fix(monitoring): gate host monitoring on docker access and let docker readers see disk usage

apps/dokploy/components/dashboard/search-command.tsx

@@ -60,6 +60,9 @@ export const SearchCommand = () => {
 		enabled: !!session,
 	});
 	const { data: isCloud } = api.settings.isCloud.useQuery();
+	const { data: permissions } = api.user.getPermissions.useQuery(undefined, {
+		enabled: !!session,
+	});
 
 	React.useEffect(() => {
 		const down = (e: KeyboardEvent) => {
@@ -183,14 +186,16 @@ export const SearchCommand = () => {
 						</CommandItem>
 						{!isCloud && (
 							<>
-								<CommandItem
-									onSelect={() => {
-										router.push("/dashboard/monitoring");
-										setOpen(false);
-									}}
-								>
-									Monitoring
-								</CommandItem>
+								{permissions?.monitoring.read && permissions?.docker.read && (
+									<CommandItem
+										onSelect={() => {
+											router.push("/dashboard/monitoring");
+											setOpen(false);
+										}}
+									>
+										Monitoring
+									</CommandItem>
+								)}
 								<CommandItem
 									onSelect={() => {
 										router.push("/dashboard/traefik");

apps/dokploy/components/layouts/side.tsx

@@ -192,9 +192,11 @@ const MENU: Menu = {
 			title: "Monitoring",
 			url: "/dashboard/monitoring",
 			icon: BarChartHorizontalBigIcon,
-			// Only enabled in non-cloud environments and if user has monitoring.read
+			// Host stats also need docker.read, which the stats socket requires
 			isEnabled: ({ isCloud, permissions }) =>
-				!isCloud && !!permissions?.monitoring.read,
+				!isCloud &&
+				!!permissions?.monitoring.read &&
+				!!permissions?.docker.read,
 		},
 		{
 			isSingle: true,

apps/dokploy/components/layouts/user-nav.tsx

@@ -87,14 +87,16 @@ export const UserNav = () => {
 					</DropdownMenuItem>
 					{!isCloud ? (
 						<>
-							<DropdownMenuItem
-								className="cursor-pointer"
-								onClick={() => {
-									router.push("/dashboard/monitoring");
-								}}
-							>
-								Monitoring
-							</DropdownMenuItem>
+							{permissions?.monitoring.read && permissions?.docker.read && (
+								<DropdownMenuItem
+									className="cursor-pointer"
+									onClick={() => {
+										router.push("/dashboard/monitoring");
+									}}
+								>
+									Monitoring
+								</DropdownMenuItem>
+							)}
 							{permissions?.traefikFiles.read && (
 								<DropdownMenuItem
 									className="cursor-pointer"

apps/dokploy/pages/dashboard/monitoring.tsx

@@ -109,13 +109,16 @@ export async function getServerSideProps(
 		};
 	}
 
-	const canView = await hasPermission(
-		{
-			user: { id: user.id },
-			session: { activeOrganizationId: session?.activeOrganizationId || "" },
-		},
-		{ monitoring: ["read"] },
-	);
+	const permissionCtx = {
+		user: { id: user.id },
+		session: { activeOrganizationId: session?.activeOrganizationId || "" },
+	};
+	// Host stats come from the docker stats socket, which requires docker.read.
+	// Checked separately because a member's "Access to Docker" is a legacy
+	// override that only applies when every requested resource has one.
+	const canView =
+		(await hasPermission(permissionCtx, { monitoring: ["read"] })) &&
+		(await hasPermission(permissionCtx, { docker: ["read"] }));
 
 	if (!canView) {
 		return {

apps/dokploy/server/api/routers/settings.ts

@@ -80,6 +80,7 @@ import {
 	enterpriseProcedure,
 	protectedProcedure,
 	publicProcedure,
+	withPermission,
 } from "../trpc";
 
 /**
@@ -284,7 +285,7 @@ export const settingsRouter = createTRPCRouter({
 		});
 		return true;
 	}),
-	getDockerDiskUsage: adminProcedure.query(async () => {
+	getDockerDiskUsage: withPermission("docker", "read").query(async () => {
 		if (IS_CLOUD) {
 			return [];
 		}