6ae45684f9
Split V5 dashboard behavior into domain controllers and policies, add agent token rotation/revocation, status reconciliation jobs, ingress firewall syncing, and canvas connection APIs. Add migrations for V5 status tracking, server capabilities, resource connection aliases, and revoked agent tokens.
74 lines
2.3 KiB
PHP
74 lines
2.3 KiB
PHP
<?php
|
|
|
|
namespace App\Policies\V5;
|
|
|
|
use App\Models\Team;
|
|
use App\Models\User;
|
|
use App\Models\V5\Application;
|
|
use Illuminate\Auth\Access\Response;
|
|
|
|
class ApplicationPolicy
|
|
{
|
|
/**
|
|
* Determine whether the user can view the application within the current team.
|
|
*
|
|
* Read-only diagnostics (deploy status, container logs) are available to any
|
|
* member of the owning team; apps from other teams stay hidden as a 404.
|
|
*/
|
|
public function view(User $user, Application $application, Team $team): Response
|
|
{
|
|
return $this->belongsToTeam($application, $team);
|
|
}
|
|
|
|
/**
|
|
* Determine whether the user can update the application within the current team.
|
|
*/
|
|
public function update(User $user, Application $application, Team $team): Response
|
|
{
|
|
return $this->allowIfAdminAndScoped($user, $application, $team);
|
|
}
|
|
|
|
/**
|
|
* Determine whether the user can update the application's ingress configuration.
|
|
*/
|
|
public function updateIngress(User $user, Application $application, Team $team): Response
|
|
{
|
|
return $this->allowIfAdminAndScoped($user, $application, $team);
|
|
}
|
|
|
|
/**
|
|
* Determine whether the user can delete the application within the current team.
|
|
*/
|
|
public function delete(User $user, Application $application, Team $team): Response
|
|
{
|
|
return $this->allowIfAdminAndScoped($user, $application, $team);
|
|
}
|
|
|
|
/**
|
|
* Run the team scoping check first (mismatch stays hidden as a 404) and
|
|
* only then the role check (403 for members on their own team's app).
|
|
*/
|
|
private function allowIfAdminAndScoped(User $user, Application $application, Team $team): Response
|
|
{
|
|
$scope = $this->belongsToTeam($application, $team);
|
|
|
|
if ($scope->denied()) {
|
|
return $scope;
|
|
}
|
|
|
|
return $user->isAdminOfTeam($team->id)
|
|
? Response::allow()
|
|
: Response::deny('You do not have permission to manage applications in this team.');
|
|
}
|
|
|
|
/**
|
|
* Applications outside the current team must stay invisible, so
|
|
* mismatches deny as not found instead of forbidden.
|
|
*/
|
|
private function belongsToTeam(Application $application, Team $team): Response
|
|
{
|
|
return $application->team_id === $team->id
|
|
? Response::allow()
|
|
: Response::denyAsNotFound();
|
|
}
|
|
}
|