GitlabAppPolicy previously allowed any authenticated user to update,
delete, and create GitLab sources. Align it with GithubAppPolicy, require
Application create authorization on the private-repo wizard, and reject
OAuth callbacks from non-admins so members cannot escalate privileges.
Adds self-hosted GitLab OAuth sources so Coolify can connect to a self-managed GitLab instance, list private repositories, clone over an OAuth token, and deploy (the GitLab counterpart to GitHub Apps).
Hardening: authenticated, one-time team-bound OAuth callback state; token redaction in deploy logs; custom host port/path kept in clone and ls-remote URLs; submodule OAuth auth; system-wide source selection. Covered by unit and feature tests.
cosigned by OpenAI Codex at M1 Max
Andras Bacsai