- Check the root team grants for the instance database, which has no environment.
- Return the root team as the team of the instance database.
- Hide the instance database from the API and MCP.
- Fix the links in backup notifications of the instance and service databases.
Closes#12503Closes#12505
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Use the limits of the API token in more permission checks.
- Show a clearer message when a token limit blocks a change.
- Describe API tokens with limits in SECURITY.md.
Introduce a dedicated `uploadBackup` ability on Application, Database,
Service, and ServiceDatabase policies (admin/owner only) and call
`$this->authorize('uploadBackup', $resource)` in `UploadController::upload`
so the backup-upload endpoint goes through the same policy layer as the
rest of the authorization refactor. Adds Pest coverage for each policy
variant plus HTTP-level checks.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Instance-level databases like coolify-db (with id = 0) should always
be assigned to the root team (id = 0) rather than attempting to resolve
their team from the database object itself.
Andras BacsaiandClaude Opus 5.5