[Fix] Enforce project authorization across web and API routes

app/Actions/Backup/ManageBackup.php

@@ -8,8 +8,11 @@
 use App\Jobs\Backup\DeleteJob;
 use App\Models\Backup;
 use App\Models\Server;
+use App\Models\StorageProvider;
+use App\Models\User;
 use App\ValidationRules\CronRule;
 use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Validation\Rule;
 use Illuminate\Validation\ValidationException;
@@ -22,10 +25,12 @@ class ManageBackup
      * @throws AuthorizationException
      * @throws ValidationException
      */
-    public function create(Server $server, array $input): Backup
+    public function create(Server $server, array $input, User $actor): Backup
     {
         $this->validate($server, $input);
 
+        Gate::forUser($actor)->authorize('view', StorageProvider::query()->findOrFail($input['storage']));
+
         $backupType = BackupType::from($input['type'] ?? BackupType::DATABASE->value);
 
         $backup = new Backup([
@@ -95,7 +100,8 @@ private function validate(Server $server, array $input): void
             ],
             'storage' => [
                 'required',
-                Rule::exists('storage_providers', 'id'),
+                Rule::exists('storage_providers', 'id')
+                    ->where(fn ($query) => $query->where('project_id', $server->project_id)->orWhereNull('project_id')),
             ],
             'keep' => [
                 'required',

app/Actions/Server/TransferServer.php

@@ -2,8 +2,11 @@
 
 namespace App\Actions\Server;
 
+use App\Models\NetworkServer;
+use App\Models\Project;
 use App\Models\Server;
 use App\Models\User;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Validation\Rule;
 use Illuminate\Validation\ValidationException;
@@ -19,7 +22,17 @@ public function transfer(User $user, Server $server, array $input): Server
     {
         $this->validate($user, $input);
 
-        $server->project_id = $input['project_id'];
+        $project = Project::query()->findOrFail($input['project_id']);
+        Gate::forUser($user)->authorize('create', [Server::class, $project]);
+
+        if ($server->project_id !== $project->id
+            && NetworkServer::query()->where('server_id', $server->id)->exists()) {
+            throw ValidationException::withMessages([
+                'project_id' => 'Remove the server from its networks and wait for removal to complete before transferring it.',
+            ]);
+        }
+
+        $server->project_id = $project->id;
         $server->save();
 
         return $server;

app/Actions/Site/CreateSite.php

@@ -13,11 +13,14 @@
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\Site;
+use App\Models\User;
 use App\Services\Webserver\Webserver;
 use App\Tooling\ToolingRegistry;
 use App\ValidationRules\DomainRule;
 use Exception;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Validation\Rule;
 use Illuminate\Validation\ValidationException;
@@ -32,7 +35,7 @@ class CreateSite
      *
      * @throws Throwable
      */
-    public function create(Server $server, array $input): Site
+    public function create(Server $server, array $input, User $actor): Site
     {
         $input = $this->lockRuntimeVersionsToExistingUser($server, $input);
 
@@ -78,6 +81,8 @@ public function create(Server $server, array $input): Site
             // check has access to repository
             try {
                 if ($site->sourceControl) {
+                    Gate::forUser($actor)->authorize('view', $site->sourceControl);
+
                     $site->sourceControl->getRepo($site->repository);
                 }
             } catch (SourceControlIsNotConnected) {
@@ -128,6 +133,10 @@ public function create(Server $server, array $input): Site
             return $site;
         } catch (Exception $e) {
             DB::rollBack();
+            if ($e instanceof AuthorizationException) {
+                throw $e;
+            }
+
             throw ValidationException::withMessages([
                 'type' => $e->getMessage(),
             ]);

app/Actions/Site/UpdateSourceControl.php

@@ -8,8 +8,11 @@
 use App\Exceptions\SSHError;
 use App\Models\Site;
 use App\Models\SourceControl;
+use App\Models\User;
 use App\SSH\OS\Git;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Validation\ValidationException;
@@ -20,28 +23,31 @@ class UpdateSourceControl
     /**
      * @param  array<string, mixed>  $input
      *
+     * @throws AuthorizationException
      * @throws ValidationException
      * @throws SSHError
      */
-    public function update(Site $site, array $input): void
+    public function update(Site $site, array $input, User $actor): void
     {
         Validator::make($input, [
             'source_control' => SourceControl::siteValidationRules($site->server),
         ])->validate();
 
         $newSourceControlId = (int) $input['source_control'];
 
-        if ($site->source_control_id === $newSourceControlId) {
-            return;
-        }
-
         $newSourceControl = SourceControl::find($newSourceControlId);
         if (! $newSourceControl instanceof SourceControl) {
             throw ValidationException::withMessages([
                 'source_control' => 'Source control not found',
             ]);
         }
 
+        Gate::forUser($actor)->authorize('view', $newSourceControl);
+
+        if ($site->source_control_id === $newSourceControlId) {
+            return;
+        }
+
         try {
             $newSourceControl->getRepo($site->repository);
         } catch (SourceControlIsNotConnected) {

app/Actions/Workflow/RunWorkflow.php

@@ -9,6 +9,8 @@
 use App\Models\User;
 use App\Models\Workflow;
 use App\Models\WorkflowRun;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Validator;
 
 class RunWorkflow
@@ -44,12 +46,14 @@ public function run(User $user, Workflow $workflow, array $input): WorkflowRun
         return $run;
     }
 
-    public function executeAction(WorkflowRun $run, User $user, Workflow $workflow, ?WorkflowActionDTO $workflowActionDto, ?array $input): void
+    public function executeAction(WorkflowRun $run, User $user, Workflow $workflow, ?WorkflowActionDTO $workflowActionDto, ?array $input, ?int $accessTokenId = null): void
     {
         if (! $workflowActionDto) {
             return;
         }
 
+        $this->authorizeExecution($user, $workflow, $accessTokenId);
+
         // Merge input with $workflowActionDto->inputs and resolve placeholders
         $resolvedInput = $this->resolveInputs($input ?? [], $workflowActionDto->inputs ?? []);
 
@@ -61,11 +65,33 @@ public function executeAction(WorkflowRun $run, User $user, Workflow $workflow,
 
         try {
             $output = $workflowActionDto->handler($user, $workflow)->run($resolvedInput);
-            $this->executeAction($run, $user, $workflow, $workflowActionDto->success, $output);
         } catch (\Throwable $e) {
             $run->log('Workflow action failed: '.$e->getMessage());
-            $this->executeAction($run, $user, $workflow, $workflowActionDto->failure, $input);
+            $this->executeAction($run, $user, $workflow, $workflowActionDto->failure, $input, $accessTokenId);
+
+            return;
         }
+
+        $this->executeAction($run, $user, $workflow, $workflowActionDto->success, $output, $accessTokenId);
+    }
+
+    private function authorizeExecution(User $user, Workflow $workflow, ?int $accessTokenId): void
+    {
+        if ($accessTokenId !== null) {
+            $token = $user->tokens()->find($accessTokenId);
+            $expiration = config('sanctum.expiration');
+
+            if (! $token ||
+                ($token->expires_at && $token->expires_at->isPast()) ||
+                ($expiration && $token->created_at->lte(now()->subMinutes($expiration))) ||
+                ! $token->can('write')) {
+                throw new AuthorizationException('The workflow API token is no longer valid.');
+            }
+
+            $user->withAccessToken($token);
+        }
+
+        Gate::forUser($user)->authorize('update', $workflow);
     }
 
     /**

app/Http/Controllers/API/FirewallRuleController.php

@@ -47,9 +47,9 @@ public function create(Request $request, Project $project, Server $server): Fire
     #[Put('{firewallRule}', name: 'api.projects.servers.firewall-rules.edit', middleware: 'ability:write')]
     public function edit(Request $request, Project $project, Server $server, FirewallRule $firewallRule): FirewallRuleResource
     {
-        $this->authorize('update', [FirewallRule::class, $firewallRule]);
+        $this->validateRoute($project, $server, $firewallRule);
 
-        $this->validateRoute($project, $server);
+        $this->authorize('update', [FirewallRule::class, $firewallRule]);
 
         $firewallRule = app(ManageRule::class)->update($firewallRule, $request->all());
 

app/Http/Controllers/API/SiteController.php

@@ -53,7 +53,7 @@ public function create(Request $request, Project $project, Server $server): Site
 
         $this->validateRoute($project, $server);
 
-        $site = app(CreateSite::class)->create($server, $request->all());
+        $site = app(CreateSite::class)->create($server, $request->all(), $request->user());
 
         return new SiteResource($site);
     }

app/Http/Controllers/API/WorkerController.php

@@ -34,10 +34,10 @@ class WorkerController extends Controller
     #[Get('/workers', name: 'api.projects.servers.workers', middleware: 'ability:read')]
     public function serverIndex(Project $project, Server $server): ResourceCollection
     {
-        $this->authorize('view', [$project, $server]);
-
         $this->validateRoute($project, $server);
 
+        $this->authorize('viewAny', [Worker::class, $server]);
+
         $workers = $server->workers()
             ->latest()
             ->simplePaginate(25);
@@ -48,10 +48,10 @@ public function serverIndex(Project $project, Server $server): ResourceCollectio
     #[Get('/sites/{site}/workers', name: 'api.projects.servers.sites.workers', middleware: 'ability:read')]
     public function siteIndex(Project $project, Server $server, Site $site): ResourceCollection
     {
-        $this->authorize('view', [$project, $server, $site]);
-
         $this->validateRoute($project, $server, $site);
 
+        $this->authorize('viewAny', [Worker::class, $server, $site]);
+
         $workers = $site->workers()
             ->latest()
             ->simplePaginate(25);
@@ -62,31 +62,31 @@ public function siteIndex(Project $project, Server $server, Site $site): Resourc
     #[Get('/workers/{worker}', name: 'api.projects.servers.workers.show', middleware: 'ability:read')]
     public function serverShow(Project $project, Server $server, Worker $worker): WorkerResource
     {
-        $this->authorize('view', [$project, $server, $worker]);
-
         $this->validateRoute($project, $server, worker: $worker);
 
+        $this->authorize('view', [$worker, $server]);
+
         return new WorkerResource($worker);
     }
 
     #[Get('/sites/{site}/workers/{worker}', name: 'api.projects.servers.sites.workers.show', middleware: 'ability:read')]
     public function siteShow(Project $project, Server $server, Site $site, Worker $worker): WorkerResource
     {
-        $this->authorize('view', [$project, $server, $site, $worker]);
-
         $this->validateRoute($project, $server, $site, $worker);
 
+        $this->authorize('view', [$worker, $server, $site]);
+
         return new WorkerResource($worker);
     }
 
     #[Post('/workers/resync/{site?}', name: 'api.projects.servers.workers.resync', middleware: 'ability:write')]
     #[WhereNumber('site')]
     public function resync(Project $project, Server $server, ?Site $site = null): JsonResponse
     {
-        $this->authorize('update', [$project, $server]);
-
         $this->validateRoute($project, $server, $site);
 
+        $this->authorize('manage', [Worker::class, $server, $site]);
+
         $count = app(SyncWorkerStatuses::class)->sync($server, $site);
 
         return response()->json([
@@ -98,10 +98,10 @@ public function resync(Project $project, Server $server, ?Site $site = null): Js
     #[WhereNumber('site')]
     public function restartAll(Project $project, Server $server, ?Site $site = null): JsonResponse
     {
-        $this->authorize('update', [$project, $server]);
-
         $this->validateRoute($project, $server, $site);
 
+        $this->authorize('manage', [Worker::class, $server, $site]);
+
         app(RestartAllWorkers::class)->restart($server, $site);
 
         return response()->json([
@@ -113,10 +113,10 @@ public function restartAll(Project $project, Server $server, ?Site $site = null)
     #[WhereNumber('site')]
     public function create(Request $request, Project $project, Server $server, ?Site $site = null): WorkerResource
     {
-        $this->authorize('create', [$project, $server, $site]);
-
         $this->validateRoute($project, $server, $site);
 
+        $this->authorize('create', [Worker::class, $server, $site]);
+
         $worker = app(CreateWorker::class)->create($server, $request->all(), $site);
 
         return new WorkerResource($worker);
@@ -125,10 +125,10 @@ public function create(Request $request, Project $project, Server $server, ?Site
     #[Put('/workers/{worker}/{site?}', name: 'api.projects.servers.workers.update', middleware: 'ability:write')]
     public function update(Request $request, Project $project, Server $server, Worker $worker, ?Site $site = null): WorkerResource
     {
-        $this->authorize('update', [$project, $server, $site]);
-
         $this->validateRoute($project, $server, $site, $worker);
 
+        $this->authorize('update', [$worker, $server, $site]);
+
         $worker = app(EditWorker::class)->edit($worker, $request->all());
 
         return new WorkerResource($worker);
@@ -137,10 +137,10 @@ public function update(Request $request, Project $project, Server $server, Worke
     #[Post('/workers/{worker}/start', name: 'api.projects.servers.workers.start', middleware: 'ability:write')]
     public function start(Request $request, Project $project, Server $server, Worker $worker): WorkerResource
     {
-        $this->authorize('update', [$project, $server]);
-
         $this->validateRoute($project, $server, worker: $worker);
 
+        $this->authorize('update', [$worker, $server]);
+
         app(ManageWorker::class)->start($worker);
 
         return new WorkerResource($worker);
@@ -149,10 +149,10 @@ public function start(Request $request, Project $project, Server $server, Worker
     #[Post('/workers/{worker}/restart', name: 'api.projects.servers.workers.restart', middleware: 'ability:write')]
     public function restart(Request $request, Project $project, Server $server, Worker $worker): WorkerResource
     {
-        $this->authorize('update', [$project, $server]);
-
         $this->validateRoute($project, $server, worker: $worker);
 
+        $this->authorize('update', [$worker, $server]);
+
         app(ManageWorker::class)->restart($worker);
 
         return new WorkerResource($worker);
@@ -161,10 +161,10 @@ public function restart(Request $request, Project $project, Server $server, Work
     #[Get('/workers/{worker}/logs', name: 'api.projects.servers.workers.logs', middleware: 'ability:read')]
     public function logs(Project $project, Server $server, Worker $worker): JsonResponse
     {
-        $this->authorize('view', [$project, $server, $worker]);
-
         $this->validateRoute($project, $server, worker: $worker);
 
+        $this->authorize('view', [$worker, $server]);
+
         $logs = app(GetWorkerLogs::class)->getLogs($worker);
 
         return response()->json([
@@ -175,10 +175,10 @@ public function logs(Project $project, Server $server, Worker $worker): JsonResp
     #[Delete('/workers/{worker}/{site?}', name: 'api.projects.servers.workers.delete', middleware: 'ability:write')]
     public function delete(Request $request, Project $project, Server $server, Worker $worker, ?Site $site = null): Response
     {
-        $this->authorize('delete', [$project, $server, $site, $worker]);
-
         $this->validateRoute($project, $server, $site, $worker);
 
+        $this->authorize('delete', [$worker, $server, $site]);
+
         app(DeleteWorker::class)->delete($worker);
 
         return response()->noContent();