prehistoric-systems/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-03-11 08:55:47 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
coolify/app/Policies
History
Andras Bacsai b878dc8102 refactor(auth): enforce team member authorization across app 
Restrict sensitive operations to admins/owners and hide sensitive data
from team members:
- Add authorization checks to Livewire components and API endpoints
- Restrict team members from accessing sensitive permissions and data
- Hide environment variable values from non-admin team members
- Update policies to enforce team-level admin status requirement
- Add useSensitivePermissions policy for read:sensitive tokens
- Improve disabled button UX with auth-specific tooltips
- Add authorization checks in middleware for API tokens

Closes authorization gaps in project management, server management,
and settings components.
2026-02-27 11:41:01 +01:00
..
ApiTokenPolicy.php refactor(auth): enforce team member authorization across app 2026-02-27 11:41:01 +01:00
ApplicationPolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
ApplicationPreviewPolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
ApplicationSettingPolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
CloudInitScriptPolicy.php feat: add cloud-init script support for Hetzner server creation 2025-10-10 19:37:16 +02:00
CloudProviderTokenPolicy.php init of cloud providers 2025-10-08 20:47:50 +02:00
DatabasePolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
EnvironmentPolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
EnvironmentVariablePolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
GithubAppPolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
InstanceSettingsPolicy.php feat: add validation methods for S3 bucket names, paths, and server paths; update import logic to prevent command injection 2025-11-25 16:40:35 +01:00
NotificationPolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
PrivateKeyPolicy.php Changes auto-committed by Conductor 2025-10-17 23:04:24 +02:00
ProjectPolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
ResourceCreatePolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
S3StoragePolicy.php refactor(auth): enforce team member authorization across app 2026-02-27 11:41:01 +01:00
ServerPolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
ServiceApplicationPolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
ServiceDatabasePolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
ServicePolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
SharedEnvironmentVariablePolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
StandaloneDockerPolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
SwarmDockerPolicy.php fix(auth): enforce authorization checks across API and Livewire components 2026-02-25 14:20:29 +01:00
TeamPolicy.php fix: critical privilege escalation in team invitation system 2025-10-15 11:42:25 +02:00