fix(security): authorize integration token creation

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Livewire/Security/IntegrationTokenForm.php

@@ -87,6 +87,8 @@ class IntegrationTokenForm extends Component
 
     public function addToken(IntegrationTokenValidator $validator, CloudflareDnsProvider $cloudflare): void
     {
+        $this->authorize('create', IntegrationToken::class);
+
         $validated = $this->validate();
         $metadata = array_filter(data_get($validated, 'metadata', []), fn ($value) => filled($value));
         if ($validated['provider'] === 'cloudflare' && ! $validated['automaticDns']) {

tests/Feature/Security/IntegrationTokenFormAuthorizationTest.php

@@ -0,0 +1,64 @@
+<?php
+
+use App\Livewire\Security\IntegrationTokenForm;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutDefer();
+    if (! InstanceSettings::query()->whereKey(0)->exists()) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->save();
+    }
+    Once::flush();
+    Http::preventStrayRequests();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'admin']);
+
+    session(['currentTeam' => $this->team]);
+    $this->actingAs($this->user);
+});
+
+function openIntegrationTokenFormAsAdmin(): mixed
+{
+    return Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'cloudflare')
+        ->set('name', 'review-fix-e-token')
+        ->set('token', 'cloudflare-token')
+        ->set('capabilities', ['dns']);
+}
+
+test('a user demoted to member after opening the form cannot add a token', function () {
+    $component = openIntegrationTokenFormAsAdmin();
+
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    $this->user->load('teams');
+
+    $component->call('addToken')->assertForbidden();
+
+    expect(IntegrationToken::query()->count())->toBe(0);
+});
+
+test('a user who switched to a team where they are a member cannot add a token', function () {
+    $memberTeam = Team::factory()->create();
+    $memberTeam->members()->attach($this->user->id, ['role' => 'member']);
+    $this->user->load('teams');
+    $component = openIntegrationTokenFormAsAdmin();
+
+    session(['currentTeam' => $memberTeam]);
+
+    $component->call('addToken')->assertForbidden();
+
+    expect(IntegrationToken::query()->count())->toBe(0);
+});