tiennm99/coolify
1
0
Fork 0
mirror of https://github.com/tiennm99/coolify.git synced 2026-08-20 12:23:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api/destinations): use getTeamIdFromToken() like other Api controllers

Browse Source 
Initial draft called auth()->user()->currentTeam() which returns null in
the API context (Sanctum tokens don't carry the per-user currentTeam
state — that's a session/Livewire concept). Other Api controllers
(ServersController, ScheduledTasksController, etc.) use the canonical
helper getTeamIdFromToken() with a null guard returning 403.

This swap makes all five endpoints work against a real token.
This commit is contained in:
Poul
2026-05-25 11:36:26 +00:00
parent fe855cf8d0
commit 789e2c5cab
1 changed files with 30 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Controllers/Api/DestinationsController.php
+30 -5
View File
@@ -25,9 +25,22 @@ class DestinationsController extends Controller
];
}
private function teamIdOrAbort(): int|\Illuminate\Http\JsonResponse
{
$teamId = getTeamIdFromToken();
if (is_null($teamId)) {
return response()->json(['message' => 'You are not allowed to access the API.'], 403);
}
return $teamId;
}
public function index(Request $request)
{
$teamId = auth()->user()->currentTeam()->id;
$teamId = $this->teamIdOrAbort();
if (! is_int($teamId)) {
return $teamId;
}
$standalone = StandaloneDocker::ownedByCurrentTeamAPI($teamId)->get();
$swarm = SwarmDocker::ownedByCurrentTeamAPI($teamId)->get();
@@ -36,7 +49,10 @@ class DestinationsController extends Controller
public function index_by_server(Request $request, string $server_uuid)
{
$teamId = auth()->user()->currentTeam()->id;
$teamId = $this->teamIdOrAbort();
if (! is_int($teamId)) {
return $teamId;
}
$server = Server::ownedByCurrentTeamAPI($teamId)->whereUuid($server_uuid)->firstOrFail();
$list = $server->standaloneDockers->concat($server->swarmDockers);
@@ -45,7 +61,10 @@ class DestinationsController extends Controller
public function show(Request $request, string $uuid)
{
$teamId = auth()->user()->currentTeam()->id;
$teamId = $this->teamIdOrAbort();
if (! is_int($teamId)) {
return $teamId;
}
$d = StandaloneDocker::ownedByCurrentTeamAPI($teamId)->whereUuid($uuid)->first()
?? SwarmDocker::ownedByCurrentTeamAPI($teamId)->whereUuid($uuid)->firstOrFail();
@@ -54,7 +73,10 @@ class DestinationsController extends Controller
public function create(Request $request, string $server_uuid)
{
$teamId = auth()->user()->currentTeam()->id;
$teamId = $this->teamIdOrAbort();
if (! is_int($teamId)) {
return $teamId;
}
$server = Server::ownedByCurrentTeamAPI($teamId)->whereUuid($server_uuid)->firstOrFail();
$allowed = ['name', 'network', 'type'];
@@ -92,7 +114,10 @@ class DestinationsController extends Controller
public function delete(Request $request, string $uuid)
{
$teamId = auth()->user()->currentTeam()->id;
$teamId = $this->teamIdOrAbort();
if (! is_int($teamId)) {
return $teamId;
}
$d = StandaloneDocker::ownedByCurrentTeamAPI($teamId)->whereUuid($uuid)->first()
?? SwarmDocker::ownedByCurrentTeamAPI($teamId)->whereUuid($uuid)->firstOrFail();
if ($d->attachedTo()) {