From babe43da3212f154d94310fc9fd2abfecef8dfdc Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 5 Oct 2026 21:23:36 +0200
Subject: [PATCH] fix(audit): return 403 on the audit log without a session
 team

When the user had no session team (for example after removal from the
team), the audit log page threw an error and returned 500.

- Return 403 when there is no session team or the user is not an admin
---
 app/Livewire/Team/AuditLog.php                |  4 +-
 .../TeamAuditLogWithoutSessionTeamTest.php    | 48 +++++++++++++++++++
 2 files changed, 51 insertions(+), 1 deletion(-)
 create mode 100644 tests/Feature/TeamAuditLogWithoutSessionTeamTest.php

diff --git a/app/Livewire/Team/AuditLog.php b/app/Livewire/Team/AuditLog.php
index 53cb203eff..9cf3ada8c8 100644
--- a/app/Livewire/Team/AuditLog.php
+++ b/app/Livewire/Team/AuditLog.php
@@ -22,7 +22,9 @@ class AuditLog extends Component
 
     public function boot(): void
     {
-        abort_unless(auth()->user()->isAdminOfTeam(currentTeam()->id), 403);
+        $team = currentTeam();
+
+        abort_unless($team && auth()->user()->isAdminOfTeam($team->id), 403);
     }
 
     public function updatedSearch(): void
diff --git a/tests/Feature/TeamAuditLogWithoutSessionTeamTest.php b/tests/Feature/TeamAuditLogWithoutSessionTeamTest.php
new file mode 100644
index 0000000000..2d861d0fb6
--- /dev/null
+++ b/tests/Feature/TeamAuditLogWithoutSessionTeamTest.php
@@ -0,0 +1,48 @@
+<?php
+
+use App\Livewire\Team\AuditLog;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->secondTeam = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'admin']);
+    $this->secondTeam->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+test('the audit log is forbidden when the session has no team', function () {
+    session()->forget('currentTeam');
+
+    Livewire::test(AuditLog::class)->assertForbidden();
+});
+
+test('an open audit log is forbidden after the session team is removed from the user', function () {
+    $component = Livewire::test(AuditLog::class)->assertOk();
+
+    $this->team->members()->detach($this->user->id);
+    auth()->setUser($this->user->fresh());
+
+    $component->set('search', 'deployment')->assertForbidden();
+});
+
+test('team admins can still open the audit log', function () {
+    Livewire::test(AuditLog::class)->assertOk();
+});
+
+test('team members cannot open the audit log', function () {
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    auth()->setUser($this->user->fresh());
+
+    Livewire::test(AuditLog::class)->assertForbidden();
+});