From c781cddbab5f711ce2e22735b352fc9aa600b514 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 18 Oct 2026 23:21:16 +0200
Subject: [PATCH] fix(server-transfer): require update access to export bundles

---
 app/Livewire/Server/Transfer.php                |  2 +-
 tests/Feature/Livewire/ServerTransferUiTest.php | 11 +++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/app/Livewire/Server/Transfer.php b/app/Livewire/Server/Transfer.php
index 8ae349ec3f..8a4cdcd1d9 100644
--- a/app/Livewire/Server/Transfer.php
+++ b/app/Livewire/Server/Transfer.php
@@ -86,7 +86,7 @@ class Transfer extends Component
         $this->ensureDevelopmentAvailability();
 
         try {
-            $this->authorize('view', $this->server);
+            $this->authorize('update', $this->server);
             if ($this->isLocalhost) {
                 throw new \RuntimeException('The Coolify host (localhost) cannot be transferred.');
             }
diff --git a/tests/Feature/Livewire/ServerTransferUiTest.php b/tests/Feature/Livewire/ServerTransferUiTest.php
index e77cefc76e..31be7a217d 100644
--- a/tests/Feature/Livewire/ServerTransferUiTest.php
+++ b/tests/Feature/Livewire/ServerTransferUiTest.php
@@ -100,6 +100,17 @@ test('export bundle streams download from livewire', function () {
         ->assertFileDownloaded('server-transfer-'.$this->server->uuid.'.json');
 });
 
+test('team members cannot export a transfer bundle', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->call('exportBundle')
+        ->assertNoFileDownloaded();
+});
+
 test('transfer page badge shows the management state of the server', function (string $state, string $label, array $hidden) {
     $claimer = app(ServerTransferClaimer::class);
     match ($state) {