fix: root + read:sensive could read senstive data with a middlewarew

app/Http/Controllers/Api/ApplicationsController.php

@@ -25,13 +25,10 @@ class ApplicationsController extends Controller
 {
     private function removeSensitiveData($application)
     {
-        $token = auth()->user()->currentAccessToken();
         $application->makeHidden([
             'id',
         ]);
-        if ($token->can('read:sensitive')) {
+        if (request()->attributes->get('can_read_sensitive', false) === false) {
-            return serializeApiResponse($application);
-        }
             $application->makeHidden([
                 'custom_labels',
                 'dockerfile',
@@ -45,6 +42,7 @@ class ApplicationsController extends Controller
                 'value',
                 'real_value',
             ]);
+        }
 
         return serializeApiResponse($application);
     }

app/Http/Controllers/Api/DatabasesController.php

@@ -19,15 +19,11 @@ class DatabasesController extends Controller
 {
     private function removeSensitiveData($database)
     {
-        $token = auth()->user()->currentAccessToken();
         $database->makeHidden([
             'id',
             'laravel_through_key',
         ]);
-        if ($token->can('read:sensitive')) {
+        if (request()->attributes->get('can_read_sensitive', false) === false) {
-            return serializeApiResponse($database);
-        }
-
             $database->makeHidden([
                 'internal_db_url',
                 'external_db_url',
@@ -38,6 +34,7 @@ class DatabasesController extends Controller
                 'keydb_password',
                 'clickhouse_admin_password',
             ]);
+        }
 
         return serializeApiResponse($database);
     }

app/Http/Controllers/Api/DeployController.php

@@ -16,14 +16,11 @@ class DeployController extends Controller
 {
     private function removeSensitiveData($deployment)
     {
-        $token = auth()->user()->currentAccessToken();
+        if (request()->attributes->get('can_read_sensitive', false) === false) {
-        if ($token->can('read:sensitive')) {
-            return serializeApiResponse($deployment);
-        }
-
             $deployment->makeHidden([
                 'logs',
             ]);
+        }
 
         return serializeApiResponse($deployment);
     }

app/Http/Controllers/Api/SecurityController.php

@@ -11,13 +11,11 @@ class SecurityController extends Controller
 {
     private function removeSensitiveData($team)
     {
-        $token = auth()->user()->currentAccessToken();
+        if (request()->attributes->get('can_read_sensitive', false) === false) {
-        if ($token->can('read:sensitive')) {
-            return serializeApiResponse($team);
-        }
             $team->makeHidden([
                 'private_key',
             ]);
+        }
 
         return serializeApiResponse($team);
     }

app/Http/Controllers/Api/ServersController.php

@@ -19,25 +19,22 @@ class ServersController extends Controller
 {
     private function removeSensitiveDataFromSettings($settings)
     {
-        $token = auth()->user()->currentAccessToken();
+        if (request()->attributes->get('can_read_sensitive', false) === false) {
-        if ($token->can('read:sensitive')) {
-            return serializeApiResponse($settings);
-        }
             $settings = $settings->makeHidden([
                 'sentinel_token',
             ]);
+        }
 
         return serializeApiResponse($settings);
     }
 
     private function removeSensitiveData($server)
     {
-        $token = auth()->user()->currentAccessToken();
         $server->makeHidden([
             'id',
         ]);
-        if ($token->can('read:sensitive')) {
+        if (request()->attributes->get('can_read_sensitive', false) === false) {
-            return serializeApiResponse($server);
+            // Do nothing
         }
 
         return serializeApiResponse($server);

app/Http/Controllers/Api/ServicesController.php

@@ -18,18 +18,15 @@ class ServicesController extends Controller
 {
     private function removeSensitiveData($service)
     {
-        $token = auth()->user()->currentAccessToken();
         $service->makeHidden([
             'id',
         ]);
-        if ($token->can('read:sensitive')) {
+        if (request()->attributes->get('can_read_sensitive', false) === false) {
-            return serializeApiResponse($service);
-        }
-
             $service->makeHidden([
                 'docker_compose_raw',
                 'docker_compose',
             ]);
+        }
 
         return serializeApiResponse($service);
     }

app/Http/Controllers/Api/TeamController.php

@@ -10,20 +10,18 @@ class TeamController extends Controller
 {
     private function removeSensitiveData($team)
     {
-        $token = auth()->user()->currentAccessToken();
         $team->makeHidden([
             'custom_server_limit',
             'pivot',
         ]);
-        if ($token->can('read:sensitive')) {
+        if (request()->attributes->get('can_read_sensitive', false) === false) {
-            return serializeApiResponse($team);
-        }
             $team->makeHidden([
                 'smtp_username',
                 'smtp_password',
                 'resend_api_key',
                 'telegram_token',
             ]);
+        }
 
         return serializeApiResponse($team);
     }

app/Http/Kernel.php

@@ -70,5 +70,6 @@ class Kernel extends HttpKernel
         'abilities' => \Laravel\Sanctum\Http\Middleware\CheckAbilities::class,
         'ability' => \Laravel\Sanctum\Http\Middleware\CheckForAnyAbility::class,
         'api.ability' => \App\Http\Middleware\ApiAbility::class,
+        'api.sensitive' => \App\Http\Middleware\ApiSensitiveData::class,
     ];
 }

app/Http/Middleware/ApiSensitiveData.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class ApiSensitiveData
+{
+    public function handle(Request $request, Closure $next)
+    {
+        $token = $request->user()->currentAccessToken();
+
+        // Allow access to sensitive data if token has root or read:sensitive permission
+        $request->attributes->add([
+            'can_read_sensitive' => $token->can('root') || $token->can('read:sensitive'),
+        ]);
+
+        return $next($request);
+    }
+}

routes/api.php

@@ -26,7 +26,7 @@ Route::group([
     Route::get('/disable', [OtherController::class, 'disable_api']);
 });
 Route::group([
-    'middleware' => ['auth:sanctum', ApiAllowed::class],
+    'middleware' => ['auth:sanctum', ApiAllowed::class, 'api.sensitive'],
     'prefix' => 'v1',
 ], function () {
     Route::get('/version', [OtherController::class, 'version'])->middleware(['api.ability:read']);