mirror of
https://github.com/coollabsio/coolify.git
synced 2026-03-11 08:55:47 +00:00
b878dc8102
Restrict sensitive operations to admins/owners and hide sensitive data from team members: - Add authorization checks to Livewire components and API endpoints - Restrict team members from accessing sensitive permissions and data - Hide environment variable values from non-admin team members - Update policies to enforce team-level admin status requirement - Add useSensitivePermissions policy for read:sensitive tokens - Improve disabled button UX with auth-specific tooltips - Add authorization checks in middleware for API tokens Closes authorization gaps in project management, server management, and settings components.
24 lines
700 B
PHP
24 lines
700 B
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
|
|
class ApiSensitiveData
|
|
{
|
|
public function handle(Request $request, Closure $next)
|
|
{
|
|
$token = $request->user()->currentAccessToken();
|
|
$hasTokenPermission = $token->can('root') || $token->can('read:sensitive');
|
|
$teamId = (int) data_get($token, 'team_id');
|
|
$isAdmin = $teamId ? $request->user()->isAdminOfTeam($teamId) : false;
|
|
|
|
// Allow access to sensitive data only if token has permission AND user is admin/owner
|
|
$request->attributes->add([
|
|
'can_read_sensitive' => $hasTokenPermission && $isAdmin,
|
|
]);
|
|
|
|
return $next($request);
|
|
}
|
|
}
|