fix(onboarding): enforce resource authorization (#11920)

app/Livewire/Boarding/Index.php

@@ -112,6 +112,7 @@ class Index extends Component
         if ($this->selectedServerType === 'localhost' && $this->selectedExistingServer === 0) {
             $this->createdServer = Server::find(0);
             if ($this->createdServer) {
+                $this->authorize('update', $this->createdServer);
                 $this->serverPublicKey = $this->createdServer->privateKey->getPublicKey();
             }
         }
@@ -196,6 +197,7 @@ class Index extends Component
             if (! $this->createdServer) {
                 return $this->dispatch('error', 'Localhost server is not found. Something went wrong during installation. Please try to reinstall or contact support.');
             }
+            $this->authorize('update', $this->createdServer);
             $this->serverPublicKey = $this->createdServer->privateKey->getPublicKey();
 
             return $this->validateServer('localhost');
@@ -248,7 +250,8 @@ class Index extends Component
 
             return;
         }
-        $this->createdPrivateKey = PrivateKey::where('team_id', currentTeam()->id)->where('id', $this->selectedExistingPrivateKey)->first();
+        $this->createdPrivateKey = PrivateKey::ownedByCurrentTeam()->findOrFail($this->selectedExistingPrivateKey);
+        $this->authorize('view', $this->createdPrivateKey);
         $this->privateKey = $this->createdPrivateKey->private_key;
         $this->currentState = 'create-server';
     }
@@ -274,6 +277,8 @@ class Index extends Component
 
     public function savePrivateKey()
     {
+        $this->authorize('create', PrivateKey::class);
+
         $this->validate([
             'privateKeyName' => 'required|string|max:255',
             'privateKeyDescription' => 'nullable|string|max:255',
@@ -281,7 +286,6 @@ class Index extends Component
         ]);
 
         try {
-            $this->authorize('create', PrivateKey::class);
             $privateKey = PrivateKey::createAndStore([
                 'name' => $this->privateKeyName,
                 'description' => $this->privateKeyDescription,
@@ -298,13 +302,9 @@ class Index extends Component
 
     public function saveServer()
     {
-        $this->validate();
+        $this->authorize('create', Server::class);
 
-        try {
-            $this->authorize('create', Server::class);
-        } catch (\Throwable $e) {
-            return handleError($e, $this);
-        }
+        $this->validate();
 
         $this->privateKey = formatPrivateKey($this->privateKey);
         $foundServer = Server::whereIp($this->remoteServerHost)->first();
@@ -315,6 +315,10 @@ class Index extends Component
 
             return $this->dispatch('error', 'A server with this IP/Domain is already in use by another team.');
         }
+        $privateKeyId = $this->createdPrivateKey?->id ?? $this->selectedExistingPrivateKey;
+        $this->createdPrivateKey = PrivateKey::ownedByCurrentTeam()->findOrFail($privateKeyId);
+        $this->authorize('view', $this->createdPrivateKey);
+
         $this->createdServer = Server::create([
             'name' => $this->remoteServerName,
             'ip' => $this->remoteServerHost,
@@ -333,11 +337,14 @@ class Index extends Component
 
     public function installServer()
     {
+        $this->authorizeCreatedServer();
         $this->dispatch('init', true);
     }
 
     public function validateServer()
     {
+        $this->authorizeCreatedServer();
+
         try {
             $this->disableSshMux();
 
@@ -385,6 +392,8 @@ class Index extends Component
 
     public function handlePrerequisitesInstalled()
     {
+        $this->authorizeCreatedServer();
+
         try {
             // Revalidate prerequisites after installation completes
             $validationResult = $this->createdServer->validatePrerequisites();
@@ -435,6 +444,8 @@ class Index extends Component
 
     public function selectProxy(?string $proxyType = null)
     {
+        $this->authorizeCreatedServer();
+
         if (! $proxyType) {
             return $this->getProjects();
         }
@@ -466,6 +477,8 @@ class Index extends Component
 
     public function createNewProject()
     {
+        $this->authorize('create', Project::class);
+
         $this->createdProject = Project::create([
             'name' => 'My first project',
             'team_id' => currentTeam()->id,
@@ -476,6 +489,10 @@ class Index extends Component
 
     public function showNewResource()
     {
+        $this->authorizeCreatedServer();
+        $this->createdProject = Project::ownedByCurrentTeam()->findOrFail($this->createdProject?->id);
+        $this->authorize('view', $this->createdProject);
+
         $this->skipBoarding();
 
         return redirect()->route(
@@ -490,6 +507,8 @@ class Index extends Component
 
     public function saveAndValidateServer()
     {
+        $this->authorizeCreatedServer();
+
         $this->validate(array_intersect_key($this->rules(), array_flip([
             'remoteServerPort',
             'remoteServerUser',
@@ -516,6 +535,12 @@ class Index extends Component
         $configRepository->disableSshMux();
     }
 
+    private function authorizeCreatedServer(): void
+    {
+        $this->createdServer = Server::findOrFail($this->createdServer?->id);
+        $this->authorize('update', $this->createdServer);
+    }
+
     public function render()
     {
         return view('livewire.boarding.index')->layout('layouts.boarding');

tests/Feature/BoardingAuthorizationTest.php

@@ -0,0 +1,184 @@
+<?php
+
+use App\Livewire\Boarding\Index;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->rootTeam = Team::factory()->create(['id' => 0, 'show_boarding' => true]);
+    $this->localhostKey = PrivateKey::withoutEvents(
+        fn () => PrivateKey::factory()->create(['id' => 0, 'uuid' => new_public_id(), 'team_id' => 0])
+    );
+    $this->localhost = Server::factory()->create([
+        'id' => 0,
+        'team_id' => 0,
+        'private_key_id' => 0,
+        'proxy' => ['type' => 'traefik'],
+    ]);
+
+    $this->rootOwner = User::factory()->create();
+    $this->rootOwner->teams()->attach($this->rootTeam, ['role' => 'owner']);
+
+    $this->rootAdmin = User::factory()->create();
+    $this->rootAdmin->teams()->attach($this->rootTeam, ['role' => 'admin']);
+
+    $this->rootMember = User::factory()->create();
+    $this->rootMember->teams()->attach($this->rootTeam, ['role' => 'member']);
+
+    $this->otherTeam = Team::factory()->create(['show_boarding' => true]);
+    $this->otherOwner = User::factory()->create();
+    $this->otherOwner->teams()->attach($this->otherTeam, ['role' => 'owner']);
+    $this->otherKey = PrivateKey::withoutEvents(
+        fn () => PrivateKey::factory()->create(['uuid' => new_public_id(), 'team_id' => $this->otherTeam->id])
+    );
+    $this->otherServer = Server::factory()->create([
+        'team_id' => $this->otherTeam->id,
+        'private_key_id' => $this->otherKey->id,
+    ]);
+});
+
+function actAsBoardingUser(User $user, Team $team): void
+{
+    test()->actingAs($user);
+    session(['currentTeam' => $team]);
+}
+
+test('root team owners and admins can select the localhost server during onboarding', function (User $user) {
+    actAsBoardingUser($user, $this->rootTeam);
+
+    Livewire::test(Index::class, [
+        'selectedServerType' => 'localhost',
+        'selectedExistingServer' => 0,
+    ])
+        ->assertOk()
+        ->assertSet('createdServer.id', 0);
+})->with([
+    'owner' => fn () => $this->rootOwner,
+    'admin' => fn () => $this->rootAdmin,
+]);
+
+test('root team owners and admins can update the localhost server during onboarding', function (User $user) {
+    actAsBoardingUser($user, $this->rootTeam);
+
+    Livewire::test(Index::class)
+        ->set('createdServer', $this->localhost)
+        ->call('selectProxy', 'none')
+        ->assertOk();
+
+    expect($this->localhost->fresh()->proxy->type)->toBe('none');
+})->with([
+    'owner' => fn () => $this->rootOwner,
+    'admin' => fn () => $this->rootAdmin,
+]);
+
+test('a root team member cannot read the localhost server through onboarding query parameters', function () {
+    actAsBoardingUser($this->rootMember, $this->rootTeam);
+
+    Livewire::test(Index::class, [
+        'selectedServerType' => 'localhost',
+        'selectedExistingServer' => 0,
+    ])->assertForbidden();
+});
+
+test('an owner from another team cannot read the localhost server through onboarding query parameters', function () {
+    actAsBoardingUser($this->otherOwner, $this->otherTeam);
+
+    Livewire::test(Index::class, [
+        'selectedServerType' => 'localhost',
+        'selectedExistingServer' => 0,
+    ])->assertForbidden();
+});
+
+test('unauthorized users cannot invoke localhost onboarding actions directly', function (string $role, string $method) {
+    $user = $role === 'member' ? $this->rootMember : $this->otherOwner;
+    $team = $role === 'member' ? $this->rootTeam : $this->otherTeam;
+    actAsBoardingUser($user, $team);
+
+    $before = $this->localhost->fresh()->getAttributes();
+
+    $component = Livewire::test(Index::class)
+        ->set('createdServer', $this->localhost);
+
+    if ($method === 'selectProxy') {
+        $component->call($method, 'none')->assertForbidden();
+    } elseif ($method === 'setServerType') {
+        $component->call($method, 'localhost')->assertForbidden();
+    } else {
+        $component->set('remoteServerPort', 2222)
+            ->set('remoteServerUser', 'attacker')
+            ->call($method)
+            ->assertForbidden();
+    }
+
+    expect($this->localhost->fresh()->getAttributes())->toBe($before);
+})->with([
+    'root member proxy mutation' => ['member', 'selectProxy'],
+    'cross-team proxy mutation' => ['other', 'selectProxy'],
+    'root member validation' => ['member', 'validateServer'],
+    'cross-team prerequisite callback' => ['other', 'handlePrerequisitesInstalled'],
+    'root member install dispatch' => ['member', 'installServer'],
+    'cross-team SSH mutation' => ['other', 'saveAndValidateServer'],
+    'cross-team localhost selection' => ['other', 'setServerType'],
+]);
+
+test('client supplied server and private key identifiers from another team are not loaded', function () {
+    actAsBoardingUser($this->rootOwner, $this->rootTeam);
+
+    Livewire::test(Index::class, [
+        'selectedServerType' => 'remote',
+        'selectedExistingServer' => $this->otherServer->id,
+        'selectedExistingPrivateKey' => $this->otherKey->id,
+    ])
+        ->assertSet('createdServer', null)
+        ->assertSet('createdPrivateKey', null);
+});
+
+test('a client supplied private key identifier from another team is rejected by the action', function () {
+    actAsBoardingUser($this->rootOwner, $this->rootTeam);
+
+    Livewire::test(Index::class)
+        ->set('selectedExistingPrivateKey', $this->otherKey->id)
+        ->call('selectExistingPrivateKey');
+})->throws(ModelNotFoundException::class);
+
+test('a hydrated server model from another team is forbidden before use', function () {
+    actAsBoardingUser($this->rootOwner, $this->rootTeam);
+
+    Livewire::test(Index::class)
+        ->set('createdServer', $this->otherServer)
+        ->call('selectProxy', 'none')
+        ->assertForbidden();
+});
+
+test('a hydrated private key model from another team is rejected before use', function () {
+    actAsBoardingUser($this->rootOwner, $this->rootTeam);
+
+    Livewire::test(Index::class)
+        ->set('createdPrivateKey', $this->otherKey)
+        ->set('privateKey', $this->otherKey->private_key)
+        ->set('remoteServerName', 'Injected key server')
+        ->set('remoteServerHost', '192.0.2.50')
+        ->set('remoteServerPort', 22)
+        ->set('remoteServerUser', 'root')
+        ->call('saveServer');
+})->throws(ModelNotFoundException::class);
+
+test('members cannot directly create projects through onboarding', function () {
+    actAsBoardingUser($this->rootMember, $this->rootTeam);
+
+    Livewire::test(Index::class)
+        ->call('createNewProject')
+        ->assertForbidden();
+
+    expect($this->rootTeam->projects()->count())->toBe(0);
+});

tests/Feature/CrossTeamIdorServerProjectTest.php

@@ -8,6 +8,7 @@ use App\Livewire\Project\DeleteProject;
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
 use App\Models\Environment;
+use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
@@ -25,7 +26,14 @@ beforeEach(function () {
     $this->teamA = Team::factory()->create();
     $this->userA->teams()->attach($this->teamA, ['role' => 'owner']);
 
-    $this->serverA = Server::factory()->create(['team_id' => $this->teamA->id]);
+    $keyA = PrivateKey::withoutEvents(fn () => PrivateKey::factory()->create([
+        'uuid' => new_public_id(),
+        'team_id' => $this->teamA->id,
+    ]));
+    $this->serverA = Server::factory()->create([
+        'team_id' => $this->teamA->id,
+        'private_key_id' => $keyA->id,
+    ]);
     $this->projectA = Project::factory()->create(['team_id' => $this->teamA->id]);
     $this->environmentA = Environment::factory()->create(['project_id' => $this->projectA->id]);
 
@@ -34,7 +42,14 @@ beforeEach(function () {
     $this->teamB = Team::factory()->create();
     $this->userB->teams()->attach($this->teamB, ['role' => 'owner']);
 
-    $this->serverB = Server::factory()->create(['team_id' => $this->teamB->id]);
+    $keyB = PrivateKey::withoutEvents(fn () => PrivateKey::factory()->create([
+        'uuid' => new_public_id(),
+        'team_id' => $this->teamB->id,
+    ]));
+    $this->serverB = Server::factory()->create([
+        'team_id' => $this->teamB->id,
+        'private_key_id' => $keyB->id,
+    ]);
     $this->projectB = Project::factory()->create(['team_id' => $this->teamB->id]);
     $this->environmentB = Environment::factory()->create(['project_id' => $this->projectB->id]);
 
@@ -87,6 +102,7 @@ describe('Boarding Project IDOR', function () {
 
     test('boarding selectExistingProject can load own team project', function () {
         $component = Livewire::test(BoardingIndex::class)
+            ->set('createdServer', $this->serverA)
             ->set('selectedProject', $this->projectA->id)
             ->call('selectExistingProject');