5 Commits

Include renames

Author	SHA1	Message	Date
Andras Bacsai	18c5cf506b	feat(api-tokens): edit a token in a modal that opens without a request	2026-10-30 14:27:58 +01:00
Andras BacsaiandClaude Opus 5.5	c467354d34	test: use the delete ability in delete permission tests ... next requires the delete ability for delete endpoints and checks member token access in EnsureTokenBelongsToCurrentTeamMember. Update the tests from main to match. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-26 12:55:24 +01:00
Andras Bacsai	ecce3cb9b4	refactor(api): check token abilities through the token in ApiAbility (#12193)	2026-10-18 23:16:38 +02:00
Andras Bacsai	2880a73684	fix(api): align token permission handling	2026-09-24 12:25:46 +02:00
Andras Bacsai	66dc1515d4	fix(security): prevent snapshot replay in API token permission checks ... Never trust Livewire component properties for authorization decisions, as snapshots can be replayed from another user's session. Re-evaluate all permission checks fresh using auth()->user()->can() against current policies to ensure the authenticated user is being authorized, not a replayed copy. - Replace cached canUse* booleans with fresh policy evaluation - Add comprehensive security tests for token creation permissions - Update API authorization tests to verify middleware blocking behavior	2026-02-27 22:58:44 +01:00