From b5fe5dd9093f4be351de997f06b06276d77e7723 Mon Sep 17 00:00:00 2001 From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com> Date: Sat, 23 Aug 2025 18:50:50 +0200 Subject: [PATCH] feat(auth): refine authorization checks for S3 storage and service management --- app/Policies/S3StoragePolicy.php | 2 +- app/Policies/ServicePolicy.php | 24 +- app/Providers/AuthServiceProvider.php | 9 + .../project/application/general.blade.php | 211 ++++++++++-------- 4 files changed, 146 insertions(+), 100 deletions(-) diff --git a/app/Policies/S3StoragePolicy.php b/app/Policies/S3StoragePolicy.php index 4f837a3dd..9b24dd31a 100644 --- a/app/Policies/S3StoragePolicy.php +++ b/app/Policies/S3StoragePolicy.php @@ -29,7 +29,7 @@ class S3StoragePolicy */ public function create(User $user): bool { - return true; + return $user->isAdmin(); } /** diff --git a/app/Policies/ServicePolicy.php b/app/Policies/ServicePolicy.php index 51a6d8116..b252d3600 100644 --- a/app/Policies/ServicePolicy.php +++ b/app/Policies/ServicePolicy.php @@ -28,7 +28,7 @@ class ServicePolicy */ public function create(User $user): bool { - return true; + return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $service->team()->first()->id) !== null; } /** @@ -36,7 +36,7 @@ class ServicePolicy */ public function update(User $user, Service $service): bool { - return true; + return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $service->team()->first()->id) !== null; } /** @@ -73,10 +73,22 @@ class ServicePolicy public function stop(User $user, Service $service): bool { - if ($user->isAdmin()) { - return true; - } + return $user->teams()->get()->firstWhere('id', $service->team()->first()->id) !== null; + } - return false; + /** + * Determine whether the user can manage environment variables. + */ + public function manageEnvironment(User $user, Service $service): bool + { + return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $service->team()->first()->id) !== null; + } + + /** + * Determine whether the user can deploy the service. + */ + public function deploy(User $user, Service $service): bool + { + return $user->teams()->get()->firstWhere('id', $service->team()->first()->id) !== null; } } diff --git a/app/Providers/AuthServiceProvider.php b/app/Providers/AuthServiceProvider.php index a2c02d20a..3aefca9f2 100644 --- a/app/Providers/AuthServiceProvider.php +++ b/app/Providers/AuthServiceProvider.php @@ -20,6 +20,15 @@ class AuthServiceProvider extends ServiceProvider \App\Models\Application::class => \App\Policies\ApplicationPolicy::class, \App\Models\ApplicationPreview::class => \App\Policies\ApplicationPreviewPolicy::class, \App\Models\ApplicationSetting::class => \App\Policies\ApplicationSettingPolicy::class, + // Database policies - all use the shared DatabasePolicy + \App\Models\StandalonePostgresql::class => \App\Policies\DatabasePolicy::class, + \App\Models\StandaloneMysql::class => \App\Policies\DatabasePolicy::class, + \App\Models\StandaloneMariadb::class => \App\Policies\DatabasePolicy::class, + \App\Models\StandaloneMongodb::class => \App\Policies\DatabasePolicy::class, + \App\Models\StandaloneRedis::class => \App\Policies\DatabasePolicy::class, + \App\Models\StandaloneKeydb::class => \App\Policies\DatabasePolicy::class, + \App\Models\StandaloneDragonfly::class => \App\Policies\DatabasePolicy::class, + \App\Models\StandaloneClickhouse::class => \App\Policies\DatabasePolicy::class, ]; /** diff --git a/resources/views/livewire/project/application/general.blade.php b/resources/views/livewire/project/application/general.blade.php index 03f26fd04..3fa370dd6 100644 --- a/resources/views/livewire/project/application/general.blade.php +++ b/resources/views/livewire/project/application/general.blade.php @@ -2,9 +2,11 @@

General

- - Save - + @can('update', $application) + + Save + + @endcan {{-- Download Config @@ -24,13 +26,24 @@ @if (!$application->dockerfile && $application->build_pack !== 'dockerimage')
- - - - - - + @can('update', $application) + + + + + + + @else + + + + + + + @endcan @if ($application->settings->is_static || $application->build_pack === 'static') @@ -52,8 +65,10 @@ helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.

Example
- http://app.coolify.io,https://cloud.coolify.io/dashboard
- http://app.coolify.io/api/v3
- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. " label="Domains for {{ str($serviceName)->headline() }}" id="parsedServiceDomains.{{ str($serviceName)->slug('_') }}.domain"> - Generate - Domain + @can('update', $application) + Generate + Domain + @endcan
@endif @endforeach @@ -66,8 +81,10 @@ - Generate Default Nginx - Configuration + @can('update', $application) + Generate Default Nginx + Configuration + @endcan @endif
@if ($application->could_set_build_commands()) @@ -90,8 +107,10 @@ - Generate Domain - + @can('update', $application) + Generate Domain + + @endcan @endif
@@ -204,87 +223,92 @@ @endif
@if ($application->build_pack === 'dockercompose') -
-
- + @else +
+ @endcan +
+ + +
+
+ +
+
The following commands are for advanced use cases. + Only + modify them if you + know what are + you doing.
+
+ + +
+
+ @else +
+ - -
-
- -
-
The following commands are for advanced use cases. - Only - modify them if you - know what are - you doing.
-
- - -
-
- @else -
- - @if ($application->build_pack === 'dockerfile' && !$application->dockerfile) - - @endif - - @if ($application->build_pack === 'dockerfile') - - @endif - @if ($application->could_set_build_commands()) - @if ($application->settings->is_static) - - @else - + @if ($application->build_pack === 'dockerfile' && !$application->dockerfile) + @endif + + @if ($application->build_pack === 'dockerfile') + + @endif + @if ($application->could_set_build_commands()) + @if ($application->settings->is_static) + + @else + + @endif + @endif + +
+ @if ($this->application->is_github_based() && !$this->application->is_public_repository()) +
+ +
@endif + -
- @if ($this->application->is_github_based() && !$this->application->is_public_repository()) -
- -
- @endif - - - @if ($application->build_pack !== 'dockercompose') -
- -
- @endif + @if ($application->build_pack !== 'dockercompose') +
+ +
+ @endif @endif
@endif @@ -419,6 +443,7 @@ @script