From 789e2c5cab41242659b59e425671a7bc0bf9891e Mon Sep 17 00:00:00 2001
From: Poul <poul@kjeldager.com>
Date: Mon, 25 May 2026 11:36:26 +0000
Subject: [PATCH] fix(api/destinations): use getTeamIdFromToken() like other
 Api controllers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Initial draft called auth()->user()->currentTeam() which returns null in
the API context (Sanctum tokens don't carry the per-user currentTeam
state — that's a session/Livewire concept). Other Api controllers
(ServersController, ScheduledTasksController, etc.) use the canonical
helper getTeamIdFromToken() with a null guard returning 403.

This swap makes all five endpoints work against a real token.
---
 .../Api/DestinationsController.php            | 35 ++++++++++++++++---
 1 file changed, 30 insertions(+), 5 deletions(-)

diff --git a/app/Http/Controllers/Api/DestinationsController.php b/app/Http/Controllers/Api/DestinationsController.php
index 43fb0cba8..cd6c187b6 100644
--- a/app/Http/Controllers/Api/DestinationsController.php
+++ b/app/Http/Controllers/Api/DestinationsController.php
@@ -25,9 +25,22 @@ private function transform($d): array
         ];
     }
 
+    private function teamIdOrAbort(): int|\Illuminate\Http\JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return response()->json(['message' => 'You are not allowed to access the API.'], 403);
+        }
+
+        return $teamId;
+    }
+
     public function index(Request $request)
     {
-        $teamId = auth()->user()->currentTeam()->id;
+        $teamId = $this->teamIdOrAbort();
+        if (! is_int($teamId)) {
+            return $teamId;
+        }
         $standalone = StandaloneDocker::ownedByCurrentTeamAPI($teamId)->get();
         $swarm = SwarmDocker::ownedByCurrentTeamAPI($teamId)->get();
 
@@ -36,7 +49,10 @@ public function index(Request $request)
 
     public function index_by_server(Request $request, string $server_uuid)
     {
-        $teamId = auth()->user()->currentTeam()->id;
+        $teamId = $this->teamIdOrAbort();
+        if (! is_int($teamId)) {
+            return $teamId;
+        }
         $server = Server::ownedByCurrentTeamAPI($teamId)->whereUuid($server_uuid)->firstOrFail();
         $list = $server->standaloneDockers->concat($server->swarmDockers);
 
@@ -45,7 +61,10 @@ public function index_by_server(Request $request, string $server_uuid)
 
     public function show(Request $request, string $uuid)
     {
-        $teamId = auth()->user()->currentTeam()->id;
+        $teamId = $this->teamIdOrAbort();
+        if (! is_int($teamId)) {
+            return $teamId;
+        }
         $d = StandaloneDocker::ownedByCurrentTeamAPI($teamId)->whereUuid($uuid)->first()
             ?? SwarmDocker::ownedByCurrentTeamAPI($teamId)->whereUuid($uuid)->firstOrFail();
 
@@ -54,7 +73,10 @@ public function show(Request $request, string $uuid)
 
     public function create(Request $request, string $server_uuid)
     {
-        $teamId = auth()->user()->currentTeam()->id;
+        $teamId = $this->teamIdOrAbort();
+        if (! is_int($teamId)) {
+            return $teamId;
+        }
         $server = Server::ownedByCurrentTeamAPI($teamId)->whereUuid($server_uuid)->firstOrFail();
 
         $allowed = ['name', 'network', 'type'];
@@ -92,7 +114,10 @@ public function create(Request $request, string $server_uuid)
 
     public function delete(Request $request, string $uuid)
     {
-        $teamId = auth()->user()->currentTeam()->id;
+        $teamId = $this->teamIdOrAbort();
+        if (! is_int($teamId)) {
+            return $teamId;
+        }
         $d = StandaloneDocker::ownedByCurrentTeamAPI($teamId)->whereUuid($uuid)->first()
             ?? SwarmDocker::ownedByCurrentTeamAPI($teamId)->whereUuid($uuid)->firstOrFail();
         if ($d->attachedTo()) {