fix members smtp pw update

app/Livewire/Notifications/Email.php

@@ -170,11 +170,15 @@ public function syncData(bool $toModel = false)
             $this->smtpPort = $this->settings->smtp_port;
             $this->smtpEncryption = $this->settings->smtp_encryption;
             $this->smtpUsername = $this->settings->smtp_username;
-            $this->smtpPassword = $this->settings->smtp_password;
+            $this->smtpPassword = auth()->user()->can('update', $this->settings)
+                ? $this->settings->smtp_password
+                : null;
             $this->smtpTimeout = $this->settings->smtp_timeout;
 
             $this->resendEnabled = $this->settings->resend_enabled;
-            $this->resendApiKey = $this->settings->resend_api_key;
+            $this->resendApiKey = auth()->user()->can('update', $this->settings)
+                ? $this->settings->resend_api_key
+                : null;
 
             $this->useInstanceEmailSettings = $this->settings->use_instance_email_settings;
 
@@ -242,6 +246,8 @@ public function instantSave(?string $type = null)
 
     public function submitSmtp()
     {
+        $this->authorize('update', $this->settings);
+
         try {
             $this->resetErrorBag();
             $this->validate([
@@ -289,6 +295,8 @@ public function submitSmtp()
 
     public function submitResend()
     {
+        $this->authorize('update', $this->settings);
+
         try {
             $this->resetErrorBag();
             $this->validate([

resources/views/livewire/notifications/email.blade.php

@@ -81,7 +81,11 @@ class="p-4 border dark:border-coolgray-300 border-neutral-200 rounded-lg flex fl
                         </div>
                         <div class="flex flex-col w-full gap-2 xl:flex-row">
                             <x-forms.input canGate="update" :canResource="$settings" id="smtpUsername" label="SMTP Username" />
-                            <x-forms.input canGate="update" :canResource="$settings" id="smtpPassword" type="password" label="SMTP Password" />
+                            @can('update', $settings)
+                                <x-forms.input canGate="update" :canResource="$settings" id="smtpPassword" type="password" label="SMTP Password" />
+                            @else
+                                <x-forms.input disabled label="SMTP Password" value="Hidden (only admins can view)" />
+                            @endcan
                             <x-forms.input canGate="update" :canResource="$settings" id="smtpTimeout" type="number"  helper="Timeout value for sending emails."
                                 label="Timeout" />
                         </div>
@@ -103,8 +107,12 @@ class="p-4 border dark:border-coolgray-300 border-neutral-200 rounded-lg flex fl
                 <div class="flex flex-col">
                     <div class="flex flex-col gap-4">
                         <div class="flex flex-col w-full gap-2 xl:flex-row">
-                            <x-forms.input canGate="update" :canResource="$settings" required type="password" id="resendApiKey" placeholder="API key"
+                            @can('update', $settings)
-                                label="API Key" />
+                                <x-forms.input canGate="update" :canResource="$settings" required type="password" id="resendApiKey" placeholder="API key"
+                                    label="API Key" />
+                            @else
+                                <x-forms.input disabled label="API Key" value="Hidden (only admins can view)" />
+                            @endcan
                         </div>
                     </div>
                 </div>

tests/Feature/Authorization/NotificationAuthorizationTest.php

@@ -161,6 +161,33 @@
         ->assertForbidden();
 });
 
+test('member cannot update smtp email transport directly', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(EmailNotification::class)
+        ->set('smtpFromAddress', 'member@example.com')
+        ->set('smtpFromName', 'Member')
+        ->set('smtpHost', 'smtp.example.com')
+        ->set('smtpPort', '587')
+        ->set('smtpEncryption', 'starttls')
+        ->set('smtpPassword', 'member-smtp-password')
+        ->call('submitSmtp')
+        ->assertForbidden();
+});
+
+test('member cannot update resend email transport directly', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(EmailNotification::class)
+        ->set('smtpFromAddress', 'member@example.com')
+        ->set('smtpFromName', 'Member')
+        ->set('resendApiKey', 'member-resend-api-key')
+        ->call('submitResend')
+        ->assertForbidden();
+});
+
 test('member cannot copy instance email settings', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
@@ -312,6 +339,10 @@
     'generic webhook' => [WebhookNotification::class, 'webhookNotificationSettings', [
         'webhook_url' => 'https://example.com/secret-webhook',
     ]],
+    'email credentials' => [EmailNotification::class, 'emailNotificationSettings', [
+        'smtp_password' => 'smtp-secret-password',
+        'resend_api_key' => 'resend-secret-api-key',
+    ]],
 ]);
 
 test('admin can view notification secrets', function (string $component, string $settingsRelation, array $secrets) {
@@ -346,4 +377,8 @@
     'generic webhook' => [WebhookNotification::class, 'webhookNotificationSettings', [
         'webhook_url' => 'https://example.com/admin-webhook',
     ]],
+    'email credentials' => [EmailNotification::class, 'emailNotificationSettings', [
+        'smtp_password' => 'smtp-admin-password',
+        'resend_api_key' => 'resend-admin-api-key',
+    ]],
 ]);