feat: self-hosted GitLab Apps OAuth integration

Adds self-hosted GitLab OAuth sources so Coolify can connect to a self-managed GitLab instance, list private repositories, clone over an OAuth token, and deploy (the GitLab counterpart to GitHub Apps).

Hardening: authenticated, one-time team-bound OAuth callback state; token redaction in deploy logs; custom host port/path kept in clone and ls-remote URLs; submodule OAuth auth; system-wide source selection. Covered by unit and feature tests.

cosigned by OpenAI Codex at M1 Max

app/Http/Controllers/Webhook/Gitlab.php

@@ -6,10 +6,14 @@ use App\Actions\Application\CleanupPreviewDeployment;
 use App\Http\Controllers\Controller;
 use App\Http\Controllers\Webhook\Concerns\DetectsSkipDeployCommits;
 use App\Http\Controllers\Webhook\Concerns\MatchesManualWebhookApplications;
+use App\Livewire\Source\Gitlab\Change as GitlabSource;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
+use App\Models\GitlabApp;
 use Exception;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Str;
 
 class Gitlab extends Controller
@@ -17,6 +21,302 @@ class Gitlab extends Controller
     use DetectsSkipDeployCommits;
     use MatchesManualWebhookApplications;
 
+    public function redirect(Request $request)
+    {
+        try {
+            $code = $request->query('code');
+            $state = $request->query('state');
+
+            if (! $code || ! $state) {
+                return redirect()->route('source.all')->with('error', 'Invalid GitLab OAuth callback. Missing code or state.');
+            }
+
+            // Validate the one-time, team-bound state (not a guessable source UUID) to stop forged callbacks from overwriting a source's tokens.
+            $payload = Cache::pull(GitlabSource::oauthStateCacheKey($state));
+            $team_id = $request->user()?->currentTeam()?->id;
+            if (! is_array($payload) || is_null($team_id) || (int) data_get($payload, 'team_id') !== (int) $team_id) {
+                return redirect()->route('source.all')->with('error', 'Invalid or expired GitLab OAuth state. Please start the authorization again.');
+            }
+
+            $gitlabApp = GitlabApp::whereKey(data_get($payload, 'gitlab_app_id'))->firstOrFail();
+
+            $baseUrl = rtrim($gitlabApp->html_url, '/');
+
+            $response = Http::asForm()->post("{$baseUrl}/oauth/token", [
+                'client_id' => $gitlabApp->client_id,
+                'client_secret' => $gitlabApp->client_secret,
+                'code' => $code,
+                'grant_type' => 'authorization_code',
+                'redirect_uri' => $gitlabApp->redirect_uri,
+            ]);
+
+            if (! $response->successful()) {
+                $error = data_get($response->json(), 'error_description', 'Token exchange failed');
+
+                return redirect()->route('source.gitlab.show', ['gitlab_app_uuid' => $gitlabApp->uuid])
+                    ->with('error', "GitLab OAuth failed: {$error}");
+            }
+
+            $data = $response->json();
+            $gitlabApp->update([
+                'access_token' => $data['access_token'],
+                'refresh_token' => $data['refresh_token'],
+                'expires_at' => time() + ($data['expires_in'] ?? 7200),
+            ]);
+
+            return redirect()->route('source.gitlab.show', ['gitlab_app_uuid' => $gitlabApp->uuid]);
+        } catch (Exception $e) {
+            return redirect()->route('source.all')->with('error', $e->getMessage());
+        }
+    }
+
+    public function normal(Request $request)
+    {
+        try {
+            $return_payloads = collect([]);
+            $payload = $request->collect();
+            $x_gitlab_token = $request->header('X-Gitlab-Token');
+            $object_kind = data_get($payload, 'object_kind');
+            $project_id = data_get($payload, 'project.id');
+
+            $allowed_events = ['push', 'merge_request'];
+            if (! in_array($object_kind, $allowed_events)) {
+                return response([
+                    'status' => 'failed',
+                    'message' => 'Event not allowed. Only push and merge_request events are allowed.',
+                ]);
+            }
+
+            if (empty($x_gitlab_token)) {
+                auditLogWebhookFailure('gitlab', 'webhook_token_missing', [
+                    'event' => $object_kind,
+                ]);
+
+                return response([
+                    'status' => 'failed',
+                    'message' => 'Missing X-Gitlab-Token header.',
+                ], 401);
+            }
+
+            $gitlab_app = GitlabApp::where('webhook_token', $x_gitlab_token)->first();
+            if (! $gitlab_app) {
+                auditLogWebhookFailure('gitlab', 'invalid_token', [
+                    'event' => $object_kind,
+                ]);
+
+                return response([
+                    'status' => 'failed',
+                    'message' => 'Invalid webhook token.',
+                ], 401);
+            }
+
+            $applications = Application::where('source_id', $gitlab_app->id)
+                ->where('source_type', GitlabApp::class)
+                ->where('repository_project_id', $project_id);
+
+            if ($object_kind === 'push') {
+                $branch = data_get($payload, 'ref');
+                if (Str::isMatch('/refs\/heads\/*/', $branch)) {
+                    $branch = Str::after($branch, 'refs/heads/');
+                }
+                if (! $branch) {
+                    return response([
+                        'status' => 'failed',
+                        'message' => 'No branch found in the request.',
+                    ]);
+                }
+
+                $applications = $applications->where('git_branch', $branch)->get();
+                $added_files = data_get($payload, 'commits.*.added');
+                $removed_files = data_get($payload, 'commits.*.removed');
+                $modified_files = data_get($payload, 'commits.*.modified');
+                $changed_files = collect($added_files)->concat($removed_files)->concat($modified_files)->unique()->flatten();
+                $skip_deploy_commits = self::shouldSkipDeploy(data_get($payload, 'commits.*.message', []));
+
+                foreach ($applications as $application) {
+                    if (! $application->destination->server->isFunctional()) {
+                        $return_payloads->push([
+                            'application' => $application->name,
+                            'status' => 'failed',
+                            'message' => 'Server is not functional',
+                        ]);
+
+                        continue;
+                    }
+
+                    if (! $application->isDeployable()) {
+                        $return_payloads->push([
+                            'application' => $application->name,
+                            'status' => 'failed',
+                            'message' => 'Deployments disabled',
+                        ]);
+
+                        continue;
+                    }
+
+                    $is_watch_path_triggered = $application->isWatchPathsTriggered($changed_files);
+                    if (! $is_watch_path_triggered && ! blank($application->watch_paths)) {
+                        $return_payloads->push([
+                            'application' => $application->name,
+                            'status' => 'failed',
+                            'message' => 'Changed files do not match watch paths.',
+                        ]);
+
+                        continue;
+                    }
+
+                    if ($skip_deploy_commits) {
+                        $return_payloads->push([
+                            'application' => $application->name,
+                            'status' => 'skipped',
+                            'message' => 'All commits contain [skip cd] or [skip ci].',
+                        ]);
+
+                        continue;
+                    }
+
+                    $deployment_uuid = new Cuid2;
+                    $result = queue_application_deployment(
+                        application: $application,
+                        deployment_uuid: $deployment_uuid,
+                        commit: data_get($payload, 'after', 'HEAD'),
+                        force_rebuild: false,
+                        is_webhook: true,
+                    );
+
+                    if ($result['status'] === 'queue_full') {
+                        return response($result['message'], 429)->header('Retry-After', 60);
+                    }
+
+                    auditLog('webhook.deployment.queued', [
+                        'provider' => 'gitlab',
+                        'mode' => 'app',
+                        'application_uuid' => $application->uuid,
+                        'application_name' => $application->name,
+                        'deployment_uuid' => $deployment_uuid->toString(),
+                        'commit' => data_get($payload, 'after'),
+                    ]);
+
+                    $return_payloads->push([
+                        'application' => $application->name,
+                        'status' => $result['status'] ?? 'success',
+                        'message' => $result['message'] ?? 'Deployment queued.',
+                    ]);
+                }
+            }
+
+            if ($object_kind === 'merge_request') {
+                $action = data_get($payload, 'object_attributes.action');
+                $branch = data_get($payload, 'object_attributes.source_branch');
+                $base_branch = data_get($payload, 'object_attributes.target_branch');
+                $pull_request_id = data_get($payload, 'object_attributes.iid');
+                $pull_request_html_url = data_get($payload, 'object_attributes.url');
+                $pull_request_title = data_get($payload, 'object_attributes.title');
+                $latest_commit_message = data_get($payload, 'object_attributes.last_commit.message');
+                $skip_deploy_pr = self::shouldSkipDeployAny([$pull_request_title, $latest_commit_message]);
+
+                $applications = $applications->where('git_branch', $base_branch)->get();
+
+                foreach ($applications as $application) {
+                    if (! $application->destination->server->isFunctional()) {
+                        $return_payloads->push([
+                            'application' => $application->name,
+                            'status' => 'failed',
+                            'message' => 'Server is not functional',
+                        ]);
+
+                        continue;
+                    }
+
+                    if (in_array($action, ['open', 'opened', 'synchronize', 'reopened', 'reopen', 'update'])) {
+                        if (! $application->isPRDeployable()) {
+                            $return_payloads->push([
+                                'application' => $application->name,
+                                'status' => 'failed',
+                                'message' => 'Preview deployments disabled',
+                            ]);
+
+                            continue;
+                        }
+
+                        if ($skip_deploy_pr) {
+                            $return_payloads->push([
+                                'application' => $application->name,
+                                'status' => 'skipped',
+                                'message' => 'PR title or latest commit contains [skip cd] or [skip ci].',
+                            ]);
+
+                            continue;
+                        }
+
+                        $deployment_uuid = new Cuid2;
+                        $found = ApplicationPreview::where('application_id', $application->id)
+                            ->where('pull_request_id', $pull_request_id)
+                            ->first();
+
+                        if (! $found) {
+                            if ($application->build_pack === 'dockercompose') {
+                                $pr_app = ApplicationPreview::create([
+                                    'git_type' => 'gitlab',
+                                    'application_id' => $application->id,
+                                    'pull_request_id' => $pull_request_id,
+                                    'pull_request_html_url' => $pull_request_html_url,
+                                    'docker_compose_domains' => $application->docker_compose_domains,
+                                ]);
+                                $pr_app->generate_preview_fqdn_compose();
+                            } else {
+                                $pr_app = ApplicationPreview::create([
+                                    'git_type' => 'gitlab',
+                                    'application_id' => $application->id,
+                                    'pull_request_id' => $pull_request_id,
+                                    'pull_request_html_url' => $pull_request_html_url,
+                                ]);
+                                $pr_app->generate_preview_fqdn();
+                            }
+                        }
+
+                        $result = queue_application_deployment(
+                            application: $application,
+                            pull_request_id: $pull_request_id,
+                            deployment_uuid: $deployment_uuid,
+                            commit: data_get($payload, 'object_attributes.last_commit.id', 'HEAD'),
+                            force_rebuild: false,
+                            is_webhook: true,
+                            git_type: 'gitlab',
+                        );
+
+                        if ($result['status'] === 'queue_full') {
+                            return response($result['message'], 429)->header('Retry-After', 60);
+                        }
+
+                        $return_payloads->push([
+                            'application' => $application->name,
+                            'status' => $result['status'] ?? 'success',
+                            'message' => $result['message'] ?? 'Preview Deployment queued',
+                        ]);
+                    } elseif (in_array($action, ['closed', 'close', 'merge'])) {
+                        $found = ApplicationPreview::where('application_id', $application->id)
+                            ->where('pull_request_id', $pull_request_id)
+                            ->first();
+
+                        if ($found) {
+                            CleanupPreviewDeployment::run($application, $pull_request_id, $found);
+                            $return_payloads->push([
+                                'application' => $application->name,
+                                'status' => 'success',
+                                'message' => 'Preview deployment closed.',
+                            ]);
+                        }
+                    }
+                }
+            }
+
+            return response($return_payloads);
+        } catch (Exception $e) {
+            return handleError($e);
+        }
+    }
+
     public function manual(Request $request)
     {
         try {
@@ -291,8 +591,6 @@ class Gitlab extends Controller
                     } elseif ($action === 'closed' || $action === 'close' || $action === 'merge') {
                         $found = ApplicationPreview::where('application_id', $application->id)->where('pull_request_id', $pull_request_id)->first();
                         if ($found) {
-                            // Use comprehensive cleanup that cancels active deployments,
-                            // kills helper containers, and removes all PR containers
                             CleanupPreviewDeployment::run($application, $pull_request_id, $found);
 
                             $return_payloads->push([