Policies: scope to the owning team; editing restricted to team leaders (#6632)

app/saas/src/main/java/stirling/software/saas/security/TeamLeaderPolicyManagementAuthority.java

@@ -0,0 +1,32 @@
+package stirling.software.saas.security;
+
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Component;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.proprietary.policy.config.PolicyManagementAuthority;
+
+/**
+ * SaaS policy context: only the LEADER of the current user's team may edit policies, and every user
+ * is scoped to their own team. Replaces the self-hosted global-admin check, which is meaningless on
+ * SaaS (a single global admin exists for the whole deployment, never per-org) — and the admin gets
+ * no cross-team escape: scoping binds them like everyone else.
+ */
+@Component
+@Profile("saas")
+@RequiredArgsConstructor
+public class TeamLeaderPolicyManagementAuthority implements PolicyManagementAuthority {
+
+    private final TeamSecurityExpressions teamSecurity;
+
+    @Override
+    public boolean canEditPolicies() {
+        return teamSecurity.isCurrentUserTeamLeader();
+    }
+
+    @Override
+    public Long currentUserTeamId() {
+        return teamSecurity.currentUserTeamId();
+    }
+}

app/saas/src/main/java/stirling/software/saas/security/TeamSecurityExpressions.java

@@ -44,6 +44,27 @@ public class TeamSecurityExpressions {
                 .orElse(false);
     }
 
+    /** Whether the current authenticated user is a {@code LEADER} of their own team. */
+    public boolean isCurrentUserTeamLeader() {
+        User currentUser = getCurrentUser();
+        if (currentUser == null || currentUser.getTeam() == null) {
+            return false;
+        }
+        return membershipRepository
+                .findByTeamIdAndUserId(currentUser.getTeam().getId(), currentUser.getId())
+                .map(membership -> membership.getRole() == TeamRole.LEADER)
+                .orElse(false);
+    }
+
+    /** The current authenticated user's team id, or {@code null} if unauthenticated / teamless. */
+    public Long currentUserTeamId() {
+        User currentUser = getCurrentUser();
+        if (currentUser == null || currentUser.getTeam() == null) {
+            return null;
+        }
+        return currentUser.getTeam().getId();
+    }
+
     /** Whether the current authenticated user is any kind of member of the given team. */
     public boolean isTeamMember(Long teamId) {
         User currentUser = getCurrentUser();