fix(auth): enforce dashboard authorization and improve team deletion

Add authorization gates to Project and Server creation buttons in the dashboard to prevent non-admin users from accessing resource creation. Improve team deletion to clear cache before deletion and automatically switch to the user's next available team.

- Hide create buttons from non-admin users in dashboard
- Clear cache before team deletion to prevent stale session resolution
- Switch user session to next available team when current team is deleted
- Handle refreshSession when user has no remaining teams
- Add tests for dashboard authorization enforcement and team deletion flow
This commit is contained in:
Andras Bacsai
2026-02-25 14:47:35 +01:00
parent 86b05b902a
commit fcc58ca08a
5 changed files with 234 additions and 53 deletions
+8
View File
@@ -186,6 +186,14 @@ function refreshSession(?Team $team = null): void
$team = User::find(Auth::id())->teams->first();
}
}
if (! $team) {
session()->forget('currentTeam');
Cache::forget('team:'.Auth::id());
return;
}
// Clear old cache key format for backwards compatibility
Cache::forget('team:'.Auth::id());
// Use new cache key format that includes team ID