Server Policy: Only do owner check if checking for subuser permissions (#1521)

app/Http/Controllers/Api/Client/Servers/SubuserController.php

@@ -138,15 +138,7 @@ class SubuserController extends ClientApiController
      */
     protected function getDefaultPermissions(Request $request): array
     {
-        $allowed = Permission::permissions()
-            ->map(function ($value, $prefix) {
-                return array_map(function ($value) use ($prefix) {
-                    return "$prefix.$value";
-                }, array_keys($value['keys']));
-            })
-            ->flatten()
-            ->all();
-
+        $allowed = Permission::permissionKeys()->all();
         $cleaned = array_intersect($request->input('permissions') ?? [], $allowed);
 
         return array_unique(array_merge($cleaned, [Permission::ACTION_WEBSOCKET_CONNECT]));

app/Http/Requests/Api/Client/Servers/SendPowerRequest.php

@@ -22,7 +22,8 @@ class SendPowerRequest extends ClientApiRequest
                 return Permission::ACTION_CONTROL_RESTART;
         }
 
-        return '__invalid';
+        // Fallback for invalid signals
+        return Permission::ACTION_WEBSOCKET_CONNECT;
     }
 
     /**