fix(api): validate token team context

2026-06-22 05:42:45 +00:00 · 2026-06-01 15:17:55 +02:00
parent 4d0be415c8
commit a511bd9b67
14 changed files with 277 additions and 23 deletions
@@ -12,6 +12,7 @@ use App\Http\Middleware\CheckForcePasswordReset;
 use App\Http\Middleware\DecideWhatToDoWithUser;
 use App\Http\Middleware\EncryptCookies;
 use App\Http\Middleware\EnsureMcpEnabled;
+use App\Http\Middleware\EnsureTokenBelongsToCurrentTeamMember;
 use App\Http\Middleware\PreventRequestsDuringMaintenance;
 use App\Http\Middleware\RedirectIfAuthenticated;
 use App\Http\Middleware\TrimStrings;
@@ -104,6 +105,7 @@ class Kernel extends HttpKernel
        'ability' => CheckForAnyAbility::class,
        'api.ability' => ApiAbility::class,
        'api.sensitive' => ApiSensitiveData::class,
+        'api.token.team' => EnsureTokenBelongsToCurrentTeamMember::class,
        'can.create.resources' => CanCreateResources::class,
        'can.update.resource' => CanUpdateResource::class,
        'can.access.terminal' => CanAccessTerminal::class,