Add resource authorization policies - #463
Conversation
Centralize user and subscriber authorization so dashboard, API, and MCP access follow the same rules. Restrict subscriber data and privileged API tokens to administrators.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
馃挕 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dbf3b650d1
鈩癸笍 About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 馃憤.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| private function registerPolicies(): void | ||
| { | ||
| Gate::policy(Models\User::class, UserPolicy::class); | ||
| Gate::policy(config('cachet.user_model'), UserPolicy::class); |
There was a problem hiding this comment.
When cachet.user_model points to a consumer's existing user model, this unconditionally installs Cachet's policy into Laravel's global Gate and takes precedence over an auto-discovered host UserPolicy. Consequently, authorization elsewhere in the host for that model starts using Cachet's admin/self rules鈥攐r, if the host later replaces the mapping, Cachet loses these rules鈥攕o the package cannot safely coexist with the consumer policy. Keep Cachet authorization scoped to its resources or use distinct abilities rather than claiming the configured host model's policy mapping.
AGENTS.md reference: AGENTS.md:L106-L109
Useful? React with 馃憤聽/ 馃憥.
1 participant
Centralizes user and subscriber authorization in Laravel policies.
Subscriber access now requires administrator authorization across the dashboard, API, MCP, and token creation. Non-administrators retain access to their own user record and scoped operational tokens.
Tests cover the policy decisions and each access boundary.