Andras Bacsai a165e03d06 fix(service-apps): harden updates and docker commands ...

Escape service application lifecycle command arguments for deploy, restart, stop, and log status checks.
Validate API update payloads from JSON/form data before applying allowed fields, preserving explicit boolean and null values.
Add coverage for service application API authorization, team isolation, validation, and command escaping.

2026-07-07 15:10:24 +02:00

..

Api

fix(hetzner): require at least one public IP protocol

2026-07-07 14:41:17 +02:00

Application

fix(github): preserve custom app API URLs

2026-07-03 12:01:16 +02:00

Auth

test: refresh api and job feature suites

2026-02-26 08:37:20 +01:00

Authorization

Merge remote-tracking branch 'origin/next' into team-level-mcp-enablement

2026-07-02 15:15:11 +02:00

EnvironmentVariable

fix(ray): remove Ray debug hooks from runtime (#10847)

2026-07-03 11:40:20 +02:00

Helpers

Merge remote-tracking branch 'origin/next' into audit-policies

2026-06-04 10:18:54 +02:00

Jobs

fix: improve s3 storage handling

2026-07-02 15:05:05 +02:00

Livewire

fix(security): validate application domains safely

2026-07-02 17:47:04 +02:00

LogDrain

fix(log-drain): connect drain to service networks

2026-06-02 14:33:57 +02:00

Mcp

feat(mcp): add per-team server toggle

2026-06-25 11:42:19 +02:00

Proxy

Merge remote-tracking branch 'origin/next' into harden-database-import-files

2026-06-29 10:35:35 +02:00

Security

fix(service-apps): harden updates and docker commands

2026-07-07 15:10:24 +02:00

Server

fix(hetzner): require at least one public IP protocol

2026-07-07 14:41:17 +02:00

Service

Merge remote-tracking branch 'origin/next' into audit-policies

2026-04-19 15:19:37 +02:00

Subscription

fix(subscription): clamp dynamic quantity to MIN_SERVER_LIMIT on update

2026-06-19 08:27:41 +02:00

Team

Merge remote-tracking branch 'origin/next' into 10633-invitation-link-redirect

2026-07-02 18:55:25 +02:00

Webhook

improve github webhook

2026-06-28 15:25:58 +02:00

ActivityMonitorCrossTeamTest.php

refactor: simplify remote process chain and harden ActivityMonitor

2026-03-26 13:26:16 +01:00

AdminAccessAuthorizationTest.php

refactor(admin): use named routes for admin index navigation

2026-04-19 11:58:52 +02:00

ApiApplicationDeploymentActionsTest.php

fix(api): return deployment UUID strings directly

2026-07-03 11:31:49 +02:00

ApiTokenExpirationTest.php

feat(security): support expiration on API tokens with warning notifications

2026-04-20 14:28:38 +02:00

ApiTokenExpirationWarningTest.php

fix(api-tokens): mark expiration warning after notification

2026-05-13 10:28:32 +02:00

ApiTokenLivewireAuthorizationTest.php

Harden token permission handling

2026-05-22 13:12:17 +02:00

ApiTokenTeamLifecycleSecurityTest.php

fix(tests): reuse instance settings in API token team tests

2026-06-02 11:05:51 +02:00

ApplicationConfigurationChangedTest.php

fix(ui): configuration changes modal values, colors and spacing

2026-05-22 21:22:50 +05:30

ApplicationCustomNginxConfigurationApiTest.php

fix(applications): store custom nginx config from API correctly

2026-05-11 22:22:01 +02:00

ApplicationDeploymentControlVarFilteringTest.php

fix(deployments): filter generated compose service env vars

2026-05-13 11:59:45 +02:00

ApplicationDockerRegistryImageValidationApiTest.php

fix(applications): harden image validation

2026-06-02 11:11:33 +02:00

ApplicationGeneralBuildpackSelectorTest.php

feat(deployments): track application configuration diffs

2026-05-13 09:58:58 +02:00

ApplicationParserDockerComposeDomainsTest.php

fix(parser): populate compose domains from service env keys

2026-07-03 11:57:02 +02:00

ApplicationPreviewApiTest.php

feat(applications): add DELETE endpoint for preview deployments by PR id

2026-04-17 13:29:11 +02:00

ApplicationPreviewDeploymentsApiTest.php

feat(api): allow preview deployments on app create

2026-07-07 12:36:35 +02:00

ApplicationPreviewImageNameTest.php

fix(deployment): avoid shared preview tags for HEAD commits

2026-05-11 22:11:08 +02:00

ApplicationPublicApiGitRepositoryTest.php

test(api): cover public git repository URL storage

2026-07-07 12:10:38 +02:00

ApplicationRailpackTest.php

refactor(railpack): extract static image build, fix port logic, bump to v0.22.0

2026-03-23 19:02:10 +00:00

ApplicationRedirectTest.php

fix(application): persist redirect value in setRedirect

2026-03-29 20:50:03 +02:00

ApplicationRollbackTest.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

ApplicationSeederTest.php

fix(ui): prevent persisted sidebar restore animation

2026-06-02 11:54:38 +02:00

ApplicationServerStatusBadgeTest.php

fix(application): only show server warning for false status

2026-05-28 20:50:14 +02:00

ApplicationSourceCrossTeamTest.php

fix(source): scope private key and source selection to current team

2026-05-22 12:30:00 +02:00

ApplicationSourceLocalhostKeyTest.php

fix(applications): refresh pending configuration changes

2026-05-13 10:04:17 +02:00

ApplicationStoppedAfterRestartLimitTest.php

feat(application): preserve crash restart limit status

2026-06-03 11:01:28 +02:00

BackupEditValidationTest.php

fix(backups): default S3 storage for backup schedules

2026-07-02 12:47:54 +02:00

BackupRetentionAndStaleDetectionTest.php

fix(backups): enforce retention and clean up stale executions

2026-04-03 11:33:21 +02:00

BreadcrumbsVisibilityTest.php

fix(ui): improve responsive project headings and controls

2026-04-09 19:51:31 +02:00

CleanupUnreachableServersTest.php

fix(cleanup): disable unreachable self-hosted servers

2026-05-31 21:47:18 +02:00

CleanupUnsubscribedServersTest.php

fix(team): mark servers unreachable when subscription ends

2026-04-15 15:12:29 +02:00

ClonePersistentVolumeUuidTest.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

ComposePreviewFqdnTest.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

CreateScheduledBackupValidationTest.php

fix(backups): revalidate S3 storage on scheduled backup submit

2026-05-23 21:06:22 +02:00

CrossTeamDestinationAttachTest.php

chore: inspect commit message guidance

2026-05-27 07:14:54 +02:00

CrossTeamIdorLogsTest.php

Squashed commit from '565g-9j4m-wqmr-cross-team-idor-logs-fix'

2026-03-10 22:11:52 +01:00

CrossTeamIdorServerProjectTest.php

test: remove GHSA advisory IDs from test descriptions and comments

2026-04-20 12:07:42 +02:00

DatabaseBackupUploadValidationTest.php

fix: harden database backup imports

2026-06-29 10:27:01 +02:00

DatabaseConfigHashEnvValueTest.php

fix(api): expose sensitive fields for privileged tokens

2026-07-07 12:53:34 +02:00

DatabaseEnvironmentVariableApiTest.php

Validate environment variable keys

2026-06-25 18:19:58 +02:00

DatabaseHealthCheckTest.php

fix(database): honor disabled standalone health checks

2026-06-01 08:55:03 +02:00

DatabaseImportCommandInjectionTest.php

fix(database): quote S3 restore temp paths

2026-05-29 12:27:33 +02:00

DatabaseImportFormAuthorizationTest.php

fix(database): gate import form controls by update access

2026-05-28 20:48:18 +02:00

DatabasePublicPortTimeoutApiTest.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

DatabaseReplicaConfigTest.php

feat(sentinel): deduplicate metrics push processing

2026-05-22 12:48:48 +02:00

DatabaseSslStatusRefreshTest.php

refactor(database): split import form into Livewire child

2026-05-28 19:30:12 +02:00

DeleteEnvironmentTeamScopingTest.php

fix(environment): scope DeleteEnvironment lookups to current team

2026-05-22 12:37:48 +02:00

DeploymentByUuidApiTest.php

fix(api): cast teamId to int in deployment authorization check

2026-03-12 13:25:10 +01:00

DeploymentCommandContainerResolutionTest.php

refactor(jobs): extract container resolution logic for deployment commands

2026-03-25 14:09:07 +01:00

DeploymentLogScrollTest.php

fix(deployment): unregister Livewire morph hook on teardown

2026-05-26 14:57:20 +02:00

DeploymentLogsLayoutTest.php

fix(deployments): use full-height deployment logs layout

2026-04-09 19:27:19 +02:00

DeploymentsIndicatorLayoutTest.php

fix(ui): align deployment indicator with collapsed sidebar

2026-05-11 16:25:15 +02:00

DeprecatedDockerComposeApplicationEndpointTest.php

fix(api): remove deprecated docker compose application endpoint

2026-05-11 13:20:05 +02:00

DevelopmentRailpackExamplesSeederTest.php

feat(dev): add Lima testing server fixtures (#10844)

2026-07-03 10:07:55 +02:00

DevHelperVersionValidationTest.php

refactor(settings): validate dev_helper_version and escape build args

2026-04-20 11:51:27 +02:00

DockerCleanupJobTest.php

feat(deployments): support Docker image tags for preview deployments

2026-03-30 13:35:35 +02:00

DockerImagePreviewDeploymentApiTest.php

feat(deployments): support Docker image tags for preview deployments

2026-03-30 13:35:35 +02:00

EmailChangeVerificationTest.php

refactor: use random_int() for email change verification codes

2026-03-28 12:25:54 +01:00

EmailVerificationHashTest.php

refactor(auth): upgrade email verification hash to sha256

2026-04-20 12:09:48 +02:00

EnvironmentVariableBulkCommentApiTest.php

feat(api): support comments in bulk environment variable endpoints

2026-03-19 22:17:55 +01:00

EnvironmentVariableCommentTest.php

fix: update success message logic to only show when changes are made

2025-12-27 15:24:09 +01:00

EnvironmentVariableKeyValidationTest.php

fix(env): validate Docker-compatible variable keys

2026-05-11 15:43:09 +02:00

EnvironmentVariableMassAssignmentTest.php

refactor: add explicit fillable array to EnvironmentVariable model

2025-12-27 15:24:09 +01:00

EnvironmentVariableMultilineToggleViewTest.php

fix(env-vars): treat search wildcards literally

2026-06-03 13:43:26 +02:00

EnvironmentVariableSearchTest.php

fix(env-vars): avoid service preview variable lookups (#10837)

2026-07-02 17:39:16 +02:00

EnvironmentVariableValueCastingTest.php

fix(env): preserve empty service variable values (#10850)

2026-07-03 20:47:18 +02:00

FeedbackEndpointTest.php

refactor(api): validate and throttle feedback endpoint

2026-04-19 14:41:47 +02:00

FileStorageMountPathTest.php

Improve storage mount path handling

2026-07-02 14:54:38 +02:00

FileStorageParserStateTest.php

fix(parser): preserve file volume state (#10843)

2026-07-03 10:14:39 +02:00

GenerateApplicationNameTest.php

feat(storage): add storage endpoints and UUID support for databases and services

2026-03-23 15:15:02 +01:00

GetLogsCommandInjectionTest.php

fix(logs): keep stream polling active without collapsible panel

2026-05-22 17:00:08 +02:00

GitHttpTransportCommandsTest.php

fix(git): apply HTTP transport config to PR checkouts

2026-06-03 12:59:45 +02:00

GithubPrivateRepositoryTest.php

fix(github): allow system-wide private apps across teams

2026-05-26 17:36:02 +02:00

GithubWebhookTest.php

fix(github-webhook): handle unsupported event types gracefully

2026-03-23 21:33:40 +01:00

InternalModelCreationMassAssignmentTest.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

InvitationLinkHandlingTest.php

fix(auth): preserve invite login with database sessions

2026-07-03 09:38:05 +02:00

LinkLoginEmailVerificationTest.php

fix(auth): bind magic links to their invitation

2026-06-02 12:57:30 +02:00

LogClipboardHandlerTest.php

Merge remote-tracking branch 'origin/next' into fix/clipboard-https-secure-context

2026-06-03 11:38:47 +02:00

LogFontStylingTest.php

fix(logs): constrain activity monitor output width

2026-06-12 16:06:20 +02:00

MassAssignmentProtectionTest.php

refactor(models): add fillable attributes for database configuration options

2026-03-30 08:11:23 +02:00

MobileResourceMenuTest.php

feat(project): add mobile action controls for resources

2026-06-12 16:09:26 +02:00

ModelFillableCreationTest.php

feat(applications): add configurable stop grace period

2026-05-11 23:43:53 +02:00

MutableLivewireComponentsAuthorizationTest.php

fix(security): enforce team access on mutable actions

2026-06-04 11:03:06 +02:00

NavigationCloakTest.php

fix(navigation): strip stale x-cloak after Livewire navigation

2026-06-02 17:00:55 +02:00

NewApplicationBuildpackDefaultsTest.php

feat(deployments): track application configuration diffs

2026-05-13 09:58:58 +02:00

OauthControllerTest.php

Merge remote-tracking branch 'origin/next' into jean/port-exposes-improvement

2026-06-03 10:32:57 +02:00

PasswordVisibilityComponentTest.php

fix(forms): focus password fields before visibility toggles

2026-06-02 17:09:14 +02:00

PostgresUpgradeScriptTest.php

fix(postgres): preserve Coolify image tag during upgrade

2026-06-03 14:54:23 +02:00

PreviewEnvVarFallbackTest.php

feat(preview-env): add production variable fallback for docker-compose

2026-03-25 13:26:50 +01:00

ProcessGithubPullRequestWebhookTest.php

Merge remote-tracking branch 'origin/next' into api-sensitive-data-scrubber

2026-06-15 12:30:15 +02:00

ProductionSeederTest.php

fix(seeding): ensure root user joins root team

2026-05-26 17:05:54 +02:00

ProfileAppearanceNavigationTest.php

feat(profile): add appearance preferences page

2026-05-29 13:59:01 +02:00

ProjectIndexEmptyStateTest.php

chore: inspect staged changes for commit message

2026-06-04 15:24:53 +02:00

ProjectSeederTest.php

feat(dev): add Lima testing server fixtures (#10844)

2026-07-03 10:07:55 +02:00

PublicGitRepositoryBranchParsingTest.php

fix(project): handle slash branches in public repo URLs

2026-04-01 09:11:56 +02:00

PullChangelogTest.php

fix(changelog): use configurable GitHub releases source

2026-05-22 18:39:37 +02:00

PushServerUpdateJobLastOnlineTest.php

fix(sentinel): reduce resource churn from health flaps

2026-05-27 16:48:38 +02:00

PushServerUpdateJobOptimizationTest.php

fix(storage): clear stale disk usage cache

2026-05-26 14:45:49 +02:00

QueryDatabaseByUuidWithinTeamTest.php

refactor(helpers): extract STANDALONE_DATABASE_MODELS registry, add tests

2026-04-30 14:48:48 +02:00

QueueApplicationDeploymentCommitTest.php

fix(deployments): resolve commit from app git_commit_sha when not explicitly set

2026-04-29 10:59:32 +02:00

QueueRoutingTest.php

fix(queue): route scheduled jobs through crons helper

2026-05-22 16:26:15 +02:00

RealtimeTerminalPackagingTest.php

fix(terminal): exit fullscreen when PTY exits

2026-06-01 10:21:30 +02:00

ResetPasswordUrlTest.php

refactor: simplify TrustHosts middleware and use APP_URL as base_url fallback

2026-03-28 12:12:48 +01:00

ResourceDetailsVisibilityTest.php

feat(resource-details): make copy fields visible and accessible

2026-06-15 13:17:53 +02:00

ResourcePermissionCalloutTest.php

fix(ui): standardize permission denial callouts

2026-06-04 11:37:16 +02:00

ResponsiveCheckboxLayoutTest.php

test: align mobile application actions expectations

2026-06-15 12:06:54 +02:00

S3StoragePolicyRegistrationTest.php

fix(auth): restrict Sentinel access and register S3 policy

2026-06-15 12:31:30 +02:00

ScheduledJobManagerDispatchTest.php

fix(crons): dispatch due schedules across chunks

2026-05-27 16:35:41 +02:00

ScheduledJobManagerShouldRunNowTest.php

refactor(scheduler): extract cron scheduling logic to shared helper

2026-03-23 10:37:49 +01:00

ScheduledLogsCommandInputTest.php

refactor(cli): validate --date and escape shell args on logs:scheduled

2026-04-20 12:09:48 +02:00

ScheduledTaskServerTest.php

refactor(scheduled-task): simplify server() with nullsafe operators and add return type

2026-05-04 12:26:15 +02:00

ScheduleOnOneServerTest.php

chore: inspect staged changes

2026-06-02 14:05:26 +02:00

SecureCookieAutoDetectionTest.php

fix(subscription): harden quantity updates and proxy trust behavior

2026-03-03 12:28:16 +01:00

SentinelPushDeduplicationTest.php

fix(security): enforce team access on mutable actions

2026-06-04 11:03:06 +02:00

SentinelTokenValidationTest.php

feat(sentinel): embed server UUID in encrypted sentinel token

2026-04-30 08:21:30 +02:00

ServerConnectionTimeoutApiTest.php

test(api): add feature tests for server connection_timeout API

2026-04-28 22:20:15 +02:00

ServerConnectionTimeoutTest.php

feat(server): add configurable SSH connection timeout per server

2026-04-28 15:39:36 +02:00

ServerDestinationsPageTest.php

fix(destinations): handle empty and server-scoped destinations

2026-05-19 12:50:08 +02:00

ServerLimaStartCommandTest.php

feat(dev): add Lima testing server fixtures (#10844)

2026-07-03 10:07:55 +02:00

ServerLimitCheckJobTest.php

fix(server-limit): re-enable force-disabled servers at limit

2026-03-03 17:03:59 +01:00

ServerManagerJobShouldRunNowTest.php

refactor(scheduler): extract cron scheduling logic to shared helper

2026-03-23 10:37:49 +01:00

ServerMetadataTest.php

feat(server): auto-fetch server metadata after validation

2026-03-13 17:07:50 +01:00

ServerNavbarStatusLayoutTest.php

feat(status): unify resource status badges

2026-06-05 13:31:20 +02:00

ServerNavbarStatusVisibilityTest.php

fix(server): hide sentinel status before validation

2026-07-03 10:08:55 +02:00

ServerReachabilityNotificationTest.php

refactor(server): dispatch event for reachability notifications, drop retry loop

2026-04-28 15:28:22 +02:00

ServerSeederTest.php

feat(dev): add Lima testing server fixtures (#10844)

2026-07-03 10:07:55 +02:00

ServerUpdatePrivateKeyApiTest.php

fix(api): allow disabling build server mode

2026-06-03 13:48:31 +02:00

ServerUsernameValidationTest.php

fix(server): return SSH username validation messages

2026-06-03 11:57:46 +02:00

ServerValidationXssTest.php

fix: sanitize error output in server validation logs

2026-03-26 18:36:36 +01:00

ServiceApplicationsApiTest.php

fix(service-apps): harden updates and docker commands

2026-07-07 15:10:24 +02:00

ServiceContainerLabelEscapeApiTest.php

feat(service): add container label escape control to services API

2026-03-13 13:32:58 +01:00

ServiceExtraFieldsTest.php

fix(service): limit Grafana extra fields to Grafana images

2026-06-05 14:29:29 -06:00

ServiceMagicVariableOverwriteTest.php

test(magic-variables): add feature tests for SERVICE_URL/FQDN variable handling

2026-03-11 17:15:17 +01:00

ServiceResourceRoutingTest.php

Refine service resource routing

2026-05-22 13:39:26 +02:00

ServiceTemplateGitTimestampTest.php

chore: inspect staged changes for commit message

2026-06-04 15:24:53 +02:00

ServiceTemplatesLastUpdatedHintTest.php

fix(services): preserve template keys for selection

2026-07-02 17:16:40 +02:00

SettingsDropdownTest.php

fix(service): defer stop when pulling latest images

2026-05-31 21:19:18 +02:00

SettingsUpdatesAuthorizationTest.php

feat(registry): add configurable docker registry url (#9017)

2026-07-02 18:52:46 +02:00

SharedVariableComposeResolutionTest.php

fix(parsers): resolve shared variables in compose environment

2026-03-12 13:23:13 +01:00

SharedVariableDevViewTest.php

fix(shared-variables): support direct mount params and comment field for server variables

2026-03-31 14:58:01 +02:00

SidebarNavigationMarkupTest.php

fix(ui): prevent persisted sidebar restore animation

2026-06-02 11:54:38 +02:00

SidebarNavigationPreferencesTest.php

fix(sidebar): center unread badge in settings menu

2026-07-02 12:35:28 +02:00

SshMultiplexingLockTest.php

chore: inspect staged changes

2026-06-02 14:05:26 +02:00

SslCertificateRegenerationTest.php

fix(database): auto-generate missing CA cert on SSL regeneration

2026-03-30 13:10:49 +02:00

StandaloneDockerDatabasesTest.php

fix(standalone-docker): include keydb, dragonfly, clickhouse in databases()

2026-04-30 15:01:48 +02:00

StatusBadgeComponentsTest.php

feat(resources): add responsive mobile navigation menus

2026-06-05 14:57:57 +02:00

StorageApiTest.php

Merge remote-tracking branch 'origin/next' into api-sensitive-data-scrubber

2026-07-02 15:57:43 +02:00

SuppressHorizonJobFailuresTest.php

feat(horizon): suppress failed job entries for deployment/timeout errors on cloud

2026-04-29 15:40:01 +02:00

SyncBunnyTest.php

feat(postgres): add internal database upgrade script

2026-06-03 14:27:01 +02:00

TagApiTest.php

feat(api): add tags to resource creation

2026-07-07 13:56:33 +02:00

TeamInvitationCsrfProtectionTest.php

refactor: split invitation endpoint into GET (show) and POST (accept)

2026-03-26 14:30:27 +01:00

TeamScopedBackupStorageTest.php

refactor: scope destination and resource lookups by current team

2026-04-19 11:55:12 +02:00

TeamScopedDestinationTest.php

feat(destinations): split Docker resources into separate page

2026-06-03 11:24:36 +02:00

TeamScopedResourceProofsTest.php

refactor: scope destination and resource lookups by current team

2026-04-19 11:55:12 +02:00

TeamServerLimitTest.php

refactor(team): make server limit methods accept optional team parameter

2026-03-23 21:56:50 +01:00

TerminalAuthIpsRouteTest.php

chore: prepare for PR

2026-03-10 20:37:22 +01:00

TerminalAuthRoutesAuthorizationTest.php

fix(terminal): apply authorization middleware to terminal bootstrap routes

2026-03-25 16:56:37 +01:00

UpgradeComponentTest.php

fix(upgrade): hide upgrade labels in collapsed sidebar

2026-06-15 12:56:19 +02:00

UserDeletionWithGithubAppTest.php

fix(team): transfer instance-wide sources to root team on deletion

2026-04-09 14:51:52 +02:00

UserRootTeamTest.php

chore: inspect commit message guidance

2026-05-27 07:14:54 +02:00