fix(security): enforce GitLab App authorization parity with GitHub

GitlabAppPolicy previously allowed any authenticated user to update,
delete, and create GitLab sources. Align it with GithubAppPolicy, require
Application create authorization on the private-repo wizard, and reject
OAuth callbacks from non-admins so members cannot escalate privileges.

app/Http/Controllers/Webhook/Gitlab.php

@@ -40,6 +40,11 @@ class Gitlab extends Controller
 
             $gitlabApp = GitlabApp::whereKey(data_get($payload, 'gitlab_app_id'))->firstOrFail();
 
+            // Only users who may administer the source can complete OAuth and store tokens.
+            if (! $request->user()->can('update', $gitlabApp)) {
+                return redirect()->route('source.all')->with('error', 'You are not authorized to connect this GitLab App.');
+            }
+
             $baseUrl = rtrim($gitlabApp->html_url, '/');
 
             $response = Http::asForm()->post("{$baseUrl}/oauth/token", [

app/Livewire/Project/New/GitlabPrivateRepository.php

@@ -7,11 +7,14 @@ use App\Models\GitlabApp;
 use App\Models\Project;
 use App\Rules\ValidGitBranch;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Route;
 use Livewire\Component;
 
 class GitlabPrivateRepository extends Component
 {
+    use AuthorizesRequests;
+
     public $current_step = 'gitlab_apps';
 
     public $gitlab_apps;
@@ -158,6 +161,8 @@ class GitlabPrivateRepository extends Component
     public function submit()
     {
         try {
+            $this->authorize('create', Application::class);
+
             $validator = validator([
                 'selected_repository_path' => $this->selected_repository_path,
                 'selected_branch_name' => $this->selected_branch_name,

app/Policies/GitlabAppPolicy.php

@@ -7,44 +7,69 @@ use App\Models\User;
 
 class GitlabAppPolicy
 {
+    /**
+     * Determine whether the user can view any models.
+     */
     public function viewAny(User $user): bool
     {
         return true;
     }
 
+    /**
+     * Determine whether the user can view the model.
+     */
     public function view(User $user, GitlabApp $gitlabApp): bool
     {
-        return true;
+        if ($gitlabApp->is_system_wide) {
+            return true;
+        }
+
+        return $user->teams->contains('id', $gitlabApp->team_id);
     }
 
+    /**
+     * Determine whether the user can create models.
+     */
     public function create(User $user): bool
     {
-        return true;
+        return $user->isAdmin();
     }
 
+    /**
+     * Determine whether the user can update the model.
+     */
     public function update(User $user, GitlabApp $gitlabApp): bool
     {
         if ($gitlabApp->is_system_wide) {
-            return true;
+            return $user->canAccessSystemResources();
         }
 
-        return true;
+        return $user->isAdminOfTeam($gitlabApp->team_id);
     }
 
+    /**
+     * Determine whether the user can delete the model.
+     */
     public function delete(User $user, GitlabApp $gitlabApp): bool
     {
         if ($gitlabApp->is_system_wide) {
-            return true;
+            return $user->canAccessSystemResources();
         }
 
-        return true;
+        return $user->isAdminOfTeam($gitlabApp->team_id);
     }
 
+    /**
+     * Determine whether the user can restore the model.
+     */
     public function restore(User $user, GitlabApp $gitlabApp): bool
     {
         return false;
     }
 
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
     public function forceDelete(User $user, GitlabApp $gitlabApp): bool
     {
         return false;

tests/Feature/GitlabAppAuthorizationTest.php

@@ -0,0 +1,92 @@
+<?php
+
+use App\Livewire\Project\New\GitlabPrivateRepository;
+use App\Livewire\Source\Gitlab\Change;
+use App\Models\Application;
+use App\Models\GitlabApp;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->owner = User::factory()->create();
+    $this->member = User::factory()->create();
+    $this->team->members()->attach($this->owner->id, ['role' => 'owner']);
+    $this->team->members()->attach($this->member->id, ['role' => 'member']);
+
+    InstanceSettings::forceCreate([
+        'id' => 0,
+        'fqdn' => null,
+        'public_ipv4' => null,
+        'public_ipv6' => null,
+    ]);
+
+    $this->gitlabApp = GitlabApp::create([
+        'name' => 'Self-hosted GitLab',
+        'api_url' => 'https://gitlab.example.com/api/v4',
+        'html_url' => 'https://gitlab.example.com',
+        'custom_user' => 'git',
+        'custom_port' => 22,
+        'client_id' => 'client-id',
+        'client_secret' => 'client-secret',
+        'webhook_token' => 'secret-webhook-token',
+        'access_token' => 'access-token',
+        'refresh_token' => 'refresh-token',
+        'expires_at' => time() + 3600,
+        'redirect_uri' => 'https://coolify.example.com/webhooks/source/gitlab/redirect',
+        'team_id' => $this->team->id,
+        'is_system_wide' => false,
+        'is_public' => false,
+    ]);
+});
+
+describe('GitLab App authorization', function () {
+    test('team member cannot update a gitlab app via instantSave', function () {
+        $this->actingAs($this->member);
+        session(['currentTeam' => $this->team]);
+
+        Livewire::withQueryParams(['gitlab_app_uuid' => $this->gitlabApp->uuid])
+            ->test(Change::class)
+            ->set('isSystemWide', true)
+            ->call('instantSave')
+            ->assertDispatched('error');
+
+        expect($this->gitlabApp->refresh()->is_system_wide)->toBeFalse();
+    });
+
+    test('team owner can update a gitlab app via instantSave', function () {
+        $this->actingAs($this->owner);
+        session(['currentTeam' => $this->team]);
+
+        Livewire::withQueryParams(['gitlab_app_uuid' => $this->gitlabApp->uuid])
+            ->test(Change::class)
+            ->set('isSystemWide', true)
+            ->call('instantSave')
+            ->assertDispatched('success');
+
+        expect($this->gitlabApp->refresh()->is_system_wide)->toBeTrue();
+    });
+
+    test('team member cannot create an application from a private gitlab repository', function () {
+        $this->actingAs($this->member);
+        session(['currentTeam' => $this->team]);
+
+        $applicationsBefore = Application::count();
+
+        // Avoid setting selected_project_id — its updated* hook loads branches and is unrelated to this auth check.
+        Livewire::test(GitlabPrivateRepository::class, ['type' => 'private-gitlab-app'])
+            ->set('selected_repository_path', 'group/repo')
+            ->set('selected_branch_name', 'main')
+            ->set('selected_gitlab_app_id', $this->gitlabApp->id)
+            ->set('gitlab_app_id', $this->gitlabApp->id)
+            ->call('submit')
+            ->assertDispatched('error');
+
+        expect(Application::count())->toBe($applicationsBefore);
+    });
+});

tests/Feature/GitlabOAuthCallbackStateTest.php

@@ -105,4 +105,25 @@ describe('GitLab OAuth callback state validation', function () {
 
         $response->assertRedirect(route('login'));
     });
+
+    test('rejects a callback from a team member who cannot administer the source', function () {
+        Http::fake();
+
+        $member = User::factory()->create();
+        $this->team->members()->attach($member->id, ['role' => 'member']);
+        $this->actingAs($member);
+        session(['currentTeam' => $this->team]);
+
+        $state = 'member-state';
+        Cache::put(GitlabSource::oauthStateCacheKey($state), [
+            'gitlab_app_id' => $this->gitlabApp->id,
+            'team_id' => $this->team->id,
+        ], now()->addMinutes(60));
+
+        $response = $this->get('/webhooks/source/gitlab/redirect?code=any&state='.$state);
+
+        $response->assertRedirect(route('source.all'));
+        Http::assertNothingSent();
+        expect($this->gitlabApp->refresh()->access_token)->toBeNull();
+    });
 });

tests/Unit/Policies/GitlabAppPolicyTest.php

@@ -0,0 +1,172 @@
+<?php
+
+use App\Models\GitlabApp;
+use App\Models\User;
+use App\Policies\GitlabAppPolicy;
+
+it('allows any user to view any gitlab apps', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $policy = new GitlabAppPolicy;
+    expect($policy->viewAny($user))->toBeTrue();
+});
+
+it('allows any user to view system-wide gitlab app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $model = mockGitlabApp(teamId: 1, isSystemWide: true);
+
+    $policy = new GitlabAppPolicy;
+    expect($policy->view($user, $model))->toBeTrue();
+});
+
+it('allows team member to view non-system-wide gitlab app', function () {
+    $teams = collect([
+        (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $model = mockGitlabApp(teamId: 1, isSystemWide: false);
+
+    $policy = new GitlabAppPolicy;
+    expect($policy->view($user, $model))->toBeTrue();
+});
+
+it('denies non-team member to view non-system-wide gitlab app', function () {
+    $teams = collect([
+        (object) ['id' => 2, 'pivot' => (object) ['role' => 'member']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $model = mockGitlabApp(teamId: 1, isSystemWide: false);
+
+    $policy = new GitlabAppPolicy;
+    expect($policy->view($user, $model))->toBeFalse();
+});
+
+it('allows admin to create gitlab app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new GitlabAppPolicy;
+    expect($policy->create($user))->toBeTrue();
+});
+
+it('denies non-admin to create gitlab app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new GitlabAppPolicy;
+    expect($policy->create($user))->toBeFalse();
+});
+
+it('allows user with system access to update system-wide gitlab app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('canAccessSystemResources')->andReturn(true);
+
+    $model = mockGitlabApp(teamId: 1, isSystemWide: true);
+
+    $policy = new GitlabAppPolicy;
+    expect($policy->update($user, $model))->toBeTrue();
+});
+
+it('denies user without system access to update system-wide gitlab app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('canAccessSystemResources')->andReturn(false);
+
+    $model = mockGitlabApp(teamId: 1, isSystemWide: true);
+
+    $policy = new GitlabAppPolicy;
+    expect($policy->update($user, $model))->toBeFalse();
+});
+
+it('allows team admin to update non-system-wide gitlab app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $model = mockGitlabApp(teamId: 1, isSystemWide: false);
+
+    $policy = new GitlabAppPolicy;
+    expect($policy->update($user, $model))->toBeTrue();
+});
+
+it('denies team member to update non-system-wide gitlab app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $model = mockGitlabApp(teamId: 1, isSystemWide: false);
+
+    $policy = new GitlabAppPolicy;
+    expect($policy->update($user, $model))->toBeFalse();
+});
+
+it('allows user with system access to delete system-wide gitlab app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('canAccessSystemResources')->andReturn(true);
+
+    $model = mockGitlabApp(teamId: 1, isSystemWide: true);
+
+    $policy = new GitlabAppPolicy;
+    expect($policy->delete($user, $model))->toBeTrue();
+});
+
+it('denies user without system access to delete system-wide gitlab app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('canAccessSystemResources')->andReturn(false);
+
+    $model = mockGitlabApp(teamId: 1, isSystemWide: true);
+
+    $policy = new GitlabAppPolicy;
+    expect($policy->delete($user, $model))->toBeFalse();
+});
+
+it('allows team admin to delete non-system-wide gitlab app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $model = mockGitlabApp(teamId: 1, isSystemWide: false);
+
+    $policy = new GitlabAppPolicy;
+    expect($policy->delete($user, $model))->toBeTrue();
+});
+
+it('denies team member to delete non-system-wide gitlab app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $model = mockGitlabApp(teamId: 1, isSystemWide: false);
+
+    $policy = new GitlabAppPolicy;
+    expect($policy->delete($user, $model))->toBeFalse();
+});
+
+it('denies restore of gitlab app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $model = mockGitlabApp(teamId: 1, isSystemWide: false);
+
+    $policy = new GitlabAppPolicy;
+    expect($policy->restore($user, $model))->toBeFalse();
+});
+
+it('denies force delete of gitlab app', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $model = mockGitlabApp(teamId: 1, isSystemWide: false);
+
+    $policy = new GitlabAppPolicy;
+    expect($policy->forceDelete($user, $model))->toBeFalse();
+});
+
+function mockGitlabApp(int $teamId, bool $isSystemWide): GitlabApp
+{
+    $gitlabApp = Mockery::mock(GitlabApp::class)->makePartial();
+    $gitlabApp->team_id = $teamId;
+    $gitlabApp->is_system_wide = $isSystemWide;
+
+    return $gitlabApp;
+}