fix(auth): enforce dashboard authorization and improve team deletion

Add authorization gates to Project and Server creation buttons in the dashboard to prevent non-admin users from accessing resource creation. Improve team deletion to clear cache before deletion and automatically switch to the user's next available team.

- Hide create buttons from non-admin users in dashboard
- Clear cache before team deletion to prevent stale session resolution
- Switch user session to next available team when current team is deleted
- Handle refreshSession when user has no remaining teams
- Add tests for dashboard authorization enforcement and team deletion flow

app/Livewire/Team/Index.php

@@ -7,6 +7,7 @@ use App\Models\TeamInvitation;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\DB;
 use Livewire\Component;
 
@@ -98,8 +99,6 @@ class Index extends Component
         try {
             $currentTeam = currentTeam();
             $this->authorize('delete', $currentTeam);
-            $currentTeam->delete();
-
             $currentTeam->members->each(function ($user) use ($currentTeam) {
                 if ($user->id === Auth::id()) {
                     return;
@@ -111,7 +110,13 @@ class Index extends Component
                 }
             });
 
-            refreshSession();
+            // Clear stale cache before deleting so refreshSession doesn't resolve the deleted team
+            Cache::forget('user:'.Auth::id().':team:'.$currentTeam->id);
+            $currentTeam->delete();
+
+            // Switch to the user's next available team
+            $newTeam = Auth::user()->teams()->first();
+            refreshSession($newTeam);
 
             return redirect()->route('team.index');
         } catch (\Throwable $e) {

bootstrap/helpers/shared.php

@@ -186,6 +186,14 @@ function refreshSession(?Team $team = null): void
             $team = User::find(Auth::id())->teams->first();
         }
     }
+
+    if (! $team) {
+        session()->forget('currentTeam');
+        Cache::forget('team:'.Auth::id());
+
+        return;
+    }
+
     // Clear old cache key format for backwards compatibility
     Cache::forget('team:'.Auth::id());
     // Use new cache key format that includes team ID

resources/views/livewire/dashboard.blade.php

@@ -17,20 +17,23 @@
     <section class="-mt-2">
         <div class="flex items-center gap-2 pb-2">
             <h3>Projects</h3>
-            @if ($projects->count() > 0)
-                <x-modal-input buttonTitle="Add" title="New Project">
-                    <x-slot:content>
-                        <button
-                            class="flex items-center justify-center size-4 text-white rounded hover:bg-coolgray-400 dark:hover:bg-coolgray-300 cursor-pointer">
-                            <svg class="size-3" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
-                                stroke-width="2" stroke="currentColor">
-                                <path stroke-linecap="round" stroke-linejoin="round" d="M12 4.5v15m7.5-7.5h-15" />
-                            </svg>
-                        </button>
-                    </x-slot:content>
-                    <livewire:project.add-empty />
-                </x-modal-input>
-            @endif
+            @can('create', App\Models\Project::class)
+                @if ($projects->count() > 0)
+                    <x-modal-input buttonTitle="Add" title="New Project">
+                        <x-slot:content>
+                            <button
+                                class="flex items-center justify-center size-4 text-white rounded hover:bg-coolgray-400 dark:hover:bg-coolgray-300 cursor-pointer">
+                                <svg class="size-3" xmlns="http://www.w3.org/2000/svg" fill="none"
+                                    viewBox="0 0 24 24" stroke-width="2" stroke="currentColor">
+                                    <path stroke-linecap="round" stroke-linejoin="round"
+                                        d="M12 4.5v15m7.5-7.5h-15" />
+                                </svg>
+                            </button>
+                        </x-slot:content>
+                        <livewire:project.add-empty />
+                    </x-modal-input>
+                @endif
+            @endcan
         </div>
         @if ($projects->count() > 0)
             <div class="grid grid-cols-1 gap-4 xl:grid-cols-2">
@@ -70,12 +73,15 @@
         @else
             <div class="flex flex-col gap-1">
                 <div class='font-bold dark:text-warning'>No projects found.</div>
-                <div class="flex items-center gap-1">
-                    <x-modal-input buttonTitle="Add" title="New Project">
-                        <livewire:project.add-empty />
-                    </x-modal-input> your first project or
-                    go to the <a class="underline dark:text-white" href="{{ route('onboarding') }}" {{ wireNavigate() }}>onboarding</a> page.
-                </div>
+                @can('create', App\Models\Project::class)
+                    <div class="flex items-center gap-1">
+                        <x-modal-input buttonTitle="Add" title="New Project">
+                            <livewire:project.add-empty />
+                        </x-modal-input> your first project or
+                        go to the <a class="underline dark:text-white" href="{{ route('onboarding') }}"
+                            {{ wireNavigate() }}>onboarding</a> page.
+                    </div>
+                @endcan
             </div>
         @endif
     </section>
@@ -83,20 +89,23 @@
     <section>
         <div class="flex items-center gap-2 pb-2">
             <h3>Servers</h3>
-            @if ($servers->count() > 0 && $privateKeys->count() > 0)
-                <x-modal-input buttonTitle="Add" title="New Server" :closeOutside="false">
-                    <x-slot:content>
-                        <button
-                            class="flex items-center justify-center size-4 text-white rounded hover:bg-coolgray-400 dark:hover:bg-coolgray-300 cursor-pointer">
-                            <svg class="size-3" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
-                                stroke-width="2" stroke="currentColor">
-                                <path stroke-linecap="round" stroke-linejoin="round" d="M12 4.5v15m7.5-7.5h-15" />
-                            </svg>
-                        </button>
-                    </x-slot:content>
-                    <livewire:server.create />
-                </x-modal-input>
-            @endif
+            @can('create', App\Models\Server::class)
+                @if ($servers->count() > 0 && $privateKeys->count() > 0)
+                    <x-modal-input buttonTitle="Add" title="New Server" :closeOutside="false">
+                        <x-slot:content>
+                            <button
+                                class="flex items-center justify-center size-4 text-white rounded hover:bg-coolgray-400 dark:hover:bg-coolgray-300 cursor-pointer">
+                                <svg class="size-3" xmlns="http://www.w3.org/2000/svg" fill="none"
+                                    viewBox="0 0 24 24" stroke-width="2" stroke="currentColor">
+                                    <path stroke-linecap="round" stroke-linejoin="round"
+                                        d="M12 4.5v15m7.5-7.5h-15" />
+                                </svg>
+                            </button>
+                        </x-slot:content>
+                        <livewire:server.create />
+                    </x-modal-input>
+                @endif
+            @endcan
         </div>
         @if ($servers->count() > 0)
             <div class="grid grid-cols-1 gap-4 xl:grid-cols-2">
@@ -133,26 +142,34 @@
             @if ($privateKeys->count() === 0)
                 <div class="flex flex-col gap-1">
                     <div class='font-bold dark:text-warning'>No private keys found.</div>
-                    <div class="flex items-center gap-1">Before you can add your server, first <x-modal-input
-                            buttonTitle="add" title="New Private Key">
-                            <livewire:security.private-key.create from="server" />
-                        </x-modal-input> a private key
-                        or
-                        go to the <a class="underline dark:text-white" href="{{ route('onboarding') }}" {{ wireNavigate() }}>onboarding</a>
-                        page.
-                    </div>
+                    @can('create', App\Models\Server::class)
+                        <div class="flex items-center gap-1">Before you can add your server, first <x-modal-input
+                                buttonTitle="add" title="New Private Key">
+                                <livewire:security.private-key.create from="server" />
+                            </x-modal-input> a private key
+                            or
+                            go to the <a class="underline dark:text-white"
+                                href="{{ route('onboarding') }}"
+                                {{ wireNavigate() }}>onboarding</a>
+                            page.
+                        </div>
+                    @endcan
                 </div>
             @else
                 <div class="flex flex-col gap-1">
                     <div class='font-bold dark:text-warning'>No servers found.</div>
-                    <div class="flex items-center gap-1">
-                        <x-modal-input buttonTitle="Add" title="New Server" :closeOutside="false">
-                            <livewire:server.create />
-                        </x-modal-input> your first server
-                        or
-                        go to the <a class="underline dark:text-white" href="{{ route('onboarding') }}" {{ wireNavigate() }}>onboarding</a>
-                        page.
-                    </div>
+                    @can('create', App\Models\Server::class)
+                        <div class="flex items-center gap-1">
+                            <x-modal-input buttonTitle="Add" title="New Server" :closeOutside="false">
+                                <livewire:server.create />
+                            </x-modal-input> your first server
+                            or
+                            go to the <a class="underline dark:text-white"
+                                href="{{ route('onboarding') }}"
+                                {{ wireNavigate() }}>onboarding</a>
+                            page.
+                        </div>
+                    @endcan
                 </div>
             @endif
         @endif

tests/Feature/DashboardAuthorizationTest.php

@@ -0,0 +1,97 @@
+<?php
+
+use App\Livewire\Dashboard;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+function setupDashboardUser(string $role): array
+{
+    $team = Team::factory()->create();
+
+    $user = User::factory()->create();
+    $user->teams()->attach($team, ['role' => $role]);
+
+    return [$user, $team];
+}
+
+function createProjectForTeam(Team $team): void
+{
+    Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $team->id,
+    ]);
+}
+
+function createServerWithKeyForTeam(Team $team): void
+{
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => $keyId,
+    ]);
+}
+
+test('admin sees add project button on dashboard', function () {
+    [$user, $team] = setupDashboardUser('admin');
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    createProjectForTeam($team);
+
+    Livewire::test(Dashboard::class)
+        ->assertSee('New Project');
+});
+
+test('member does not see add project button on dashboard', function () {
+    [$user, $team] = setupDashboardUser('member');
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    createProjectForTeam($team);
+
+    Livewire::test(Dashboard::class)
+        ->assertDontSee('New Project');
+});
+
+test('admin sees add server button on dashboard', function () {
+    [$user, $team] = setupDashboardUser('admin');
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    createServerWithKeyForTeam($team);
+
+    Livewire::test(Dashboard::class)
+        ->assertSee('New Server');
+});
+
+test('member does not see add server button on dashboard', function () {
+    [$user, $team] = setupDashboardUser('member');
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    createServerWithKeyForTeam($team);
+
+    Livewire::test(Dashboard::class)
+        ->assertDontSee('New Server');
+});

tests/Feature/TeamDeletionTest.php

@@ -0,0 +1,54 @@
+<?php
+
+use App\Livewire\Team\Index;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->owner = User::factory()->create();
+
+    // The owner's personal team (created by factory)
+    $this->personalTeam = $this->owner->teams()->first();
+    $this->owner->teams()->updateExistingPivot($this->personalTeam->id, ['role' => 'owner']);
+
+    // A second team to delete
+    $this->teamToDelete = Team::create(['name' => 'Deletable Team', 'personal_team' => false]);
+    $this->teamToDelete->members()->attach($this->owner->id, ['role' => 'owner']);
+});
+
+test('deleting a team switches session to another team without error', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->teamToDelete]);
+
+    Livewire::test(Index::class)
+        ->call('delete')
+        ->assertRedirect(route('team.index'));
+
+    // Team should be deleted from the database
+    expect(Team::find($this->teamToDelete->id))->toBeNull();
+
+    // Session should now have the personal team
+    $sessionTeam = session('currentTeam');
+    expect($sessionTeam)->not->toBeNull()
+        ->and($sessionTeam->id)->toBe($this->personalTeam->id);
+});
+
+test('refreshSession clears session when no team exists', function () {
+    $user = User::factory()->create();
+    // Detach all teams so user has none
+    $user->teams()->detach();
+    $this->actingAs($user);
+    session(['currentTeam' => null]);
+
+    // Should not throw when no team can be resolved
+    refreshSession(null);
+
+    expect(session('currentTeam'))->toBeNull();
+});