Merge remote-tracking branch 'origin/next' into automation/sync-main-to-next

app/Http/Controllers/Api/ApplicationsController.php

@@ -1326,8 +1326,6 @@ class ApplicationsController extends Controller
             return invalidTokenResponse();
         }
 
-        $this->authorize('create', Application::class);
-
         // removeUnnecessaryFieldsFromRequest() strips force_domain_override before the docker_compose_domains checks run.
         $forceDomainOverride = $request->boolean('force_domain_override');
 
@@ -1479,6 +1477,7 @@ class ApplicationsController extends Controller
         if (! $environment) {
             return response()->json(['message' => 'Environment not found.'], 404);
         }
+        $this->authorize('create', [Application::class, $environment]);
         $server = Server::whereTeamId($teamId)->whereUuid($serverUuid)->first();
         if (! $server) {
             return response()->json(['message' => 'Server not found.'], 404);
@@ -6153,6 +6152,7 @@ class ApplicationsController extends Controller
         }
 
         $this->authorize('update', $application);
+        $this->authorize('create', [Application::class, $application->environment]);
 
         if ($request->boolean('clone_volumes') && $response = $this->deployAbilityForbiddenResponse($request, 'Cloning volume data stops and starts the source resource, so it needs a token with the deploy permission.')) {
             return $response;