fix(api): authorize target environment moves

bootstrap/helpers/api.php

@@ -8,6 +8,7 @@ use App\Support\ValidationPatterns;
 use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\Validation\Rule;
 
 function getTeamIdFromToken()
@@ -202,6 +203,8 @@ function moveResourceToEnvironment(Request $request, $resource, string $resource
         return response()->json(['message' => 'Target environment not found or not owned by your team.'], 404);
     }
 
+    Gate::authorize('update', $newEnvironment);
+
     if ($resource->environment_id === $newEnvironment->id) {
         return response()->json(['message' => "$resourceType is already in this environment."], 400);
     }

tests/Feature/MoveResourceApiTest.php

@@ -11,6 +11,7 @@ use App\Models\StandalonePostgresql;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Gate;
 
 uses(RefreshDatabase::class);
 
@@ -123,6 +124,36 @@ describe('POST /api/v1/applications/{uuid}/move', function () {
         $response->assertStatus(404);
     });
 
+    test('returns 403 when target environment update is denied', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        Gate::before(function (User $user, string $ability, array $arguments) {
+            $target = $arguments[0] ?? null;
+
+            if ($ability === 'update' && $target instanceof Environment && $target->is($this->targetEnvironment)) {
+                return false;
+            }
+
+            return null;
+        });
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/applications/{$application->uuid}/move", [
+            'environment_uuid' => $this->targetEnvironment->uuid,
+        ]);
+
+        $response->assertForbidden();
+
+        $application->refresh();
+        expect($application->environment_id)->toBe($this->environment->id);
+    });
+
     test('returns 400 when application is already in the target environment', function () {
         $application = Application::factory()->create([
             'environment_id' => $this->environment->id,