a4ab69df56
Restrict V5 application and resource-connection creation to team admins. Resolve project, environment, and application from query params and keep session selection in sync. Surface V5 apps on the v4 resource index and count them for project/environment emptiness. Create the flux data dir on install and upgrade.
81 lines
2.6 KiB
PHP
81 lines
2.6 KiB
PHP
<?php
|
|
|
|
namespace App\Policies\V5;
|
|
|
|
use App\Models\Team;
|
|
use App\Models\User;
|
|
use App\Models\V5\Application;
|
|
use Illuminate\Auth\Access\Response;
|
|
|
|
class ApplicationPolicy
|
|
{
|
|
public function create(User $user, Team $team): Response
|
|
{
|
|
return $user->isAdminOfTeam($team->id)
|
|
? Response::allow()
|
|
: Response::deny('You do not have permission to manage applications in this team.');
|
|
}
|
|
|
|
/**
|
|
* Determine whether the user can view the application within the current team.
|
|
*
|
|
* Read-only diagnostics (deploy status, container logs) are available to any
|
|
* member of the owning team; apps from other teams stay hidden as a 404.
|
|
*/
|
|
public function view(User $user, Application $application, Team $team): Response
|
|
{
|
|
return $this->belongsToTeam($application, $team);
|
|
}
|
|
|
|
/**
|
|
* Determine whether the user can update the application within the current team.
|
|
*/
|
|
public function update(User $user, Application $application, Team $team): Response
|
|
{
|
|
return $this->allowIfAdminAndScoped($user, $application, $team);
|
|
}
|
|
|
|
/**
|
|
* Determine whether the user can update the application's ingress configuration.
|
|
*/
|
|
public function updateIngress(User $user, Application $application, Team $team): Response
|
|
{
|
|
return $this->allowIfAdminAndScoped($user, $application, $team);
|
|
}
|
|
|
|
/**
|
|
* Determine whether the user can delete the application within the current team.
|
|
*/
|
|
public function delete(User $user, Application $application, Team $team): Response
|
|
{
|
|
return $this->allowIfAdminAndScoped($user, $application, $team);
|
|
}
|
|
|
|
/**
|
|
* Run the team scoping check first (mismatch stays hidden as a 404) and
|
|
* only then the role check (403 for members on their own team's app).
|
|
*/
|
|
private function allowIfAdminAndScoped(User $user, Application $application, Team $team): Response
|
|
{
|
|
$scope = $this->belongsToTeam($application, $team);
|
|
|
|
if ($scope->denied()) {
|
|
return $scope;
|
|
}
|
|
|
|
return $user->isAdminOfTeam($team->id)
|
|
? Response::allow()
|
|
: Response::deny('You do not have permission to manage applications in this team.');
|
|
}
|
|
|
|
/**
|
|
* Applications outside the current team must stay invisible, so
|
|
* mismatches deny as not found instead of forbidden.
|
|
*/
|
|
private function belongsToTeam(Application $application, Team $team): Response
|
|
{
|
|
return $application->team_id === $team->id
|
|
? Response::allow()
|
|
: Response::denyAsNotFound();
|
|
}
|
|
}
|