From 0ac3b6c9d6570d329fff463be9b385c8695bcf97 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Wed, 23 Sep 2026 22:32:26 +0200
Subject: [PATCH] fix: align notification settings access checks

---
 app/Livewire/Notifications/Email.php          |  1 +
 .../NotificationAuthorizationTest.php         | 55 +++++++++++++++++++
 2 files changed, 56 insertions(+)

diff --git a/app/Livewire/Notifications/Email.php b/app/Livewire/Notifications/Email.php
index 70b424d23a..0a37c75d16 100644
--- a/app/Livewire/Notifications/Email.php
+++ b/app/Livewire/Notifications/Email.php
@@ -437,6 +437,7 @@ class Email extends Component
     {
         $this->authorize('update', $this->settings);
         $settings = instanceSettings();
+        $this->authorize('view', $settings);
         $this->smtpFromAddress = $settings->smtp_from_address;
         $this->smtpFromName = $settings->smtp_from_name;
 
diff --git a/tests/Feature/Authorization/NotificationAuthorizationTest.php b/tests/Feature/Authorization/NotificationAuthorizationTest.php
index 424696c17d..89dca49fcd 100644
--- a/tests/Feature/Authorization/NotificationAuthorizationTest.php
+++ b/tests/Feature/Authorization/NotificationAuthorizationTest.php
@@ -279,6 +279,61 @@ test('member cannot copy instance email settings', function () {
         ->assertForbidden();
 });
 
+test('team admin cannot copy instance email credentials', function () {
+    InstanceSettings::query()->findOrFail(0)->update([
+        'smtp_password' => 'instance-smtp-secret',
+        'resend_api_key' => 'instance-resend-secret',
+    ]);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(EmailNotification::class)
+        ->assertSet('smtpPassword', null)
+        ->assertSet('resendApiKey', null)
+        ->call('copyFromInstanceSettings')
+        ->assertForbidden();
+
+    expect($this->team->emailNotificationSettings->fresh()->smtp_password)->toBeNull();
+    expect($this->team->emailNotificationSettings->fresh()->resend_api_key)->toBeNull();
+});
+
+test('instance admin can copy instance email credentials to an authorized team', function () {
+    $rootTeam = Team::factory()->create(['id' => 0]);
+    $this->admin->teams()->attach($rootTeam, ['role' => 'admin']);
+
+    InstanceSettings::query()->findOrFail(0)->update([
+        'smtp_from_address' => 'instance@example.com',
+        'smtp_from_name' => 'Instance',
+        'smtp_password' => 'instance-smtp-secret',
+        'resend_api_key' => 'instance-resend-secret',
+    ]);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(EmailNotification::class)
+        ->call('copyFromInstanceSettings')
+        ->assertHasNoErrors()
+        ->assertSet('smtpPassword', 'instance-smtp-secret')
+        ->assertSet('resendApiKey', 'instance-resend-secret');
+
+    expect($this->team->emailNotificationSettings->fresh()->smtp_password)->toBe('instance-smtp-secret');
+    expect($this->team->emailNotificationSettings->fresh()->resend_api_key)->toBe('instance-resend-secret');
+});
+
+test('instance admin cannot copy credentials to a team they cannot update', function () {
+    $rootTeam = Team::factory()->create(['id' => 0]);
+    $this->member->teams()->attach($rootTeam, ['role' => 'admin']);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(EmailNotification::class)
+        ->call('copyFromInstanceSettings')
+        ->assertForbidden();
+});
+
 test('admin can update email notification settings', function () {
     $this->actingAs($this->admin);
     session(['currentTeam' => $this->team]);