From f39fa67cf0eb9e3c82c5fcd16df2251b014659bc Mon Sep 17 00:00:00 2001
From: Aditya Tripathi <aditya@climactic.co>
Date: Mon, 14 Sep 2026 10:11:17 +0000
Subject: [PATCH] fix(notifications): add canGate/canResource authorization to
 channel buttons

Per the repo's form-authorization guideline (flagged in review), the enable/
disable and send-test buttons now pass canGate/canResource so they gate on the
policy server-side, not just the browser :disabled. The 5 channel pages pass
their $settings resource; the toggle/test Livewire methods already authorize.
---
 .../components/notification/channel-actions.blade.php     | 8 ++++++--
 resources/views/livewire/notifications/discord.blade.php  | 3 ++-
 resources/views/livewire/notifications/pushover.blade.php | 3 ++-
 resources/views/livewire/notifications/slack.blade.php    | 3 ++-
 resources/views/livewire/notifications/telegram.blade.php | 3 ++-
 resources/views/livewire/notifications/webhook.blade.php  | 3 ++-
 6 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/resources/views/components/notification/channel-actions.blade.php b/resources/views/components/notification/channel-actions.blade.php
index 37f7ee963f..b4ad3c8bda 100644
--- a/resources/views/components/notification/channel-actions.blade.php
+++ b/resources/views/components/notification/channel-actions.blade.php
@@ -4,6 +4,8 @@
     'toggleMethod',
     'testMethod' => 'sendTestNotification',
     'canUpdate' => true,
+    'canResource' => null,
+    'canGate' => 'update',
 ])
 
 <div class="flex items-center gap-2"
@@ -13,7 +15,8 @@
         toggleMethod: @js($toggleMethod),
         testMethod: @js($testMethod),
     }">
-    <x-forms.button type="button" :disabled="!$canUpdate"
+    <x-forms.button type="button" :disabled="!$canUpdate" :canGate="$canResource ? $canGate : null"
+        :canResource="$canResource"
         x-bind:class="{ 'button-highlighted': !enabled }"
         x-on:click="
             if (!enabled && !$el.closest('form').reportValidity()) return;
@@ -25,7 +28,8 @@
         ">
         <span x-text="enabled ? 'Disable' : 'Enable'">{{ $enabled ? 'Disable' : 'Enable' }}</span>
     </x-forms.button>
-    <x-forms.button type="button" :disabled="!$enabled"
+    <x-forms.button type="button" :disabled="!$enabled" :canGate="$canResource ? 'sendTest' : null"
+        :canResource="$canResource"
         x-on:click="if ($el.closest('form').reportValidity()) $wire.$call(testMethod)">
         <x-reicon name="notifications" class="size-3.5" />
         Send test
diff --git a/resources/views/livewire/notifications/discord.blade.php b/resources/views/livewire/notifications/discord.blade.php
index 9e568c8459..9e3921f514 100644
--- a/resources/views/livewire/notifications/discord.blade.php
+++ b/resources/views/livewire/notifications/discord.blade.php
@@ -11,7 +11,8 @@
                 description="Send team notifications to a Discord channel through an incoming webhook.">
                 <x-slot:actions>
                     <x-notification.channel-actions :enabled="$discordEnabled" enabledProperty="discordEnabled"
-                        toggleMethod="instantSaveDiscordEnabled" :canUpdate="auth()->user()->can('update', $settings)" />
+                        toggleMethod="instantSaveDiscordEnabled" :canUpdate="auth()->user()->can('update', $settings)"
+                        :canResource="$settings" />
                 </x-slot:actions>
 
                 <div class="grid gap-4 lg:grid-cols-2">
diff --git a/resources/views/livewire/notifications/pushover.blade.php b/resources/views/livewire/notifications/pushover.blade.php
index d617ed76cf..40661fc976 100644
--- a/resources/views/livewire/notifications/pushover.blade.php
+++ b/resources/views/livewire/notifications/pushover.blade.php
@@ -11,7 +11,8 @@
                 description="Deliver team alerts through your Pushover application.">
                 <x-slot:actions>
                     <x-notification.channel-actions :enabled="$pushoverEnabled" enabledProperty="pushoverEnabled"
-                        toggleMethod="instantSavePushoverEnabled" :canUpdate="auth()->user()->can('update', $settings)" />
+                        toggleMethod="instantSavePushoverEnabled" :canUpdate="auth()->user()->can('update', $settings)"
+                        :canResource="$settings" />
                 </x-slot:actions>
 
                 <div class="grid gap-4 lg:grid-cols-2">
diff --git a/resources/views/livewire/notifications/slack.blade.php b/resources/views/livewire/notifications/slack.blade.php
index 9b1814b69d..f3ccd8256d 100644
--- a/resources/views/livewire/notifications/slack.blade.php
+++ b/resources/views/livewire/notifications/slack.blade.php
@@ -11,7 +11,8 @@
                 description="Send team notifications to Slack through an incoming webhook.">
                 <x-slot:actions>
                     <x-notification.channel-actions :enabled="$slackEnabled" enabledProperty="slackEnabled"
-                        toggleMethod="instantSaveSlackEnabled" :canUpdate="auth()->user()->can('update', $settings)" />
+                        toggleMethod="instantSaveSlackEnabled" :canUpdate="auth()->user()->can('update', $settings)"
+                        :canResource="$settings" />
                 </x-slot:actions>
 
                 <div class="grid gap-4 lg:grid-cols-2">
diff --git a/resources/views/livewire/notifications/telegram.blade.php b/resources/views/livewire/notifications/telegram.blade.php
index 8686d40a3b..8ab110e62e 100644
--- a/resources/views/livewire/notifications/telegram.blade.php
+++ b/resources/views/livewire/notifications/telegram.blade.php
@@ -11,7 +11,8 @@
                 description="Deliver team notifications through a Telegram bot and chat.">
                 <x-slot:actions>
                     <x-notification.channel-actions :enabled="$telegramEnabled" enabledProperty="telegramEnabled"
-                        toggleMethod="instantSaveTelegramEnabled" :canUpdate="auth()->user()->can('update', $settings)" />
+                        toggleMethod="instantSaveTelegramEnabled" :canUpdate="auth()->user()->can('update', $settings)"
+                        :canResource="$settings" />
                 </x-slot:actions>
 
                 <div class="grid gap-4 lg:grid-cols-2">
diff --git a/resources/views/livewire/notifications/webhook.blade.php b/resources/views/livewire/notifications/webhook.blade.php
index 81eb8c2025..fde9054b8d 100644
--- a/resources/views/livewire/notifications/webhook.blade.php
+++ b/resources/views/livewire/notifications/webhook.blade.php
@@ -11,7 +11,8 @@
                 description="Send JSON event payloads to your own HTTP endpoint.">
                 <x-slot:actions>
                     <x-notification.channel-actions :enabled="$webhookEnabled" enabledProperty="webhookEnabled"
-                        toggleMethod="instantSaveWebhookEnabled" :canUpdate="auth()->user()->can('update', $settings)" />
+                        toggleMethod="instantSaveWebhookEnabled" :canUpdate="auth()->user()->can('update', $settings)"
+                        :canResource="$settings" />
                 </x-slot:actions>
 
                 <div class="grid gap-4 lg:grid-cols-2">