Files
coolify/tests/Feature/Subscription
Andras Bacsai 3987f97a8e fix(subscription): require team admin for billing actions
Subscription actions ran on the session team without a role check. A user
who switched the session to a team where they are only a member could
cancel, refund, or change that team's subscription.

- Lock the team id at mount and require admin or owner of that team
- Check the locked team and the role again in every billing action
- Reject actions after the session switched to another team
2026-10-05 17:04:05 +02:00
..