starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-09-26 09:20:54 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: align notification settings access checks (#11960)

Browse Source
This commit is contained in:
Andras Bacsai
2026-09-23 22:33:09 +02:00
committed by GitHub
parent 73b12ba0da 0ac3b6c9d6
commit 39cc12b780
2 changed files with 56 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Livewire/Notifications/Email.php
+1
View File
@@ -437,6 +437,7 @@ class Email extends Component
{
$this->authorize('update', $this->settings);
$settings = instanceSettings();
$this->authorize('view', $settings);
$this->smtpFromAddress = $settings->smtp_from_address;
$this->smtpFromName = $settings->smtp_from_name;
tests/Feature/Authorization/NotificationAuthorizationTest.php
+55
View File
@@ -279,6 +279,61 @@ test('member cannot copy instance email settings', function () {
->assertForbidden();
});
test('team admin cannot copy instance email credentials', function () {
InstanceSettings::query()->findOrFail(0)->update([
'smtp_password' => 'instance-smtp-secret',
'resend_api_key' => 'instance-resend-secret',
]);
$this->actingAs($this->admin);
session(['currentTeam' => $this->team]);
Livewire::test(EmailNotification::class)
->assertSet('smtpPassword', null)
->assertSet('resendApiKey', null)
->call('copyFromInstanceSettings')
->assertForbidden();
expect($this->team->emailNotificationSettings->fresh()->smtp_password)->toBeNull();
expect($this->team->emailNotificationSettings->fresh()->resend_api_key)->toBeNull();
});
test('instance admin can copy instance email credentials to an authorized team', function () {
$rootTeam = Team::factory()->create(['id' => 0]);
$this->admin->teams()->attach($rootTeam, ['role' => 'admin']);
InstanceSettings::query()->findOrFail(0)->update([
'smtp_from_address' => 'instance@example.com',
'smtp_from_name' => 'Instance',
'smtp_password' => 'instance-smtp-secret',
'resend_api_key' => 'instance-resend-secret',
]);
$this->actingAs($this->admin);
session(['currentTeam' => $this->team]);
Livewire::test(EmailNotification::class)
->call('copyFromInstanceSettings')
->assertHasNoErrors()
->assertSet('smtpPassword', 'instance-smtp-secret')
->assertSet('resendApiKey', 'instance-resend-secret');
expect($this->team->emailNotificationSettings->fresh()->smtp_password)->toBe('instance-smtp-secret');
expect($this->team->emailNotificationSettings->fresh()->resend_api_key)->toBe('instance-resend-secret');
});
test('instance admin cannot copy credentials to a team they cannot update', function () {
$rootTeam = Team::factory()->create(['id' => 0]);
$this->member->teams()->attach($rootTeam, ['role' => 'admin']);
$this->actingAs($this->member);
session(['currentTeam' => $this->team]);
Livewire::test(EmailNotification::class)
->call('copyFromInstanceSettings')
->assertForbidden();
});
test('admin can update email notification settings', function () {
$this->actingAs($this->admin);
session(['currentTeam' => $this->team]);