Andras Bacsai 105584da06 fix(auth): check the resource team for cloud tokens and cloud-init scripts ...

The policies checked the admin role in the session team. A user who was
demoted in the owning team could still edit its cloud tokens and
cloud-init scripts after switching to a team they administer. View,
update and delete now need admin of the resource's team, as for
integration tokens.

2026-10-06 10:29:04 +02:00

..

ApiTokenPolicy.php

fix(api-tokens): scope token access to current team (#11396)

2026-08-19 11:27:23 +02:00

ApplicationPolicy.php

refactor(policies): add uploadBackup ability and enforce it on backup upload endpoint

2026-04-20 11:51:35 +02:00

ApplicationPreviewPolicy.php

fix(auth): enforce authorization checks across API and Livewire components

2026-02-25 14:20:29 +01:00

ApplicationSettingPolicy.php

fix(auth): enforce authorization checks across API and Livewire components

2026-02-25 14:20:29 +01:00

CloudInitScriptPolicy.php

fix(auth): check the resource team for cloud tokens and cloud-init scripts

2026-10-06 10:29:04 +02:00

CloudProviderTokenPolicy.php

fix(auth): check the resource team for cloud tokens and cloud-init scripts

2026-10-06 10:29:04 +02:00

DatabasePolicy.php

refactor(policies): add uploadBackup ability and enforce it on backup upload endpoint

2026-04-20 11:51:35 +02:00

EnvironmentPolicy.php

fix(auth): enforce authorization checks across API and Livewire components

2026-02-25 14:20:29 +01:00

EnvironmentVariablePolicy.php

fix(auth): enforce authorization checks across API and Livewire components

2026-02-25 14:20:29 +01:00

GithubAppPolicy.php

fix(sources): prevent 500 when deleting GitLab/GitHub apps

2026-08-01 18:34:38 +02:00

GitlabAppPolicy.php

fix(sources): prevent 500 when deleting GitLab/GitHub apps

2026-08-01 18:34:38 +02:00

InstanceSettingsPolicy.php

feat: add validation methods for S3 bucket names, paths, and server paths; update import logic to prevent command injection

2025-11-25 16:40:35 +01:00

IntegrationTokenPolicy.php

fix(auth): use the resource team in database import, SQLite, and tokens

2026-10-05 21:22:33 +02:00

NotificationPolicy.php

fix(auth): enforce authorization checks across API and Livewire components

2026-02-25 14:20:29 +01:00

PrivateKeyPolicy.php

Changes auto-committed by Conductor

2025-10-17 23:04:24 +02:00

ProjectPolicy.php

fix(auth): enforce authorization checks across API and Livewire components

2026-02-25 14:20:29 +01:00

ResourceCreatePolicy.php

feat(auth): authorize sqlite databases with the database policy

2026-09-24 19:03:42 +02:00

S3StoragePolicy.php

refactor(auth): enforce team member authorization across app

2026-02-27 11:41:01 +01:00

ScheduledTaskPolicy.php

fix(security): enforce team-scoped authorization for scheduled tasks (#11239)

2026-08-18 16:01:17 +02:00

ServerPolicy.php

fix(auth): restrict Sentinel access and register S3 policy

2026-06-15 12:31:30 +02:00

ServiceApplicationPolicy.php

Merge remote-tracking branch 'origin/next' into 9249-pr-investigation

2026-07-07 14:45:48 +02:00

ServiceDatabasePolicy.php

feat(api): add service database management endpoints

2026-07-15 12:29:58 +02:00

ServicePolicy.php

refactor(policies): add uploadBackup ability and enforce it on backup upload endpoint

2026-04-20 11:51:35 +02:00

SharedEnvironmentVariablePolicy.php

fix(auth): enforce authorization checks across API and Livewire components

2026-02-25 14:20:29 +01:00

StandaloneDockerPolicy.php

fix(auth): enforce authorization checks across API and Livewire components

2026-02-25 14:20:29 +01:00

SwarmDockerPolicy.php

fix(auth): enforce authorization checks across API and Livewire components

2026-02-25 14:20:29 +01:00

TagPolicy.php

fix(api): secure proxy config, clone volumes, and rollback tags (#11003)

2026-07-22 14:52:11 +02:00

TeamPolicy.php

fix(teams): restrict deletion to owners and backfill team ownership

2026-08-20 09:32:32 +02:00