Andras Bacsai 8b7dbbafb2 fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens ...

Models now declare $hidden for passwords, tokens, db URLs, and compose
fields. API controllers flip from makeHidden-on-deny to makeVisible-on-
allow (can_read_sensitive=true), fixing fields that were never hidden.
Also adds missing fields (mysql/mariadb passwords, logdrain keys, etc.)
to privileged disclosure lists.

Tests added: Feature/Security/ApiSensitiveFieldsTest and
Unit/Models/SensitiveFieldsHiddenTest cover all affected models and
controllers.

2026-04-30 11:28:06 +02:00

..

Actions

refactor(database): escape postgres_user in SSL chown command

2026-04-20 21:41:48 +02:00

Console

feat(security): support expiration on API tokens with warning notifications

2026-04-20 14:28:38 +02:00

Contracts

…

Data

refactor: simplify remote process chain and harden ActivityMonitor

2026-03-26 13:26:16 +01:00

Enums

…

Events

…

Exceptions

feat(observability): add structured audit log channel for API and webhook events

2026-04-28 14:50:37 +02:00

Helpers

feat(server): add configurable SSH connection timeout per server

2026-04-28 15:39:36 +02:00

Http

fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens

2026-04-30 11:28:06 +02:00

Jobs

feat(webhook): skip deployment on [skip ci]/[skip cd] commit markers

2026-04-29 09:12:24 +02:00

Listeners

…

Livewire

feat(mcp): add MCP server with read-only tools for Coolify resources

2026-04-29 10:30:43 +02:00

Mcp

feat(mcp): add MCP server with read-only tools for Coolify resources

2026-04-29 10:30:43 +02:00

Models

fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens

2026-04-30 11:28:06 +02:00

Notifications

feat(security): support expiration on API tokens with warning notifications

2026-04-20 14:28:38 +02:00

Policies

chore: prepare for PR

2026-02-25 11:18:46 +01:00

Providers

refactor(api): validate and throttle feedback endpoint

2026-04-19 14:41:47 +02:00

Repositories

…

Rules

refactor(storage): tighten S3 endpoint URL validation

2026-04-20 11:50:19 +02:00

Services

refactor: remove verbose logging and use explicit exception types

2026-03-20 15:57:26 +01:00

Support

refactor(validation): tokenize shell-safe command pattern

2026-04-20 22:00:41 +02:00

Traits

feat(security): support expiration on API tokens with warning notifications

2026-04-20 14:28:38 +02:00

View/Components

feat(forms): make textarea monospace opt-in and improve multiline toggle

2026-03-31 15:37:42 +02:00