check if the user can access system resources (team_id=0)
+     * Must be admin/owner of root team
+     */
+    public function canAccessSystemResources(): bool
+    {
+        // Check if user is member of root team
+        $rootTeam = $this->teams->where('id', 0)->first();
+
+        if (! $rootTeam) {
+            return false;
+        }
+
+        // Check if user is admin or owner of root team
+        return $this->isAdminOfTeam(0);
+    }
+
     public function requestEmailChange(string $newEmail): void
     {
         // Generate 6-digit code

app/Policies/PrivateKeyPolicy.php

@@ -20,8 +20,18 @@ class PrivateKeyPolicy
      */
     public function view(User $user, PrivateKey $privateKey): bool
     {
-        // return $user->teams->contains('id', $privateKey->team_id);
-        return true;
+        // Handle null team_id
+        if ($privateKey->team_id === null) {
+            return false;
+        }
+
+        // System resource (team_id=0): Only root team admins/owners can access
+        if ($privateKey->team_id === 0) {
+            return $user->canAccessSystemResources();
+        }
+
+        // Regular resource: Check team membership
+        return $user->teams->contains('id', $privateKey->team_id);
     }
 
     /**
@@ -29,8 +39,9 @@ class PrivateKeyPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        // Only admins/owners can create private keys
+        // Members should not be able to create SSH keys that could be used for deployments
+        return $user->isAdmin();
     }
 
     /**
@@ -38,8 +49,19 @@ class PrivateKeyPolicy
      */
     public function update(User $user, PrivateKey $privateKey): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $privateKey->team_id);
-        return true;
+        // Handle null team_id
+        if ($privateKey->team_id === null) {
+            return false;
+        }
+
+        // System resource (team_id=0): Only root team admins/owners can update
+        if ($privateKey->team_id === 0) {
+            return $user->canAccessSystemResources();
+        }
+
+        // Regular resource: Must be admin/owner of the team
+        return $user->isAdminOfTeam($privateKey->team_id)
+            && $user->teams->contains('id', $privateKey->team_id);
     }
 
     /**
@@ -47,8 +69,19 @@ class PrivateKeyPolicy
      */
     public function delete(User $user, PrivateKey $privateKey): bool
     {
-        //  return $user->isAdmin() && $user->teams->contains('id', $privateKey->team_id);
-        return true;
+        // Handle null team_id
+        if ($privateKey->team_id === null) {
+            return false;
+        }
+
+        // System resource (team_id=0): Only root team admins/owners can delete
+        if ($privateKey->team_id === 0) {
+            return $user->canAccessSystemResources();
+        }
+
+        // Regular resource: Must be admin/owner of the team
+        return $user->isAdminOfTeam($privateKey->team_id)
+            && $user->teams->contains('id', $privateKey->team_id);
     }
 
     /**