diff --git a/app/Policies/ApplicationPolicy.php b/app/Policies/ApplicationPolicy.php index 1a1290b55b..3dca4cdf7e 100644 --- a/app/Policies/ApplicationPolicy.php +++ b/app/Policies/ApplicationPolicy.php @@ -106,16 +106,6 @@ class ApplicationPolicy return $teamId !== null && $user->isAdminOfTeam($teamId); } - /** - * Determine whether the user can manage deployments. - */ - public function manageDeployments(User $user, Application $application): bool - { - $teamId = $this->getTeamId($application); - - return $teamId !== null && $user->isAdminOfTeam($teamId); - } - /** * Determine whether the user can manage environment variables. */ @@ -126,14 +116,6 @@ class ApplicationPolicy return $teamId !== null && $user->isAdminOfTeam($teamId); } - /** - * Determine whether the user can cleanup deployment queue. - */ - public function cleanupDeploymentQueue(User $user): bool - { - return $user->isAdmin(); - } - private function getTeamId(Application $application): ?int { return $application->team()?->id; diff --git a/app/Policies/ApplicationPreviewPolicy.php b/app/Policies/ApplicationPreviewPolicy.php index f3c13acd94..6e1b597249 100644 --- a/app/Policies/ApplicationPreviewPolicy.php +++ b/app/Policies/ApplicationPreviewPolicy.php @@ -88,16 +88,6 @@ class ApplicationPreviewPolicy return $teamId !== null && $user->isAdminOfTeam($teamId); } - /** - * Determine whether the user can manage preview deployments. - */ - public function manageDeployments(User $user, ApplicationPreview $applicationPreview): bool - { - $teamId = $this->getTeamId($applicationPreview); - - return $teamId !== null && $user->isAdminOfTeam($teamId); - } - private function getTeamId(ApplicationPreview $applicationPreview): ?int { return $applicationPreview->application?->team()?->id; diff --git a/app/Policies/ResourceCreatePolicy.php b/app/Policies/ResourceCreatePolicy.php index 5b60674d5b..ee2876d956 100644 --- a/app/Policies/ResourceCreatePolicy.php +++ b/app/Policies/ResourceCreatePolicy.php @@ -2,39 +2,10 @@ namespace App\Policies; -use App\Models\Application; -use App\Models\Service; -use App\Models\StandaloneClickhouse; -use App\Models\StandaloneDragonfly; -use App\Models\StandaloneKeydb; -use App\Models\StandaloneMariadb; -use App\Models\StandaloneMongodb; -use App\Models\StandaloneMysql; -use App\Models\StandalonePostgresql; -use App\Models\StandaloneRedis; -use App\Models\StandaloneSqlite; use App\Models\User; class ResourceCreatePolicy { - /** - * List of resource classes that can be created - */ - public const CREATABLE_RESOURCES = [ - StandalonePostgresql::class, - StandaloneRedis::class, - StandaloneMongodb::class, - StandaloneMysql::class, - StandaloneMariadb::class, - StandaloneKeydb::class, - StandaloneDragonfly::class, - StandaloneClickhouse::class, - StandaloneSqlite::class, - Service::class, - Application::class, - GithubApp::class, - ]; - /** * Determine whether the user can create any resource. */ @@ -42,24 +13,4 @@ class ResourceCreatePolicy { return $user->isAdmin(); } - - /** - * Determine whether the user can create a specific resource type. - */ - public function create(User $user, string $resourceClass): bool - { - if (! in_array($resourceClass, self::CREATABLE_RESOURCES)) { - return false; - } - - return $user->isAdmin(); - } - - /** - * Authorize creation of all supported resource types. - */ - public function authorizeAllResourceCreation(User $user): bool - { - return $this->createAny($user); - } } diff --git a/app/Policies/ServicePolicy.php b/app/Policies/ServicePolicy.php index 6ca79b42ac..272ea1e930 100644 --- a/app/Policies/ServicePolicy.php +++ b/app/Policies/ServicePolicy.php @@ -109,16 +109,6 @@ class ServicePolicy return $teamId !== null && $user->isAdminOfTeam($teamId); } - /** - * Determine whether the user can access the terminal. - */ - public function accessTerminal(User $user, Service $service): bool - { - $teamId = $this->getTeamId($service); - - return $teamId !== null && $user->isAdminOfTeam($teamId); - } - private function getTeamId(Service $service): ?int { return $service->team()?->id; diff --git a/tests/Unit/Policies/ApplicationPolicyTest.php b/tests/Unit/Policies/ApplicationPolicyTest.php index e3c80a4e59..04d37bbc99 100644 --- a/tests/Unit/Policies/ApplicationPolicyTest.php +++ b/tests/Unit/Policies/ApplicationPolicyTest.php @@ -158,28 +158,6 @@ it('denies team member to deploy their own team application', function () { expect($policy->deploy($user, $application))->toBeFalse(); }); -it('allows team admin to manage deployments', function () { - $user = Mockery::mock(User::class)->makePartial(); - $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true); - - $application = Mockery::mock(Application::class)->makePartial(); - $application->shouldReceive('team')->andReturn((object) ['id' => 1]); - - $policy = new ApplicationPolicy; - expect($policy->manageDeployments($user, $application))->toBeTrue(); -}); - -it('denies team member to manage deployments', function () { - $user = Mockery::mock(User::class)->makePartial(); - $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false); - - $application = Mockery::mock(Application::class)->makePartial(); - $application->shouldReceive('team')->andReturn((object) ['id' => 1]); - - $policy = new ApplicationPolicy; - expect($policy->manageDeployments($user, $application))->toBeFalse(); -}); - it('allows team admin to manage environment variables', function () { $user = Mockery::mock(User::class)->makePartial(); $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true); @@ -202,22 +180,6 @@ it('denies team member to manage environment variables', function () { expect($policy->manageEnvironment($user, $application))->toBeFalse(); }); -it('allows admin to cleanup deployment queue', function () { - $user = Mockery::mock(User::class)->makePartial(); - $user->shouldReceive('isAdmin')->andReturn(true); - - $policy = new ApplicationPolicy; - expect($policy->cleanupDeploymentQueue($user))->toBeTrue(); -}); - -it('denies member to cleanup deployment queue', function () { - $user = Mockery::mock(User::class)->makePartial(); - $user->shouldReceive('isAdmin')->andReturn(false); - - $policy = new ApplicationPolicy; - expect($policy->cleanupDeploymentQueue($user))->toBeFalse(); -}); - it('denies restore for any user', function () { $user = Mockery::mock(User::class)->makePartial(); diff --git a/tests/Unit/Policies/ApplicationPreviewPolicyTest.php b/tests/Unit/Policies/ApplicationPreviewPolicyTest.php index 38e4eef293..8e295406c2 100644 --- a/tests/Unit/Policies/ApplicationPreviewPolicyTest.php +++ b/tests/Unit/Policies/ApplicationPreviewPolicyTest.php @@ -192,36 +192,6 @@ it('denies team member from deploying application preview', function () { expect($policy->deploy($user, $preview))->toBeFalse(); }); -it('allows team admin to manage preview deployments', function () { - $user = Mockery::mock(User::class)->makePartial(); - $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true); - - $team = (object) ['id' => 1]; - $application = Mockery::mock(Application::class)->makePartial(); - $application->shouldReceive('team')->andReturn($team); - - $preview = Mockery::mock(ApplicationPreview::class)->makePartial(); - $preview->shouldReceive('getAttribute')->with('application')->andReturn($application); - - $policy = new ApplicationPreviewPolicy; - expect($policy->manageDeployments($user, $preview))->toBeTrue(); -}); - -it('denies team member from managing preview deployments', function () { - $user = Mockery::mock(User::class)->makePartial(); - $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false); - - $team = (object) ['id' => 1]; - $application = Mockery::mock(Application::class)->makePartial(); - $application->shouldReceive('team')->andReturn($team); - - $preview = Mockery::mock(ApplicationPreview::class)->makePartial(); - $preview->shouldReceive('getAttribute')->with('application')->andReturn($application); - - $policy = new ApplicationPreviewPolicy; - expect($policy->manageDeployments($user, $preview))->toBeFalse(); -}); - it('denies restoring application preview', function () { $user = Mockery::mock(User::class)->makePartial(); $preview = Mockery::mock(ApplicationPreview::class)->makePartial(); diff --git a/tests/Unit/Policies/ResourceCreatePolicyTest.php b/tests/Unit/Policies/ResourceCreatePolicyTest.php index 606535467f..eb6fc513c4 100644 --- a/tests/Unit/Policies/ResourceCreatePolicyTest.php +++ b/tests/Unit/Policies/ResourceCreatePolicyTest.php @@ -1,6 +1,5 @@ createAny($user))->toBeFalse(); }); - -it('allows admin to create a valid resource class', function () { - $user = Mockery::mock(User::class)->makePartial(); - $user->shouldReceive('isAdmin')->andReturn(true); - - $policy = new ResourceCreatePolicy; - expect($policy->create($user, Application::class))->toBeTrue(); -}); - -it('denies member from creating a valid resource class', function () { - $user = Mockery::mock(User::class)->makePartial(); - $user->shouldReceive('isAdmin')->andReturn(false); - - $policy = new ResourceCreatePolicy; - expect($policy->create($user, Application::class))->toBeFalse(); -}); - -it('denies admin from creating an invalid resource class', function () { - $user = Mockery::mock(User::class)->makePartial(); - $user->shouldReceive('isAdmin')->andReturn(true); - - $policy = new ResourceCreatePolicy; - expect($policy->create($user, 'App\Models\NonExistent'))->toBeFalse(); -}); - -it('allows admin to authorize all resource creation', function () { - $user = Mockery::mock(User::class)->makePartial(); - $user->shouldReceive('isAdmin')->andReturn(true); - - $policy = new ResourceCreatePolicy; - expect($policy->authorizeAllResourceCreation($user))->toBeTrue(); -}); - -it('denies member from authorizing all resource creation', function () { - $user = Mockery::mock(User::class)->makePartial(); - $user->shouldReceive('isAdmin')->andReturn(false); - - $policy = new ResourceCreatePolicy; - expect($policy->authorizeAllResourceCreation($user))->toBeFalse(); -}); diff --git a/tests/Unit/Policies/ServicePolicyTest.php b/tests/Unit/Policies/ServicePolicyTest.php index 166fbc6172..e9a0b4da0a 100644 --- a/tests/Unit/Policies/ServicePolicyTest.php +++ b/tests/Unit/Policies/ServicePolicyTest.php @@ -192,28 +192,6 @@ it('denies team member to manage service environment variables', function () { expect($policy->manageEnvironment($user, $service))->toBeFalse(); }); -it('allows team admin to access terminal', function () { - $user = Mockery::mock(User::class)->makePartial(); - $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true); - - $service = Mockery::mock(Service::class)->makePartial(); - $service->shouldReceive('team')->andReturn((object) ['id' => 1]); - - $policy = new ServicePolicy; - expect($policy->accessTerminal($user, $service))->toBeTrue(); -}); - -it('denies team member to access terminal', function () { - $user = Mockery::mock(User::class)->makePartial(); - $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false); - - $service = Mockery::mock(Service::class)->makePartial(); - $service->shouldReceive('team')->andReturn((object) ['id' => 1]); - - $policy = new ServicePolicy; - expect($policy->accessTerminal($user, $service))->toBeFalse(); -}); - it('denies restore for any user', function () { $user = Mockery::mock(User::class)->makePartial();