Andras Bacsai
aded45acbe
Merge remote-tracking branch 'origin/next' into feat/api/tag-management
2026-07-07 14:02:45 +02:00
Andras Bacsai
11b35ba3c1
feat(api): add tags to resource creation
...
Normalize tag names before attaching them, reject names that are too short
after sanitization, and return 404 when removing tags not attached to the
resource.
Adds a per-team unique tag-name index and migrates duplicate tags onto the
kept record before creating the constraint.
2026-07-07 13:56:33 +02:00
Andras Bacsai
ff976a134f
Merge remote-tracking branch 'origin/next' into api-sensitive-data-scrubber
2026-07-07 12:56:19 +02:00
Andras Bacsai
9a2c432c79
fix(api): expose sensitive fields for privileged tokens
...
Privileged API tokens can read hidden resource fields in environment and
resource responses, including instance-admin team tokens with team_id 0.
Configuration hashes now include hidden environment variable values so
secret edits trigger restart detection.
2026-07-07 12:53:34 +02:00
Andras Bacsai
f617e58401
Merge remote-tracking branch 'origin/next' into feat/api/tag-management
...
# Conflicts:
# app/Http/Controllers/Api/ApplicationsController.php
2026-07-07 12:49:19 +02:00
Andras Bacsai
00a3738ec7
Merge remote-tracking branch 'origin/next' into api-application-preview-deployments
2026-07-07 12:38:37 +02:00
Andras Bacsai
e9bef8443b
fix(api): hide nested server secrets in database responses
...
Prevent database detail responses from exposing log drain and Sentinel
settings when callers lack sensitive read access.
2026-07-07 12:34:09 +02:00
Andras Bacsai and GitHub
2caa5e67ff
fix(github): derive API URLs from GitHub HTML hosts ( #10610 )
2026-07-07 12:29:15 +02:00
Andras Bacsai
b50839d451
Merge remote-tracking branch 'origin/next' into fix/url-validator-underscore-hostnames
2026-07-07 12:24:32 +02:00
Andras Bacsai and GitHub
d01e3a9730
fix(parsers): populate docker_compose_domains for API-created Docker Compose apps ( #9300 )
2026-07-07 12:17:52 +02:00
Andras Bacsai and GitHub
d657c10df3
fix(api): allow source commit build setting ( #10551 )
2026-07-07 12:12:32 +02:00
Andras Bacsai
59b158381c
fix(api): preserve source commit flag until cleanup
2026-07-07 12:12:20 +02:00
Andras Bacsai and GitHub
6c42ca82cb
fix: only strip git_host from repository_url when git_host is github.com ( #10274 )
2026-07-07 12:11:45 +02:00
Andras Bacsai and GitHub
76a4c1484d
fix(deploy): cast force param as boolean to prevent cache bust on every deploy ( #9909 )
2026-07-07 12:08:29 +02:00
Andras Bacsai
6baabf9eda
fix(api): document source commit build option
2026-07-07 12:08:07 +02:00
Andras Bacsai
ff5cfd4253
fix(api): normalize log endpoint query handling
...
Clamp log line counts, parse timestamp flags consistently, and filter
service subcontainers by Coolify labels. Document log endpoint timestamp
parameters and database/service log routes in OpenAPI.
2026-07-06 23:58:12 +02:00
Andras Bacsai
adc4b3091f
Merge remote-tracking branch 'origin/next' into feat/database-service-logs-endpoint
2026-07-06 23:29:54 +02:00
Andras Bacsai
1adeed2a48
fix(github): preserve custom app API URLs
2026-07-03 12:01:16 +02:00
Andras Bacsai
e551f9c176
Merge remote-tracking branch 'origin/next' into fix/docker-compose-domains-api-9211
2026-07-03 11:32:41 +02:00
Andras Bacsai
29c122b31a
fix(api): return deployment UUID strings directly
2026-07-03 11:31:49 +02:00
Andras Bacsai
b5ba40b049
Merge remote-tracking branch 'origin/next' into fix/docker-compose-domains-api-9211
2026-07-03 10:26:19 +02:00
Andras Bacsai
b90380f542
Merge remote-tracking branch 'origin/next' into ghe-support-helpers
2026-07-03 10:15:29 +02:00
Andras Bacsai
c0866d4cb3
fix(auth): preserve invite login with database sessions
2026-07-03 09:38:05 +02:00
Andras Bacsai
eb56287b57
Merge remote-tracking branch 'origin/next' into 10633-invitation-link-redirect
2026-07-02 18:55:25 +02:00
Andras Bacsai
99f60228ad
fix(api): avoid lazy loading nested server secrets
2026-07-02 17:47:22 +02:00
Andras Bacsai
bbff70c8d0
fix: improve application URL handling
2026-07-02 16:52:07 +02:00
Andras Bacsai
13172849e1
Merge remote-tracking branch 'origin/next' into api-sensitive-data-scrubber
2026-07-02 15:57:43 +02:00
Andras Bacsai
6871160623
fix(api): gate sensitive storage and GitHub fields
...
Expose GitHub app secrets and file storage content only when the request has sensitive read access. Hide LocalFileVolume content by default and resolve application UUIDs from route parameters.
2026-07-02 15:50:43 +02:00
Andras Bacsai and GitHub
438eeefa73
feat(api): add REST endpoints for destinations ( #10405 )
2026-07-02 15:34:30 +02:00
Andras Bacsai
70021c8d5e
fix(api): handle destination create races as conflicts
2026-07-02 15:33:01 +02:00
Andras Bacsai
88d5aff018
Merge remote-tracking branch 'origin/next' into team-level-mcp-enablement
2026-07-02 15:15:11 +02:00
Andras Bacsai
4ef884e1ac
Merge remote-tracking branch 'origin/next' into feat/api-destinations
2026-07-02 15:14:13 +02:00
Andras Bacsai
a06c1a7bf5
Improve storage mount path handling
2026-07-02 14:54:38 +02:00
Andras Bacsai
a121386ab4
Merge branch 'next' into improve-resource-route-handling
2026-07-02 13:25:47 +02:00
Andras Bacsai
fb2d477e48
fix: improve team resource route handling
2026-07-02 13:05:27 +02:00
Julien Bouquillon and GitHub
77086e28af
Merge branch 'v4.x' into api-application-preview-deployments
2026-07-01 19:11:16 +02:00
Andras Bacsai
29445bf177
fix: align resource creation permissions
2026-06-29 15:57:17 +02:00
Andras Bacsai
7d65a4b496
Merge remote-tracking branch 'origin/next' into harden-database-import-files
2026-06-29 10:35:35 +02:00
Andras Bacsai
2d63d51237
fix: harden database backup imports
2026-06-29 10:27:01 +02:00
Andras Bacsai
3729b5c074
improve github webhook
2026-06-28 15:25:58 +02:00
Andras Bacsai
87d4744390
Validate environment variable keys
2026-06-25 18:19:58 +02:00
Andras Bacsai
bef94a9ce2
feat(mcp): add per-team server toggle
2026-06-25 11:42:19 +02:00
Andras Bacsai
9e021c4037
fix(api): enforce destination access and cleanup networks
...
Require admin team membership for destination mutations, return invalid-token
responses for tokenless requests, and remove standalone Docker networks when
deleting destinations.
2026-06-15 17:15:56 +02:00
Andras Bacsai
9665aa292c
fix(api): block invalid destination types and service deletions
2026-06-15 17:03:01 +02:00
Andras Bacsai
506643603c
Merge remote-tracking branch 'origin/next' into feat/api-destinations
2026-06-15 17:02:24 +02:00
Andras Bacsai
f5ecdfa4ce
Merge remote-tracking branch 'origin/next' into api-sensitive-data-scrubber
2026-06-15 13:29:25 +02:00
Osamaali313
74b1077010
fix: accept underscores in domain hostnames for API URL validation
...
PHP's FILTER_VALIDATE_URL rejects underscores in the host, so domains
like https://myapp_service.example.com were rejected by the API and
never got a Let's Encrypt certificate. Add an isValidDomainUrl() helper
that validates a copy with underscores replaced by hyphens, and route
domain validation in the Applications and Services API controllers
through it.
Fixes #10597
2026-06-13 22:46:04 +03:00
Andras Bacsai
78d7291929
fix(github): keep provided api_url on GitHub app updates
2026-06-12 19:56:13 +02:00
Andras Bacsai
4f509c02be
fix(auth): validate invitation magic link tokens
...
Accept invitation links across configured public origins while still
rejecting stored invitations whose token no longer matches.
2026-06-12 16:17:45 +02:00
Andras Bacsai
281184c040
fix(github): derive app API URLs from HTML hosts
...
Normalize GitHub organization values and derive API URLs for GitHub.com,
GHE.com, and enterprise hosts when creating or updating GitHub Apps.
2026-06-09 18:31:06 +02:00
Andras Bacsai