Restrict sensitive operations to admins/owners and hide sensitive data
from team members:
- Add authorization checks to Livewire components and API endpoints
- Restrict team members from accessing sensitive permissions and data
- Hide environment variable values from non-admin team members
- Update policies to enforce team-level admin status requirement
- Add useSensitivePermissions policy for read:sensitive tokens
- Improve disabled button UX with auth-specific tooltips
- Add authorization checks in middleware for API tokens
Closes authorization gaps in project management, server management,
and settings components.
The trim operation was happening after validation, which meant
whitespace was counted toward the max:255 validation rule. Now
input is normalized before validation, matching the pattern used
in Application and Service components.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Andras Bacsai <andrasbacsai@users.noreply.github.com>
- Add trim() to FQDN in instantSave() method to prevent whitespace from being saved
- Add trim() to FQDN in submit() method before validation and DNS checks
- Prevents invalid HostSNI rules caused by leading/trailing whitespace
- Fixes issue where accidental whitespace from copy-paste causes deployment failures
Fixes#7797
Co-authored-by: Andras Bacsai <andrasbacsai@users.noreply.github.com>
- Make Server property nullable in Settings components (Index, Advanced, Updates)
- Add conditional server loading: only load when not on cloud
- Add null checks before using server for DNS validation and proxy configuration
- Fix isInstanceAdmin() to check root team's pivot role directly instead of current team
- Make root team (id=0) bypass subscription check on cloud
- Remove isInstanceAdmin() from main middleware bypass: only settings/admin routes are exempted
- Update isSubscribed() to only check isSubscriptionActive() for navbar consistency
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- Remove App\\Events\\ prefix from event class names
- RunRemoteProcess already prepends App\\Events\\ to the class name
- Use 'S3DownloadFinished' instead of 'App\\Events\\S3DownloadFinished'
- Use 'S3RestoreJobFinished' instead of 'App\\Events\\S3RestoreJobFinished'
- Fixes "Class 'App\Events\App\Events\S3DownloadFinished' not found" error
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
