[Feature]: Read-only / viewer role that's actually enforced (Policy authorization checks are currently stubbed to always-allow)

[ahliweb]

Request Type

New Feature

Description

Problem

We'd like to expose the Coolify dashboard on a public domain (behind our own reverse-proxy auth
layer) so a couple of people can check deployment/server status without needing an SSH tunnel every
time. Coolify already has a role column on team_user (owner/admin/member), which looks
like exactly the right primitive for this — give a viewer the member role and expect them to be
restricted to read-only.

In testing this, we found that role isn't actually enforced anywhere right now. Every Policy class
we checked has its real authorization logic commented out under an explicit
// Authorization temporarily disabled marker, with the method unconditionally return true
below it — e.g.:

• app/Policies/ApplicationPolicy.php — update(), delete(), manageEnvironment(),
  manageDeployments(), deploy() all commented-out isAdmin() checks, all return true
• app/Policies/ServerPolicy.php — same pattern on update()/delete()
• app/Policies/DatabasePolicy.php — same pattern on update()/delete()
• app/Policies/ServicePolicy.php — same pattern on update()/delete()
• app/Policies/EnvironmentVariablePolicy.php — update()/delete() just return true, no
  commented-out check at all

So today, any team member — regardless of role — has full write/delete access to every resource,
including secrets (EnvironmentVariablePolicy) and the server itself (ServerPolicy). Inviting
someone as member currently provides zero actual restriction.

Separately (not a blocker for this request, just context for why a network-level workaround isn't
a good substitute): the UI funnels essentially every interaction — including ones that are purely
informational, like loading logs/metrics/tabs — through one shared POST /livewire/update
endpoint, dispatched dynamically to whatever Livewire action the click maps to. That means there's
no way to approximate "read-only" by blocking a class of HTTP requests at a reverse proxy either;
doing so breaks nearly all interactivity, not just mutations.

Proposed solution

Re-enable the existing (currently commented-out) isAdmin()/role checks in the Policy classes so
the member role in team_user actually restricts write access to view-only, matching what the
UI/DB schema already imply. Concretely, for a member:

• view*/viewAny — keep allowing (this is the whole point of a viewer role)
• update/delete/deploy/manageDeployments/manageEnvironment/forceDelete — restrict to
  isAdmin() (or owner/admin), as the commented-out code already suggests was the original
  intent
• Same treatment for ServerPolicy, DatabasePolicy, ServicePolicy,
  EnvironmentVariablePolicy, and any other Policy following this pattern

This would let teams safely expose read access (dashboard status, logs, metrics) to more people —
auditors, other engineers, on-call viewers — without giving them the ability to redeploy, delete,
or read/rotate secrets, using infrastructure Coolify already has (the role column, the
isAdmin() helper, the Policy classes themselves) rather than requiring new plumbing.

Happy to help test this against a real multi-app Coolify instance if useful — we found this while
trying to safely expose our dashboard.

[coderabbitai[bot]]

🔗 Related PRs

#6884 - fix: critical privilege escalation in team invitation system [merged]
#7785 - fix(settings): fix 404 on /settings for root user on cloud [merged]
#9230 - refactor: scope server and project queries to current team [merged]
#10505 - fix(api): validate token team context [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[Cinzya]

Afaik this is already prepared for Coolify v4.2.0