From c9246559994f5006390c7665825e3bbd60370bb6 Mon Sep 17 00:00:00 2001 From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com> Date: Fri, 27 Feb 2026 22:42:48 +0100 Subject: [PATCH] feat(auth): restrict sensitive data visibility for team members Hide database passwords, connection URLs, and debug logs from team members: - Database components: hide passwords and connection URLs for members - Deployment UI: gate debug log toggle behind update permission - Debug logs: prevent members from viewing debug output - Storage/services: hide sensitive credentials from members Members can still view non-sensitive configuration while admins retain full access to all data. --- app/Http/Middleware/ApiAbility.php | 4 +- .../Project/Application/Deployment/Show.php | 4 +- .../Project/Application/DeploymentNavbar.php | 9 ++- .../Project/Database/Clickhouse/General.php | 9 +++ .../Project/Database/Dragonfly/General.php | 9 +++ .../Project/Database/Keydb/General.php | 9 +++ .../Project/Database/Mariadb/General.php | 10 ++++ .../Project/Database/Mongodb/General.php | 9 +++ .../Project/Database/Mysql/General.php | 10 ++++ .../Project/Database/Postgresql/General.php | 9 +++ .../Project/Database/Redis/General.php | 9 +++ app/Livewire/Project/Service/FileStorage.php | 3 +- app/Livewire/Project/Service/StackForm.php | 13 +++++ app/Livewire/Storage/Form.php | 8 +++ bootstrap/helpers/remoteProcess.php | 5 ++ .../application/deployment/show.blade.php | 2 + .../database/clickhouse/general.blade.php | 42 +++++++++----- .../database/dragonfly/general.blade.php | 44 ++++++++++----- .../project/database/keydb/general.blade.php | 42 +++++++++----- .../database/mariadb/general.blade.php | 56 +++++++++++++------ .../database/mongodb/general.blade.php | 40 +++++++++---- .../project/database/mysql/general.blade.php | 52 ++++++++++++----- .../database/postgresql/general.blade.php | 38 +++++++++---- .../project/database/redis/general.blade.php | 38 +++++++++---- .../project/service/file-storage.blade.php | 2 +- .../project/service/stack-form.blade.php | 12 ++-- .../views/livewire/storage/form.blade.php | 13 +++-- 27 files changed, 382 insertions(+), 119 deletions(-) diff --git a/app/Http/Middleware/ApiAbility.php b/app/Http/Middleware/ApiAbility.php index d42e09136..874e63825 100644 --- a/app/Http/Middleware/ApiAbility.php +++ b/app/Http/Middleware/ApiAbility.php @@ -21,9 +21,9 @@ public function handle($request, $next, ...$abilities) { try { $token = $request->user()->currentAccessToken(); - $teamId = (int) data_get($token, 'team_id'); + $teamId = data_get($token, 'team_id'); - if ($teamId && ! $request->user()->isAdminOfTeam($teamId)) { + if ($teamId !== null && ! $request->user()->isAdminOfTeam((int) $teamId)) { $tokenAbilities = $token->abilities ?? []; $disallowed = array_intersect($tokenAbilities, self::MEMBER_DISALLOWED_ABILITIES); diff --git a/app/Livewire/Project/Application/Deployment/Show.php b/app/Livewire/Project/Application/Deployment/Show.php index 189dcca9b..b8f5e891a 100644 --- a/app/Livewire/Project/Application/Deployment/Show.php +++ b/app/Livewire/Project/Application/Deployment/Show.php @@ -59,7 +59,9 @@ public function mount() $this->application_deployment_queue = $application_deployment_queue; $this->horizon_job_status = $this->application_deployment_queue->getHorizonJobStatus(); $this->deployment_uuid = $deploymentUuid; - $this->is_debug_enabled = $this->application->settings->is_debug_enabled; + $this->is_debug_enabled = auth()->user()->isMember() + ? false + : $this->application->settings->is_debug_enabled; $this->isKeepAliveOn(); } diff --git a/app/Livewire/Project/Application/DeploymentNavbar.php b/app/Livewire/Project/Application/DeploymentNavbar.php index fcd0d4cf4..b60f543ba 100644 --- a/app/Livewire/Project/Application/DeploymentNavbar.php +++ b/app/Livewire/Project/Application/DeploymentNavbar.php @@ -28,7 +28,9 @@ public function mount() { $this->application = Application::ownedByCurrentTeam()->find($this->application_deployment_queue->application_id); $this->server = $this->application->destination->server; - $this->is_debug_enabled = $this->application->settings->is_debug_enabled; + $this->is_debug_enabled = auth()->user()->isMember() + ? false + : $this->application->settings->is_debug_enabled; } public function deploymentFinished() @@ -67,10 +69,15 @@ public function copyLogsToClipboard(): string return ''; } + $isMember = auth()->user()->isMember(); + $markdown = "# Deployment Logs\n\n"; $markdown .= "```\n"; foreach ($logs as $log) { + if ($isMember && ! empty($log['hidden'])) { + continue; + } if (isset($log['output'])) { $markdown .= $log['output']."\n"; } diff --git a/app/Livewire/Project/Database/Clickhouse/General.php b/app/Livewire/Project/Database/Clickhouse/General.php index 7ad453fd5..e790f2a40 100644 --- a/app/Livewire/Project/Database/Clickhouse/General.php +++ b/app/Livewire/Project/Database/Clickhouse/General.php @@ -44,6 +44,8 @@ class General extends Component public bool $isLogDrainEnabled = false; + public bool $isPasswordHiddenForMember = false; + public function getListeners() { $teamId = Auth::user()->currentTeam()->id; @@ -67,6 +69,13 @@ public function mount() } catch (\Throwable $e) { return handleError($e, $this); } + + $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false; + if ($this->isPasswordHiddenForMember) { + $this->clickhouseAdminPassword = ''; + $this->dbUrl = null; + $this->dbUrlPublic = null; + } } protected function rules(): array diff --git a/app/Livewire/Project/Database/Dragonfly/General.php b/app/Livewire/Project/Database/Dragonfly/General.php index 4e325b9ee..4d74dbe22 100644 --- a/app/Livewire/Project/Database/Dragonfly/General.php +++ b/app/Livewire/Project/Database/Dragonfly/General.php @@ -48,6 +48,8 @@ class General extends Component public bool $enable_ssl = false; + public bool $isPasswordHiddenForMember = false; + public function getListeners() { $userId = Auth::id(); @@ -79,6 +81,13 @@ public function mount() } catch (\Throwable $e) { return handleError($e, $this); } + + $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false; + if ($this->isPasswordHiddenForMember) { + $this->dragonflyPassword = ''; + $this->dbUrl = null; + $this->dbUrlPublic = null; + } } protected function rules(): array diff --git a/app/Livewire/Project/Database/Keydb/General.php b/app/Livewire/Project/Database/Keydb/General.php index f02aa6674..1877f0cb8 100644 --- a/app/Livewire/Project/Database/Keydb/General.php +++ b/app/Livewire/Project/Database/Keydb/General.php @@ -50,6 +50,8 @@ class General extends Component public bool $enable_ssl = false; + public bool $isPasswordHiddenForMember = false; + public function getListeners() { $userId = Auth::id(); @@ -81,6 +83,13 @@ public function mount() } catch (\Throwable $e) { return handleError($e, $this); } + + $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false; + if ($this->isPasswordHiddenForMember) { + $this->keydbPassword = ''; + $this->dbUrl = null; + $this->dbUrlPublic = null; + } } protected function rules(): array diff --git a/app/Livewire/Project/Database/Mariadb/General.php b/app/Livewire/Project/Database/Mariadb/General.php index 74658e2a4..ccf7a440d 100644 --- a/app/Livewire/Project/Database/Mariadb/General.php +++ b/app/Livewire/Project/Database/Mariadb/General.php @@ -56,6 +56,8 @@ class General extends Component public ?Carbon $certificateValidUntil = null; + public bool $isPasswordHiddenForMember = false; + public function getListeners() { $userId = Auth::id(); @@ -137,6 +139,14 @@ public function mount() } catch (Exception $e) { return handleError($e, $this); } + + $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false; + if ($this->isPasswordHiddenForMember) { + $this->mariadbRootPassword = ''; + $this->mariadbPassword = ''; + $this->db_url = null; + $this->db_url_public = null; + } } public function syncData(bool $toModel = false) diff --git a/app/Livewire/Project/Database/Mongodb/General.php b/app/Livewire/Project/Database/Mongodb/General.php index 9f34b73d5..20490c4e1 100644 --- a/app/Livewire/Project/Database/Mongodb/General.php +++ b/app/Livewire/Project/Database/Mongodb/General.php @@ -56,6 +56,8 @@ class General extends Component public ?Carbon $certificateValidUntil = null; + public bool $isPasswordHiddenForMember = false; + public function getListeners() { $userId = Auth::id(); @@ -137,6 +139,13 @@ public function mount() } catch (Exception $e) { return handleError($e, $this); } + + $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false; + if ($this->isPasswordHiddenForMember) { + $this->mongoInitdbRootPassword = ''; + $this->db_url = null; + $this->db_url_public = null; + } } public function syncData(bool $toModel = false) diff --git a/app/Livewire/Project/Database/Mysql/General.php b/app/Livewire/Project/Database/Mysql/General.php index 86b109251..3a82af581 100644 --- a/app/Livewire/Project/Database/Mysql/General.php +++ b/app/Livewire/Project/Database/Mysql/General.php @@ -58,6 +58,8 @@ class General extends Component public ?Carbon $certificateValidUntil = null; + public bool $isPasswordHiddenForMember = false; + public function getListeners() { $userId = Auth::id(); @@ -142,6 +144,14 @@ public function mount() } catch (Exception $e) { return handleError($e, $this); } + + $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false; + if ($this->isPasswordHiddenForMember) { + $this->mysqlRootPassword = ''; + $this->mysqlPassword = ''; + $this->db_url = null; + $this->db_url_public = null; + } } public function syncData(bool $toModel = false) diff --git a/app/Livewire/Project/Database/Postgresql/General.php b/app/Livewire/Project/Database/Postgresql/General.php index e24674315..fbea4506a 100644 --- a/app/Livewire/Project/Database/Postgresql/General.php +++ b/app/Livewire/Project/Database/Postgresql/General.php @@ -66,6 +66,8 @@ class General extends Component public ?Carbon $certificateValidUntil = null; + public bool $isPasswordHiddenForMember = false; + public function getListeners() { $userId = Auth::id(); @@ -155,6 +157,13 @@ public function mount() } catch (Exception $e) { return handleError($e, $this); } + + $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false; + if ($this->isPasswordHiddenForMember) { + $this->postgresPassword = ''; + $this->db_url = null; + $this->db_url_public = null; + } } public function syncData(bool $toModel = false) diff --git a/app/Livewire/Project/Database/Redis/General.php b/app/Livewire/Project/Database/Redis/General.php index 08bcdc343..b777768ea 100644 --- a/app/Livewire/Project/Database/Redis/General.php +++ b/app/Livewire/Project/Database/Redis/General.php @@ -54,6 +54,8 @@ class General extends Component public ?Carbon $certificateValidUntil = null; + public bool $isPasswordHiddenForMember = false; + public function getListeners() { $userId = Auth::id(); @@ -130,6 +132,13 @@ public function mount() } catch (\Throwable $e) { return handleError($e, $this); } + + $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false; + if ($this->isPasswordHiddenForMember) { + $this->redisPassword = ''; + $this->dbUrl = null; + $this->dbUrlPublic = null; + } } public function syncData(bool $toModel = false) diff --git a/app/Livewire/Project/Service/FileStorage.php b/app/Livewire/Project/Service/FileStorage.php index 079115bb6..596a2646c 100644 --- a/app/Livewire/Project/Service/FileStorage.php +++ b/app/Livewire/Project/Service/FileStorage.php @@ -101,8 +101,7 @@ public function convertToDirectory() public function loadStorageOnServer() { try { - // Loading content is a read operation, so we use 'view' permission - $this->authorize('view', $this->resource); + $this->authorize('update', $this->resource); $this->fileStorage->loadStorageOnServer(); $this->syncData(); diff --git a/app/Livewire/Project/Service/StackForm.php b/app/Livewire/Project/Service/StackForm.php index 678db17e8..86d5a57c1 100644 --- a/app/Livewire/Project/Service/StackForm.php +++ b/app/Livewire/Project/Service/StackForm.php @@ -17,6 +17,8 @@ class StackForm extends Component public Collection $fields; + public bool $isPasswordHiddenForMember = false; + protected $listeners = ['saveCompose']; // Explicit properties @@ -121,6 +123,17 @@ public function mount() })->flatMap(function ($group) { return $group; }); + + $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false; + if ($this->isPasswordHiddenForMember) { + $this->fields = $this->fields->map(function ($field) { + if (data_get($field, 'isPassword')) { + $field['value'] = null; + } + + return $field; + }); + } } public function saveCompose($raw) diff --git a/app/Livewire/Storage/Form.php b/app/Livewire/Storage/Form.php index 4dc0b6ae2..bc1726f10 100644 --- a/app/Livewire/Storage/Form.php +++ b/app/Livewire/Storage/Form.php @@ -31,6 +31,8 @@ class Form extends Component public ?bool $isUsable = null; + public bool $isPasswordHiddenForMember = false; + protected function rules(): array { return [ @@ -109,6 +111,12 @@ private function syncData(bool $toModel = false): void public function mount() { $this->syncData(false); + + $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false; + if ($this->isPasswordHiddenForMember) { + $this->key = ''; + $this->secret = ''; + } } public function testConnection() diff --git a/bootstrap/helpers/remoteProcess.php b/bootstrap/helpers/remoteProcess.php index 217c82929..cb9f3bcab 100644 --- a/bootstrap/helpers/remoteProcess.php +++ b/bootstrap/helpers/remoteProcess.php @@ -183,6 +183,11 @@ function decode_remote_command_output(?ApplicationDeploymentQueue $application_d $application = Application::find(data_get($application_deployment_queue, 'application_id')); $is_debug_enabled = data_get($application, 'settings.is_debug_enabled'); + // Members should never see debug logs, even if an admin enabled debug mode + if ($is_debug_enabled && auth()->check() && auth()->user()->isMember()) { + $is_debug_enabled = false; + } + $logs = data_get($application_deployment_queue, 'logs'); if (empty($logs)) { return collect([]); diff --git a/resources/views/livewire/project/application/deployment/show.blade.php b/resources/views/livewire/project/application/deployment/show.blade.php index 5861cef30..4ea4a65bc 100644 --- a/resources/views/livewire/project/application/deployment/show.blade.php +++ b/resources/views/livewire/project/application/deployment/show.blade.php @@ -290,6 +290,7 @@ class="p-1 text-gray-500 hover:text-gray-700 dark:text-gray-400 dark:hover:text- d="M12 6v6h4.5m4.5 0a9 9 0 1 1-18 0 9 9 0 0 1 18 0Z" /> + @can('update', $application) + @endcan