feat(auth): implement authorization checks for server updates across multiple components
- Added authorization checks using the `authorize` method in various Livewire components to ensure only authorized users can update server settings. - Updated `ServerPolicy` to restrict update permissions to admin users and their respective teams. - Enhanced security and access control for server management functionalities.
This commit is contained in:
@@ -28,7 +28,7 @@ class ServerPolicy
|
||||
*/
|
||||
public function create(User $user): bool
|
||||
{
|
||||
return true;
|
||||
return $user->isAdmin();
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -36,7 +36,7 @@ class ServerPolicy
|
||||
*/
|
||||
public function update(User $user, Server $server): bool
|
||||
{
|
||||
return $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
|
||||
return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -44,7 +44,7 @@ class ServerPolicy
|
||||
*/
|
||||
public function delete(User $user, Server $server): bool
|
||||
{
|
||||
return $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
|
||||
return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
Reference in New Issue
Block a user