feat(auth): implement authorization for Docker and server management

- Added authorization checks in Livewire components related to Docker and server management to ensure only authorized users can create, update, and manage Docker instances and server settings.
- Introduced new policies for StandaloneDocker and SwarmDocker to define access control rules based on user roles and team associations.
- Updated AuthServiceProvider to register the new policies, enhancing security and access control for Docker functionalities and server management operations.

app/Livewire/Server/CaCertificate/Show.php

@@ -6,12 +6,15 @@ use App\Helpers\SslHelper;
 use App\Jobs\RegenerateSslCertJob;
 use App\Models\Server;
 use App\Models\SslCertificate;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Carbon;
 use Livewire\Attributes\Locked;
 use Livewire\Component;
 
 class Show extends Component
 {
+    use AuthorizesRequests;
+
     #[Locked]
     public Server $server;
 
@@ -52,6 +55,7 @@ class Show extends Component
     public function saveCaCertificate()
     {
         try {
+            $this->authorize('manageCaCertificate', $this->server);
             if (! $this->certificateContent) {
                 throw new \Exception('Certificate content cannot be empty.');
             }
@@ -82,6 +86,7 @@ class Show extends Component
     public function regenerateCaCertificate()
     {
         try {
+            $this->authorize('manageCaCertificate', $this->server);
             SslHelper::generateSslCertificate(
                 commonName: 'Coolify CA Certificate',
                 serverId: $this->server->id,

app/Livewire/Server/Destinations.php

@@ -5,11 +5,14 @@ namespace App\Livewire\Server;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\SwarmDocker;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
 
 class Destinations extends Component
 {
+    use AuthorizesRequests;
+
     public Server $server;
 
     public Collection $networks;
@@ -33,6 +36,7 @@ class Destinations extends Component
     public function add($name)
     {
         if ($this->server->isSwarm()) {
+            $this->authorize('create', SwarmDocker::class);
             $found = $this->server->swarmDockers()->where('network', $name)->first();
             if ($found) {
                 $this->dispatch('error', 'Network already added to this server.');
@@ -46,6 +50,7 @@ class Destinations extends Component
                 ]);
             }
         } else {
+            $this->authorize('create', StandaloneDocker::class);
             $found = $this->server->standaloneDockers()->where('network', $name)->first();
             if ($found) {
                 $this->dispatch('error', 'Network already added to this server.');

app/Livewire/Server/Navbar.php

@@ -8,10 +8,13 @@ use App\Actions\Proxy\StopProxy;
 use App\Jobs\RestartProxyJob;
 use App\Models\Server;
 use App\Services\ProxyDashboardCacheService;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Navbar extends Component
 {
+    use AuthorizesRequests;
+
     public Server $server;
 
     public bool $isChecking = false;
@@ -57,6 +60,7 @@ class Navbar extends Component
     public function restart()
     {
         try {
+            $this->authorize('manageProxy', $this->server);
             RestartProxyJob::dispatch($this->server);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -66,6 +70,7 @@ class Navbar extends Component
     public function checkProxy()
     {
         try {
+            $this->authorize('manageProxy', $this->server);
             CheckProxy::run($this->server, true);
             $this->dispatch('startProxy')->self();
         } catch (\Throwable $e) {
@@ -76,6 +81,7 @@ class Navbar extends Component
     public function startProxy()
     {
         try {
+            $this->authorize('manageProxy', $this->server);
             $activity = StartProxy::run($this->server, force: true);
             $this->dispatch('activityMonitor', $activity->id);
         } catch (\Throwable $e) {
@@ -86,6 +92,7 @@ class Navbar extends Component
     public function stop(bool $forceStop = true)
     {
         try {
+            $this->authorize('manageProxy', $this->server);
             StopProxy::dispatch($this->server, $forceStop);
         } catch (\Throwable $e) {
             return handleError($e, $this);

app/Livewire/Server/Proxy/NewDynamicConfiguration.php

@@ -4,11 +4,14 @@ namespace App\Livewire\Server\Proxy;
 
 use App\Enums\ProxyTypes;
 use App\Models\Server;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 use Symfony\Component\Yaml\Yaml;
 
 class NewDynamicConfiguration extends Component
 {
+    use AuthorizesRequests;
+
     public string $fileName = '';
 
     public string $value = '';
@@ -23,6 +26,7 @@ class NewDynamicConfiguration extends Component
 
     public function mount()
     {
+        $this->server = Server::ownedByCurrentTeam()->whereId($this->server_id)->first();
         $this->parameters = get_route_parameters();
         if ($this->fileName !== '') {
             $this->fileName = str_replace('|', '.', $this->fileName);
@@ -32,6 +36,7 @@ class NewDynamicConfiguration extends Component
     public function addDynamicConfiguration()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->validate([
                 'fileName' => 'required',
                 'value' => 'required',
@@ -39,9 +44,7 @@ class NewDynamicConfiguration extends Component
             if (data_get($this->parameters, 'server_uuid')) {
                 $this->server = Server::ownedByCurrentTeam()->whereUuid(data_get($this->parameters, 'server_uuid'))->first();
             }
-            if (! is_null($this->server_id)) {
-                $this->server = Server::ownedByCurrentTeam()->whereId($this->server_id)->first();
-            }
+
             if (is_null($this->server)) {
                 return redirect()->route('server.index');
             }

app/Livewire/Server/Security/Patches.php

@@ -7,10 +7,13 @@ use App\Actions\Server\UpdatePackage;
 use App\Events\ServerPackageUpdated;
 use App\Models\Server;
 use App\Notifications\Server\ServerPatchCheck;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Patches extends Component
 {
+    use AuthorizesRequests;
+
     public array $parameters;
 
     public Server $server;
@@ -36,11 +39,9 @@ class Patches extends Component
 
     public function mount()
     {
-        if (! auth()->user()->isAdmin()) {
-            abort(403);
-        }
         $this->parameters = get_route_parameters();
         $this->server = Server::ownedByCurrentTeam()->whereUuid($this->parameters['server_uuid'])->firstOrFail();
+        $this->authorize('viewSecurity', $this->server);
     }
 
     public function checkForUpdatesDispatch()

app/Livewire/Server/Show.php

@@ -152,6 +152,7 @@ class Show extends Component
         if ($toModel) {
             $this->validate();
 
+            $this->authorize('update', $this->server);
             if (Server::where('team_id', currentTeam()->id)
                 ->where('ip', $this->ip)
                 ->where('id', '!=', $this->server->id)
@@ -160,8 +161,6 @@ class Show extends Component
                 throw new \Exception('This IP/Domain is already in use by another server in your team.');
             }
 
-            $this->authorize('update', $this->server);
-
             $this->server->name = $this->name;
             $this->server->description = $this->description;
             $this->server->ip = $this->ip;
@@ -253,38 +252,57 @@ class Show extends Component
 
     public function restartSentinel()
     {
-        $this->server->restartSentinel();
-        $this->dispatch('success', 'Sentinel restarted.');
+        try {
+            $this->authorize('manageSentinel', $this->server);
+            $this->server->restartSentinel();
+            $this->dispatch('success', 'Sentinel restarted.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+
     }
 
     public function updatedIsSentinelDebugEnabled($value)
     {
-        $this->submit();
-        $this->restartSentinel();
+        try {
+            $this->submit();
+            $this->restartSentinel();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function updatedIsMetricsEnabled($value)
     {
-        $this->submit();
-        $this->restartSentinel();
+        try {
+            $this->submit();
+            $this->restartSentinel();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function updatedIsSentinelEnabled($value)
     {
-        if ($value === true) {
-            StartSentinel::run($this->server, true);
-        } else {
-            $this->isMetricsEnabled = false;
-            $this->isSentinelDebugEnabled = false;
-            StopSentinel::dispatch($this->server);
+        try {
+            $this->authorize('manageSentinel', $this->server);
+            if ($value === true) {
+                StartSentinel::run($this->server, true);
+            } else {
+                $this->isMetricsEnabled = false;
+                $this->isSentinelDebugEnabled = false;
+                StopSentinel::dispatch($this->server);
+            }
+            $this->submit();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-        $this->submit();
-
     }
 
     public function regenerateSentinelToken()
     {
         try {
+            $this->authorize('manageSentinel', $this->server);
             $this->server->settings->generateSentinelToken();
             $this->dispatch('success', 'Token regenerated & Sentinel restarted.');
         } catch (\Throwable $e) {
@@ -294,7 +312,11 @@ class Show extends Component
 
     public function instantSave()
     {
-        $this->submit();
+        try {
+            $this->submit();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function submit()