feat(auth): implement authorization for Docker and server management

- Added authorization checks in Livewire components related to Docker and server management to ensure only authorized users can create, update, and manage Docker instances and server settings.
- Introduced new policies for StandaloneDocker and SwarmDocker to define access control rules based on user roles and team associations.
- Updated AuthServiceProvider to register the new policies, enhancing security and access control for Docker functionalities and server management operations.

app/Livewire/Destination/New/Docker.php

@@ -5,6 +5,7 @@
 use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\SwarmDocker;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
@@ -12,6 +13,8 @@
 
 class Docker extends Component
 {
+    use AuthorizesRequests;
+
     #[Locked]
     public $servers;
 
@@ -67,6 +70,7 @@ public function generateName()
     public function submit()
     {
         try {
+            $this->authorize('create', StandaloneDocker::class);
             $this->validate();
             if ($this->isSwarm) {
                 $found = $this->selectedServer->swarmDockers()->where('network', $this->network)->first();

app/Livewire/Server/CaCertificate/Show.php

@@ -6,12 +6,15 @@
 use App\Jobs\RegenerateSslCertJob;
 use App\Models\Server;
 use App\Models\SslCertificate;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Carbon;
 use Livewire\Attributes\Locked;
 use Livewire\Component;
 
 class Show extends Component
 {
+    use AuthorizesRequests;
+
     #[Locked]
     public Server $server;
 
@@ -52,6 +55,7 @@ public function toggleCertificate()
     public function saveCaCertificate()
     {
         try {
+            $this->authorize('manageCaCertificate', $this->server);
             if (! $this->certificateContent) {
                 throw new \Exception('Certificate content cannot be empty.');
             }
@@ -82,6 +86,7 @@ public function saveCaCertificate()
     public function regenerateCaCertificate()
     {
         try {
+            $this->authorize('manageCaCertificate', $this->server);
             SslHelper::generateSslCertificate(
                 commonName: 'Coolify CA Certificate',
                 serverId: $this->server->id,

app/Livewire/Server/Destinations.php

@@ -5,11 +5,14 @@
 use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\SwarmDocker;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
 
 class Destinations extends Component
 {
+    use AuthorizesRequests;
+
     public Server $server;
 
     public Collection $networks;
@@ -33,6 +36,7 @@ private function createNetworkAndAttachToProxy()
     public function add($name)
     {
         if ($this->server->isSwarm()) {
+            $this->authorize('create', SwarmDocker::class);
             $found = $this->server->swarmDockers()->where('network', $name)->first();
             if ($found) {
                 $this->dispatch('error', 'Network already added to this server.');
@@ -46,6 +50,7 @@ public function add($name)
                 ]);
             }
         } else {
+            $this->authorize('create', StandaloneDocker::class);
             $found = $this->server->standaloneDockers()->where('network', $name)->first();
             if ($found) {
                 $this->dispatch('error', 'Network already added to this server.');

app/Livewire/Server/Navbar.php

@@ -8,10 +8,13 @@
 use App\Jobs\RestartProxyJob;
 use App\Models\Server;
 use App\Services\ProxyDashboardCacheService;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Navbar extends Component
 {
+    use AuthorizesRequests;
+
     public Server $server;
 
     public bool $isChecking = false;
@@ -57,6 +60,7 @@ public function loadProxyConfiguration()
     public function restart()
     {
         try {
+            $this->authorize('manageProxy', $this->server);
             RestartProxyJob::dispatch($this->server);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -66,6 +70,7 @@ public function restart()
     public function checkProxy()
     {
         try {
+            $this->authorize('manageProxy', $this->server);
             CheckProxy::run($this->server, true);
             $this->dispatch('startProxy')->self();
         } catch (\Throwable $e) {
@@ -76,6 +81,7 @@ public function checkProxy()
     public function startProxy()
     {
         try {
+            $this->authorize('manageProxy', $this->server);
             $activity = StartProxy::run($this->server, force: true);
             $this->dispatch('activityMonitor', $activity->id);
         } catch (\Throwable $e) {
@@ -86,6 +92,7 @@ public function startProxy()
     public function stop(bool $forceStop = true)
     {
         try {
+            $this->authorize('manageProxy', $this->server);
             StopProxy::dispatch($this->server, $forceStop);
         } catch (\Throwable $e) {
             return handleError($e, $this);

app/Livewire/Server/Proxy/NewDynamicConfiguration.php

@@ -4,11 +4,14 @@
 
 use App\Enums\ProxyTypes;
 use App\Models\Server;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 use Symfony\Component\Yaml\Yaml;
 
 class NewDynamicConfiguration extends Component
 {
+    use AuthorizesRequests;
+
     public string $fileName = '';
 
     public string $value = '';
@@ -23,6 +26,7 @@ class NewDynamicConfiguration extends Component
 
     public function mount()
     {
+        $this->server = Server::ownedByCurrentTeam()->whereId($this->server_id)->first();
         $this->parameters = get_route_parameters();
         if ($this->fileName !== '') {
             $this->fileName = str_replace('|', '.', $this->fileName);
@@ -32,6 +36,7 @@ public function mount()
     public function addDynamicConfiguration()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->validate([
                 'fileName' => 'required',
                 'value' => 'required',
@@ -39,9 +44,7 @@ public function addDynamicConfiguration()
             if (data_get($this->parameters, 'server_uuid')) {
                 $this->server = Server::ownedByCurrentTeam()->whereUuid(data_get($this->parameters, 'server_uuid'))->first();
             }
-            if (! is_null($this->server_id)) {
-                $this->server = Server::ownedByCurrentTeam()->whereId($this->server_id)->first();
-            }
+
             if (is_null($this->server)) {
                 return redirect()->route('server.index');
             }

app/Livewire/Server/Security/Patches.php

@@ -7,10 +7,13 @@
 use App\Events\ServerPackageUpdated;
 use App\Models\Server;
 use App\Notifications\Server\ServerPatchCheck;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Patches extends Component
 {
+    use AuthorizesRequests;
+
     public array $parameters;
 
     public Server $server;
@@ -36,11 +39,9 @@ public function getListeners()
 
     public function mount()
     {
-        if (! auth()->user()->isAdmin()) {
-            abort(403);
-        }
         $this->parameters = get_route_parameters();
         $this->server = Server::ownedByCurrentTeam()->whereUuid($this->parameters['server_uuid'])->firstOrFail();
+        $this->authorize('viewSecurity', $this->server);
     }
 
     public function checkForUpdatesDispatch()

app/Livewire/Server/Show.php

@@ -152,6 +152,7 @@ public function syncData(bool $toModel = false)
         if ($toModel) {
             $this->validate();
 
+            $this->authorize('update', $this->server);
             if (Server::where('team_id', currentTeam()->id)
                 ->where('ip', $this->ip)
                 ->where('id', '!=', $this->server->id)
@@ -160,8 +161,6 @@ public function syncData(bool $toModel = false)
                 throw new \Exception('This IP/Domain is already in use by another server in your team.');
             }
 
-            $this->authorize('update', $this->server);
-
             $this->server->name = $this->name;
             $this->server->description = $this->description;
             $this->server->ip = $this->ip;
@@ -253,38 +252,57 @@ public function checkLocalhostConnection()
 
     public function restartSentinel()
     {
-        $this->server->restartSentinel();
-        $this->dispatch('success', 'Sentinel restarted.');
+        try {
+            $this->authorize('manageSentinel', $this->server);
+            $this->server->restartSentinel();
+            $this->dispatch('success', 'Sentinel restarted.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+
     }
 
     public function updatedIsSentinelDebugEnabled($value)
     {
-        $this->submit();
-        $this->restartSentinel();
+        try {
+            $this->submit();
+            $this->restartSentinel();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function updatedIsMetricsEnabled($value)
     {
-        $this->submit();
-        $this->restartSentinel();
+        try {
+            $this->submit();
+            $this->restartSentinel();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function updatedIsSentinelEnabled($value)
     {
-        if ($value === true) {
-            StartSentinel::run($this->server, true);
-        } else {
-            $this->isMetricsEnabled = false;
-            $this->isSentinelDebugEnabled = false;
-            StopSentinel::dispatch($this->server);
+        try {
+            $this->authorize('manageSentinel', $this->server);
+            if ($value === true) {
+                StartSentinel::run($this->server, true);
+            } else {
+                $this->isMetricsEnabled = false;
+                $this->isSentinelDebugEnabled = false;
+                StopSentinel::dispatch($this->server);
+            }
+            $this->submit();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-        $this->submit();
-
     }
 
     public function regenerateSentinelToken()
     {
         try {
+            $this->authorize('manageSentinel', $this->server);
             $this->server->settings->generateSentinelToken();
             $this->dispatch('success', 'Token regenerated & Sentinel restarted.');
         } catch (\Throwable $e) {
@@ -294,7 +312,11 @@ public function regenerateSentinelToken()
 
     public function instantSave()
     {
-        $this->submit();
+        try {
+            $this->submit();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function submit()

app/Livewire/Terminal/Index.php

@@ -18,9 +18,7 @@ class Index extends Component
 
     public function mount()
     {
-        if (! auth()->user()->isAdmin()) {
-            abort(403);
-        }
+        $this->authorize('useTerminal', Server::class);
         $this->servers = Server::isReachable()->get()->filter(function ($server) {
             return $server->isTerminalEnabled();
         });

app/Policies/ServerPolicy.php

@@ -62,4 +62,44 @@ public function forceDelete(User $user, Server $server): bool
     {
         return false;
     }
+
+    /**
+     * Determine whether the user can manage proxy (start/stop/restart).
+     */
+    public function manageProxy(User $user, Server $server): bool
+    {
+        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
+    }
+
+    /**
+     * Determine whether the user can manage sentinel (start/stop).
+     */
+    public function manageSentinel(User $user, Server $server): bool
+    {
+        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
+    }
+
+    /**
+     * Determine whether the user can manage CA certificates.
+     */
+    public function manageCaCertificate(User $user, Server $server): bool
+    {
+        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
+    }
+
+    /**
+     * Determine whether the user can view terminal.
+     */
+    public function viewTerminal(User $user, Server $server): bool
+    {
+        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
+    }
+
+    /**
+     * Determine whether the user can view security views.
+     */
+    public function viewSecurity(User $user, Server $server): bool
+    {
+        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
+    }
 }

app/Policies/StandaloneDockerPolicy.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\StandaloneDocker;
+use App\Models\User;
+
+class StandaloneDockerPolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, StandaloneDocker $standaloneDocker): bool
+    {
+        return $user->teams()->get()->firstWhere('id', $standaloneDocker->server->team_id) !== null;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, StandaloneDocker $standaloneDocker): bool
+    {
+        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $standaloneDocker->server->team_id) !== null;
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, StandaloneDocker $standaloneDocker): bool
+    {
+        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $standaloneDocker->server->team_id) !== null;
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     */
+    public function restore(User $user, StandaloneDocker $standaloneDocker): bool
+    {
+        return false;
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
+    public function forceDelete(User $user, StandaloneDocker $standaloneDocker): bool
+    {
+        return false;
+    }
+}

app/Policies/SwarmDockerPolicy.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\SwarmDocker;
+use App\Models\User;
+
+class SwarmDockerPolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, SwarmDocker $swarmDocker): bool
+    {
+        return $user->teams()->get()->firstWhere('id', $swarmDocker->server->team_id) !== null;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, SwarmDocker $swarmDocker): bool
+    {
+        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $swarmDocker->server->team_id) !== null;
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, SwarmDocker $swarmDocker): bool
+    {
+        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $swarmDocker->server->team_id) !== null;
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     */
+    public function restore(User $user, SwarmDocker $swarmDocker): bool
+    {
+        return false;
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
+    public function forceDelete(User $user, SwarmDocker $swarmDocker): bool
+    {
+        return false;
+    }
+}

app/Providers/AuthServiceProvider.php

@@ -15,6 +15,8 @@ class AuthServiceProvider extends ServiceProvider
     protected $policies = [
         \App\Models\Server::class => \App\Policies\ServerPolicy::class,
         \App\Models\PrivateKey::class => \App\Policies\PrivateKeyPolicy::class,
+        \App\Models\StandaloneDocker::class => \App\Policies\StandaloneDockerPolicy::class,
+        \App\Models\SwarmDocker::class => \App\Policies\SwarmDockerPolicy::class,
     ];
 
     /**

resources/views/livewire/server/proxy/dynamic-configurations.blade.php

@@ -7,14 +7,13 @@
         <x-server.sidebar-proxy :server="$server" :parameters="$parameters" />
         @if ($server->isFunctional())
             <div class="w-full">
-
                 <div class="flex gap-2">
                     <div>
                         <div class="flex gap-2">
                             <h2>Dynamic Configurations</h2>
                             <x-forms.button wire:click="loadDynamicConfigurations">Reload</x-forms.button>
                             <x-modal-input buttonTitle="+ Add" title="New Dynamic Configuration">
-                                <livewire:server.proxy.new-dynamic-configuration />
+                                <livewire:server.proxy.new-dynamic-configuration :server_id="$server->id" />
                             </x-modal-input>
                         </div>
                         <div class='pb-4'>You can add dynamic proxy configurations here.</div>