Commit Graph
4 Commits
Author SHA1 Message Date
Andras Bacsai fff83884da fix(ui): polish create flows and terminal navigation
Open the global terminal outside Livewire navigation, clarify that
image tag and SHA256 digest are mutually exclusive, inset the GitLab
empty state, and show loading on Dockerfile create. Add regression tests.
2026-08-07 17:54:50 +02:00
Andras Bacsai 5b370713c3 fix(sources): prevent 500 when deleting GitLab/GitHub apps
After delete, Livewire still re-renders the source change view (modal
$refresh / morph). Policy @can checks then call isAdminOfTeam() with a
null team_id and throw a TypeError (HTTP 500) before the redirect.

Guard null team_id in GitlabAppPolicy and GithubAppPolicy, clear the
Livewire model after delete, and skip @can when the model is gone.
2026-08-01 18:34:38 +02:00
Andras Bacsai 3a863378b1 fix(gitlab): hide source secrets from unauthorized users
Only persist the system-wide setting during instant saves, preventing
unvalidated source details from being stored.
2026-07-21 22:11:25 +02:00
Andras Bacsai 6f557cf17f fix(security): enforce GitLab App authorization parity with GitHub
GitlabAppPolicy previously allowed any authenticated user to update,
delete, and create GitLab sources. Align it with GithubAppPolicy, require
Application create authorization on the private-repo wizard, and reject
OAuth callbacks from non-admins so members cannot escalate privileges.
2026-07-20 23:21:40 +02:00