rosslh/coolify
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(api/destinations): use getTeamIdFromToken() like other Api controllers

Browse source 
Initial draft called auth()->user()->currentTeam() which returns null in
the API context (Sanctum tokens don't carry the per-user currentTeam
state — that's a session/Livewire concept). Other Api controllers
(ServersController, ScheduledTasksController, etc.) use the canonical
helper getTeamIdFromToken() with a null guard returning 403.

This swap makes all five endpoints work against a real token.
This commit is contained in:
Poul 2026-05-25 11:36:26 +00:00
parent fe855cf8d0
commit 789e2c5cab
1 changed files with 30 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
app/Http/Controllers/Api/DestinationsController.php
View file

@ -25,9 +25,22 @@ private function transform($d): array
];
}
private function teamIdOrAbort(): int|\Illuminate\Http\JsonResponse
{
$teamId = getTeamIdFromToken();
if (is_null($teamId)) {
return response()->json(['message' => 'You are not allowed to access the API.'], 403);
}
return $teamId;
}
public function index(Request $request)
{
$teamId = auth()->user()->currentTeam()->id;
$teamId = $this->teamIdOrAbort();
if (! is_int($teamId)) {
return $teamId;
}
$standalone = StandaloneDocker::ownedByCurrentTeamAPI($teamId)->get();
$swarm = SwarmDocker::ownedByCurrentTeamAPI($teamId)->get();
@ -36,7 +49,10 @@ public function index(Request $request)
public function index_by_server(Request $request, string $server_uuid)
{
$teamId = auth()->user()->currentTeam()->id;
$teamId = $this->teamIdOrAbort();
if (! is_int($teamId)) {
return $teamId;
}
$server = Server::ownedByCurrentTeamAPI($teamId)->whereUuid($server_uuid)->firstOrFail();
$list = $server->standaloneDockers->concat($server->swarmDockers);
@ -45,7 +61,10 @@ public function index_by_server(Request $request, string $server_uuid)
public function show(Request $request, string $uuid)
{
$teamId = auth()->user()->currentTeam()->id;
$teamId = $this->teamIdOrAbort();
if (! is_int($teamId)) {
return $teamId;
}
$d = StandaloneDocker::ownedByCurrentTeamAPI($teamId)->whereUuid($uuid)->first()
?? SwarmDocker::ownedByCurrentTeamAPI($teamId)->whereUuid($uuid)->firstOrFail();
@ -54,7 +73,10 @@ public function show(Request $request, string $uuid)
public function create(Request $request, string $server_uuid)
{
$teamId = auth()->user()->currentTeam()->id;
$teamId = $this->teamIdOrAbort();
if (! is_int($teamId)) {
return $teamId;
}
$server = Server::ownedByCurrentTeamAPI($teamId)->whereUuid($server_uuid)->firstOrFail();
$allowed = ['name', 'network', 'type'];
@ -92,7 +114,10 @@ public function create(Request $request, string $server_uuid)
public function delete(Request $request, string $uuid)
{
$teamId = auth()->user()->currentTeam()->id;
$teamId = $this->teamIdOrAbort();
if (! is_int($teamId)) {
return $teamId;
}
$d = StandaloneDocker::ownedByCurrentTeamAPI($teamId)->whereUuid($uuid)->first()
?? SwarmDocker::ownedByCurrentTeamAPI($teamId)->whereUuid($uuid)->firstOrFail();
if ($d->attachedTo()) {