fix(notifications): add canGate/canResource authorization to channel buttons

Per the repo's form-authorization guideline (flagged in review), the enable/
disable and send-test buttons now pass canGate/canResource so they gate on the
policy server-side, not just the browser :disabled. The 5 channel pages pass
their $settings resource; the toggle/test Livewire methods already authorize.

resources/views/components/notification/channel-actions.blade.php

@@ -4,6 +4,8 @@
     'toggleMethod',
     'testMethod' => 'sendTestNotification',
     'canUpdate' => true,
+    'canResource' => null,
+    'canGate' => 'update',
 ])
 
 <div class="flex items-center gap-2"
@@ -13,7 +15,8 @@
         toggleMethod: @js($toggleMethod),
         testMethod: @js($testMethod),
     }">
-    <x-forms.button type="button" :disabled="!$canUpdate"
+    <x-forms.button type="button" :disabled="!$canUpdate" :canGate="$canResource ? $canGate : null"
+        :canResource="$canResource"
         x-bind:class="{ 'button-highlighted': !enabled }"
         x-on:click="
             if (!enabled && !$el.closest('form').reportValidity()) return;
@@ -25,7 +28,8 @@
         ">
         <span x-text="enabled ? 'Disable' : 'Enable'">{{ $enabled ? 'Disable' : 'Enable' }}</span>
     </x-forms.button>
-    <x-forms.button type="button" :disabled="!$enabled"
+    <x-forms.button type="button" :disabled="!$enabled" :canGate="$canResource ? 'sendTest' : null"
+        :canResource="$canResource"
         x-on:click="if ($el.closest('form').reportValidity()) $wire.$call(testMethod)">
         <x-reicon name="notifications" class="size-3.5" />
         Send test

resources/views/livewire/notifications/discord.blade.php

@@ -11,7 +11,8 @@
                 description="Send team notifications to a Discord channel through an incoming webhook.">
                 <x-slot:actions>
                     <x-notification.channel-actions :enabled="$discordEnabled" enabledProperty="discordEnabled"
-                        toggleMethod="instantSaveDiscordEnabled" :canUpdate="auth()->user()->can('update', $settings)" />
+                        toggleMethod="instantSaveDiscordEnabled" :canUpdate="auth()->user()->can('update', $settings)"
+                        :canResource="$settings" />
                 </x-slot:actions>
 
                 <div class="grid gap-4 lg:grid-cols-2">

resources/views/livewire/notifications/pushover.blade.php

@@ -11,7 +11,8 @@
                 description="Deliver team alerts through your Pushover application.">
                 <x-slot:actions>
                     <x-notification.channel-actions :enabled="$pushoverEnabled" enabledProperty="pushoverEnabled"
-                        toggleMethod="instantSavePushoverEnabled" :canUpdate="auth()->user()->can('update', $settings)" />
+                        toggleMethod="instantSavePushoverEnabled" :canUpdate="auth()->user()->can('update', $settings)"
+                        :canResource="$settings" />
                 </x-slot:actions>
 
                 <div class="grid gap-4 lg:grid-cols-2">

resources/views/livewire/notifications/slack.blade.php

@@ -11,7 +11,8 @@
                 description="Send team notifications to Slack through an incoming webhook.">
                 <x-slot:actions>
                     <x-notification.channel-actions :enabled="$slackEnabled" enabledProperty="slackEnabled"
-                        toggleMethod="instantSaveSlackEnabled" :canUpdate="auth()->user()->can('update', $settings)" />
+                        toggleMethod="instantSaveSlackEnabled" :canUpdate="auth()->user()->can('update', $settings)"
+                        :canResource="$settings" />
                 </x-slot:actions>
 
                 <div class="grid gap-4 lg:grid-cols-2">

resources/views/livewire/notifications/telegram.blade.php

@@ -11,7 +11,8 @@
                 description="Deliver team notifications through a Telegram bot and chat.">
                 <x-slot:actions>
                     <x-notification.channel-actions :enabled="$telegramEnabled" enabledProperty="telegramEnabled"
-                        toggleMethod="instantSaveTelegramEnabled" :canUpdate="auth()->user()->can('update', $settings)" />
+                        toggleMethod="instantSaveTelegramEnabled" :canUpdate="auth()->user()->can('update', $settings)"
+                        :canResource="$settings" />
                 </x-slot:actions>
 
                 <div class="grid gap-4 lg:grid-cols-2">

resources/views/livewire/notifications/webhook.blade.php

@@ -11,7 +11,8 @@
                 description="Send JSON event payloads to your own HTTP endpoint.">
                 <x-slot:actions>
                     <x-notification.channel-actions :enabled="$webhookEnabled" enabledProperty="webhookEnabled"
-                        toggleMethod="instantSaveWebhookEnabled" :canUpdate="auth()->user()->can('update', $settings)" />
+                        toggleMethod="instantSaveWebhookEnabled" :canUpdate="auth()->user()->can('update', $settings)"
+                        :canResource="$settings" />
                 </x-slot:actions>
 
                 <div class="grid gap-4 lg:grid-cols-2">