mirror of
https://github.com/tiennm99/coolify.git
synced 2026-10-14 20:17:05 +00:00
fix(auth): enforce dashboard authorization and improve team deletion
Add authorization gates to Project and Server creation buttons in the dashboard to prevent non-admin users from accessing resource creation. Improve team deletion to clear cache before deletion and automatically switch to the user's next available team. - Hide create buttons from non-admin users in dashboard - Clear cache before team deletion to prevent stale session resolution - Switch user session to next available team when current team is deleted - Handle refreshSession when user has no remaining teams - Add tests for dashboard authorization enforcement and team deletion flow
This commit is contained in:
1 parent
86b05b902a
commit
fcc58ca08a
5 files changed
+234
-53
No files matched your search
@@ -7,6 +7,7 @@ use App\Models\TeamInvitation;
|
||||
use App\Support\ValidationPatterns;
|
||||
use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
|
||||
use Illuminate\Support\Facades\Auth;
|
||||
use Illuminate\Support\Facades\Cache;
|
||||
use Illuminate\Support\Facades\DB;
|
||||
use Livewire\Component;
|
||||
|
||||
@@ -98,8 +99,6 @@ class Index extends Component
|
||||
try {
|
||||
$currentTeam = currentTeam();
|
||||
$this->authorize('delete', $currentTeam);
|
||||
$currentTeam->delete();
|
||||
|
||||
$currentTeam->members->each(function ($user) use ($currentTeam) {
|
||||
if ($user->id === Auth::id()) {
|
||||
return;
|
||||
@@ -111,7 +110,13 @@ class Index extends Component
|
||||
}
|
||||
});
|
||||
|
||||
refreshSession();
|
||||
// Clear stale cache before deleting so refreshSession doesn't resolve the deleted team
|
||||
Cache::forget('user:'.Auth::id().':team:'.$currentTeam->id);
|
||||
$currentTeam->delete();
|
||||
|
||||
// Switch to the user's next available team
|
||||
$newTeam = Auth::user()->teams()->first();
|
||||
refreshSession($newTeam);
|
||||
|
||||
return redirect()->route('team.index');
|
||||
} catch (\Throwable $e) {
|
||||
|
||||
Reference in new issue
Block a user