feat(app/sources): UAC on sources (#2997)

Co-authored-by: Chaim Lev-Ari <chaim.lev-ari@portainer.io>
Co-authored-by: andres-portainer <91705312+andres-portainer@users.noreply.github.com>

api/stacks/stackbuilders/stack_git_builder.go

@@ -7,12 +7,14 @@ import (
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
 	"github.com/portainer/portainer/api/filesystem"
 	gittypes "github.com/portainer/portainer/api/git/types"
 	"github.com/portainer/portainer/api/gitops/workflows"
 	"github.com/portainer/portainer/api/scheduler"
 	"github.com/portainer/portainer/api/stacks/deployments"
 	"github.com/portainer/portainer/api/stacks/stackutils"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/ssrf"
 )
 
@@ -30,11 +32,28 @@ func (b *GitMethodStackBuilder) prepare(ctx context.Context, payload *StackPaylo
 		return err
 	}
 
+	var userContext *dataservices.SourceServiceUserContext
+	if err := b.dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		user, err := tx.User().Read(userID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to read user", err)
+		}
+		memberships, err := tx.TeamMembership().TeamMembershipsByUserID(userID)
+		if err != nil {
+			return httperror.InternalServerError("Unable to read user team memberships", err)
+		}
+
+		userContext = source.NewUserContext(user, memberships)
+		return nil
+	}); err != nil {
+		return err
+	}
+
 	var repoConfig gittypes.RepoConfig
 	var sourceID portainer.SourceID
 
 	if payload.SourceID != 0 {
-		src, err := b.dataStore.Source().Read(payload.SourceID)
+		src, err := b.dataStore.Source().Read(userContext, payload.SourceID)
 		if err != nil {
 			return fmt.Errorf("failed to read source: %w", err)
 		}
@@ -105,7 +124,7 @@ func (b *GitMethodStackBuilder) prepare(ctx context.Context, payload *StackPaylo
 		} else {
 			repoConfig.URL = gittypes.SanitizeURL(repoConfig.URL)
 
-			src, err := workflows.FindOrCreateGitSource(tx, &portainer.Source{
+			src, err := workflows.FindOrCreateGitSource(tx, userContext, &portainer.Source{
 				Name: gittypes.RepoName(repoConfig.URL),
 				Type: portainer.SourceTypeGit,
 				Git:  &repoConfig,