From 5ab6e1b245032269f304addaa28d691e508a5508 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 12:53:39 +0200
Subject: [PATCH] fix(storage): show file mount content only to users who can
 edit the resource

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 app/Livewire/Project/Service/FileStorage.php  |  2 +-
 .../project/service/file-storage.blade.php    | 21 +++--
 .../FileMountContentVisibilityTest.php        | 84 +++++++++++++++++++
 3 files changed, 98 insertions(+), 9 deletions(-)
 create mode 100644 tests/Feature/Authorization/FileMountContentVisibilityTest.php

diff --git a/app/Livewire/Project/Service/FileStorage.php b/app/Livewire/Project/Service/FileStorage.php
index 9ad6e4d2f4..fcbc100a1a 100644
--- a/app/Livewire/Project/Service/FileStorage.php
+++ b/app/Livewire/Project/Service/FileStorage.php
@@ -137,7 +137,7 @@ class FileStorage extends Component
             $this->fileStorage->save();
         } else {
             // Sync from model
-            $this->content = $this->fileStorage->content;
+            $this->content = auth()->user()?->can('update', $this->resource) ? $this->fileStorage->content : null;
             $this->isBasedOnGit = $this->fileStorage->is_based_on_git;
             $this->isPreviewSuffixEnabled = $this->fileStorage->is_preview_suffix_enabled ?? true;
         }
diff --git a/resources/views/livewire/project/service/file-storage.blade.php b/resources/views/livewire/project/service/file-storage.blade.php
index 377294ecfa..753b2f6555 100644
--- a/resources/views/livewire/project/service/file-storage.blade.php
+++ b/resources/views/livewire/project/service/file-storage.blade.php
@@ -119,10 +119,9 @@
                                     id="isBasedOnGit"></x-forms.checkbox>
                             </div>
                         @endif
-                        <x-forms.textarea
-                            label="{{ $fileStorage->is_based_on_git ? 'Content (refreshed after a successful deployment)' : 'Content' }}"
-                            helper="The content shown may be outdated. Click 'Load from server' to fetch the latest version."
-                            rows="20" id="content" disabled></x-forms.textarea>
+                        <x-callout type="info" title="Hidden (only admins can view)">
+                            The file content can contain secrets.
+                        </x-callout>
                     @endcan
                 @endif
             @else
@@ -140,10 +139,16 @@
                                 id="isBasedOnGit"></x-forms.checkbox>
                         </div>
                     @endif
-                    <x-forms.textarea
-                        label="{{ $fileStorage->is_based_on_git ? 'Content (refreshed after a successful deployment)' : 'Content' }}"
-                        helper="The content shown may be outdated. Click 'Load from server' to fetch the latest version."
-                        rows="20" id="content" disabled></x-forms.textarea>
+                    @can('update', $resource)
+                        <x-forms.textarea
+                            label="{{ $fileStorage->is_based_on_git ? 'Content (refreshed after a successful deployment)' : 'Content' }}"
+                            helper="The content shown may be outdated. Click 'Load from server' to fetch the latest version."
+                            rows="20" id="content" disabled></x-forms.textarea>
+                    @else
+                        <x-callout type="info" title="Hidden (only admins can view)">
+                            The file content can contain secrets.
+                        </x-callout>
+                    @endcan
                 @endif
             @endif
         </form>
diff --git a/tests/Feature/Authorization/FileMountContentVisibilityTest.php b/tests/Feature/Authorization/FileMountContentVisibilityTest.php
new file mode 100644
index 0000000000..149406183a
--- /dev/null
+++ b/tests/Feature/Authorization/FileMountContentVisibilityTest.php
@@ -0,0 +1,84 @@
+<?php
+
+use App\Livewire\Project\Service\FileStorage;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\LocalFileVolume;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\Process;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Bus::fake();
+    Process::fake();
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+    $this->owner = User::factory()->create();
+    $this->member = User::factory()->create();
+    $this->team->members()->attach($this->owner, ['role' => 'owner']);
+    $this->team->members()->attach($this->member, ['role' => 'member']);
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environmentId = $project->environments()->firstOrFail()->id;
+
+    $application = Application::factory()->create([
+        'environment_id' => $environmentId,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $service = Service::factory()->create([
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'environment_id' => $environmentId,
+    ]);
+    $serviceApplication = ServiceApplication::create([
+        'name' => 'app',
+        'service_id' => $service->id,
+    ]);
+
+    $this->fileMounts = collect([$application, $serviceApplication])->map(fn ($resource) => LocalFileVolume::create([
+        'fs_path' => '/data/app/.env',
+        'mount_path' => '/app/.env',
+        'content' => 'TOKEN=stored-file-mount-value',
+        'is_directory' => false,
+        'is_based_on_git' => false,
+        'resource_id' => $resource->id,
+        'resource_type' => $resource->getMorphClass(),
+    ]));
+});
+
+it('keeps file mount content out of member state', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    foreach ($this->fileMounts as $fileMount) {
+        $component = Livewire::test(FileStorage::class, ['fileStorage' => $fileMount])
+            ->assertSet('content', null)
+            ->assertSee('Hidden (only admins can view)');
+
+        expect(json_encode($component->snapshot).$component->html())->not->toContain('stored-file-mount-value');
+    }
+});
+
+it('keeps file mount content available to an owner', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    foreach ($this->fileMounts as $fileMount) {
+        Livewire::test(FileStorage::class, ['fileStorage' => $fileMount])
+            ->assertSet('content', 'TOKEN=stored-file-mount-value');
+    }
+});