{"record":{"id":"f01a02793a22ab3f","repo":"coollabsio/coolify","slug":"destination-does-not-belong-to-the-current-team","errorCode":null,"errorMessage":"Destination does not belong to the current team.","messagePattern":"Destination does not belong to the current team\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"bootstrap/helpers/applications.php","lineNumber":198,"sourceCode":"                        'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,\n                    ]);\n\n                    ApplicationDeploymentJob::dispatch(\n                        application_deployment_queue_id: $next->id,\n                    );\n                }\n            }\n        }\n    }\n}\n\nfunction clone_application(Application $source, $destination, array $overrides = [], bool $cloneVolumeData = false): Application\n{\n    $uuid = $overrides['uuid'] ?? new_public_id();\n    $server = $destination->server;\n\n    if ($server->team_id !== currentTeam()->id) {\n        throw new RuntimeException('Destination does not belong to the current team.');\n    }\n\n    // Prepare name and URL\n    $name = $overrides['name'] ?? 'clone-of-'.str($source->name)->limit(20).'-'.$uuid;\n    $applicationSettings = $source->settings;\n    $url = $overrides['fqdn'] ?? $source->fqdn;\n\n    if ($server->proxyType() !== 'NONE' && $applicationSettings->is_container_label_readonly_enabled === true) {\n        $url = generateUrl(server: $server, random: $uuid);\n    }\n\n    // Clone the application\n    $newApplication = $source->replicate([\n        'id',\n        'created_at',\n        'updated_at',\n        'additional_servers_count',\n        'additional_networks_count',","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/coollabsio/coolify/blob/70b9acc42467278373e00de77abb40684e25b395/bootstrap/helpers/applications.php#L180-L216","documentation":"clone_application() in bootstrap/helpers/applications.php clones an application into a destination (a StandaloneDocker/SwarmDocker network). Before copying anything it resolves $destination->server and verifies the server's team_id equals currentTeam()->id; on mismatch it throws RuntimeException 'Destination does not belong to the current team.'. This is a multi-tenancy guard: a destination uuid alone is never sufficient authorization.","triggerScenarios":"Calling clone_application() with a destination whose server belongs to another team (e.g. a uuid pasted from another team's server); the active team being switched in another browser tab so currentTeam()->id no longer matches the destination used by the UI; API callers reusing one team's destination uuid while authenticated against a different team.","commonSituations":"Multi-team Coolify instances where a user belongs to two teams and the destination picker shows stale data after switching teams; automation that hardcodes a destination uuid regardless of the authenticated team.","solutions":["Switch your active team to the team that owns the destination server, then retry the clone.","Or pick a destination (docker network) that belongs to your current team.","Verify before calling: compare $destination->server->team_id against currentTeam()->id.","If you own both teams, move or recreate the destination under the correct team instead of bypassing the check."],"exampleFix":"// before\n$destination = StandaloneDocker::whereUuid($uuid)->firstOrFail();\n$clone = clone_application($application, $destination); // RuntimeException\n// after: scope the lookup to the current team's servers\n$destination = StandaloneDocker::whereUuid($uuid)\n    ->whereHas('server', fn ($q) => $q->where('team_id', currentTeam()->id))\n    ->firstOrFail();\n$clone = clone_application($application, $destination);","handlingStrategy":"validation","validationCode":"use App\\Models\\StandaloneDocker;\n\n$destination = StandaloneDocker::whereUuid($uuid)\n    ->whereHas('server', fn ($q) => $q->where('team_id', currentTeam()->id))\n    ->first();\n\nif (! $destination) {\n    abort(403, 'Pick a destination owned by your current team.');\n}","typeGuard":"function destinationBelongsToCurrentTeam(StandaloneDocker|SwarmDocker $destination): bool\n{\n    return (int) $destination->server->team_id === (int) currentTeam()->id;\n}","tryCatchPattern":"try {\n    $clone = clone_application($application, $destination);\n} catch (\\RuntimeException $e) {\n    if (str_contains($e->getMessage(), 'Destination does not belong')) {\n        // surface a friendly 'switch team' prompt\n    }\n    throw $e;\n}","preventionTips":["Scope all destination pickers/queries by server.team_id = current team","Re-derive currentTeam() server-side at request start; never trust client-stored team ids","Treat uuids as opaque identifiers, never as authorization"],"tags":["clone","teams","multi-tenancy","authorization","destination"],"backgroundTag":"cross-team-authorization","analyzedSha":"70b9acc42467278373e00de77abb40684e25b395","analyzedAt":"2026-08-17T01:41:01.313Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}