mirror of
https://github.com/coollabsio/coolify.git
synced 2026-03-11 08:55:47 +00:00
b878dc8102
Restrict sensitive operations to admins/owners and hide sensitive data from team members: - Add authorization checks to Livewire components and API endpoints - Restrict team members from accessing sensitive permissions and data - Hide environment variable values from non-admin team members - Update policies to enforce team-level admin status requirement - Add useSensitivePermissions policy for read:sensitive tokens - Improve disabled button UX with auth-specific tooltips - Add authorization checks in middleware for API tokens Closes authorization gaps in project management, server management, and settings components.
73 lines
1.8 KiB
PHP
73 lines
1.8 KiB
PHP
<?php
|
|
|
|
namespace App\Policies;
|
|
|
|
use App\Models\S3Storage;
|
|
use App\Models\User;
|
|
|
|
class S3StoragePolicy
|
|
{
|
|
/**
|
|
* Determine whether the user can view any models.
|
|
*/
|
|
public function viewAny(User $user): bool
|
|
{
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Determine whether the user can view the model.
|
|
*/
|
|
public function view(User $user, S3Storage $storage): bool
|
|
{
|
|
return $user->teams->contains('id', $storage->team_id);
|
|
}
|
|
|
|
/**
|
|
* Determine whether the user can create models.
|
|
*/
|
|
public function create(User $user): bool
|
|
{
|
|
return $user->isAdmin();
|
|
}
|
|
|
|
/**
|
|
* Determine whether the user can update the model.
|
|
*/
|
|
public function update(User $user, S3Storage $storage): bool
|
|
{
|
|
return $user->teams->contains('id', $storage->team_id) && $user->isAdminOfTeam($storage->team_id);
|
|
}
|
|
|
|
/**
|
|
* Determine whether the user can delete the model.
|
|
*/
|
|
public function delete(User $user, S3Storage $storage): bool
|
|
{
|
|
return $user->teams->contains('id', $storage->team_id) && $user->isAdminOfTeam($storage->team_id);
|
|
}
|
|
|
|
/**
|
|
* Determine whether the user can restore the model.
|
|
*/
|
|
public function restore(User $user, S3Storage $storage): bool
|
|
{
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Determine whether the user can permanently delete the model.
|
|
*/
|
|
public function forceDelete(User $user, S3Storage $storage): bool
|
|
{
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Determine whether the user can validate the connection of the model.
|
|
*/
|
|
public function validateConnection(User $user, S3Storage $storage): bool
|
|
{
|
|
return $user->teams->contains('id', $storage->team_id) && $user->isAdminOfTeam($storage->team_id);
|
|
}
|
|
}
|