mirror of
https://github.com/coollabsio/coolify.git
synced 2026-11-06 13:10:37 -04:00
Andras Bacsai
6f1905b7b0
- Require write access on the target environment to clone or move a resource - Check read access on shared variables before a reference is added or resolved - Limit team credentials, git sources, and imports of other backups to team-wide writers - Require the delete level for backup, volume, storage, and task deletes - Require create access for previews, new projects, and git sources - Use the token team for the access scope, and check team-wide access on Livewire updates - Require instance admin to toggle the API and MCP server - Hide server pickers and broadcast details from members without access
31 lines
901 B
PHP
31 lines
901 B
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use App\Services\Access\AccessResolver;
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
/**
|
|
* Blocks team-level pages (servers, keys, sources, notifications, team settings, ...) for members
|
|
* whose grants cover only some projects, environments, or resources of the session team.
|
|
*/
|
|
class EnsureTeamWideAccess
|
|
{
|
|
/**
|
|
* @param Closure(Request): (Response) $next
|
|
*/
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
$user = $request->user();
|
|
$teamId = data_get($user?->currentAccessToken(), 'team_id') ?? $user?->currentTeam()?->id;
|
|
|
|
if ($teamId !== null && ! app(AccessResolver::class)->coversWholeTeam($user, $teamId)) {
|
|
abort(403, 'Your access in this team is limited to some projects.');
|
|
}
|
|
|
|
return $next($request);
|
|
}
|
|
}
|