starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-11-06 13:10:37 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: restrict proxy content access and scope backup storage to owners

Browse Source 
- Hide proxy configuration contents from users without update permission.
- Select and validate backup S3 storage against the resource's team.
- Keep scheduled branch syncs green while a conflict PR remains open.
- Document external mount permissions and Sentinel traffic limits.
- Add regression coverage for authorization and backup storage selection.
This commit is contained in:
Andras Bacsai
2026-10-05 13:20:19 +02:00
parent 4227ec6ebf
commit 439ee6faea
10 changed files with 220 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openapi.json
+35 -10
View File
@@ -4969,7 +4969,7 @@
},
"fs_path": {
"type": "string",
"description": "Host directory path (required when is_directory is true)."
"description": "Host path. Required for directory mounts and host file mounts. Optional for file mounts with content (default: inside the resource directory). An absolute path can be anywhere on the host; a relative path is inside the resource directory. A directory or file mount outside the resource directory needs a token with the deploy permission. Coolify never deletes a path outside the resource directory."
}
},
"type": "object",
@@ -4998,6 +4998,9 @@
"404": {
"$ref": "#\/components\/responses\/404"
},
"403": {
"description": "The token needs the deploy permission for a mount outside the resource directory."
},
"422": {
"$ref": "#\/components\/responses\/422"
}
@@ -5067,7 +5070,7 @@
"content": {
"type": "string",
"nullable": true,
"description": "The file content (file only, not allowed for read-only storages)."
"description": "The file content (file only, not allowed for read-only storages). Changing the content of a file outside the resource directory needs the deploy permission."
}
},
"type": "object",
@@ -5096,6 +5099,9 @@
"404": {
"$ref": "#\/components\/responses\/404"
},
"403": {
"description": "The token needs the deploy permission to change the content of a file outside the resource directory."
},
"422": {
"$ref": "#\/components\/responses\/422"
}
@@ -9605,7 +9611,7 @@
},
"fs_path": {
"type": "string",
"description": "Host directory path (required when is_directory is true)."
"description": "Host path. Required for directory mounts and host file mounts. Optional for file mounts with content (default: inside the resource directory). An absolute path can be anywhere on the host; a relative path is inside the resource directory. A directory or file mount outside the resource directory needs a token with the deploy permission. Coolify never deletes a path outside the resource directory."
}
},
"type": "object",
@@ -9634,6 +9640,9 @@
"404": {
"$ref": "#\/components\/responses\/404"
},
"403": {
"description": "The token needs the deploy permission for a mount outside the resource directory."
},
"422": {
"$ref": "#\/components\/responses\/422"
}
@@ -9703,7 +9712,7 @@
"content": {
"type": "string",
"nullable": true,
"description": "The file content (file only, not allowed for read-only storages)."
"description": "The file content (file only, not allowed for read-only storages). Changing the content of a file outside the resource directory needs the deploy permission."
}
},
"type": "object",
@@ -9732,6 +9741,9 @@
"404": {
"$ref": "#\/components\/responses\/404"
},
"403": {
"description": "The token needs the deploy permission to change the content of a file outside the resource directory."
},
"422": {
"$ref": "#\/components\/responses\/422"
}
@@ -14426,7 +14438,8 @@
"timeout": {
"type": "integer",
"description": "The timeout of the scheduled task in seconds.",
"default": 300
"default": 300,
"maximum": 36000
},
"enabled": {
"type": "boolean",
@@ -14579,7 +14592,8 @@
"timeout": {
"type": "integer",
"description": "The timeout of the scheduled task in seconds.",
"default": 300
"default": 300,
"maximum": 36000
},
"enabled": {
"type": "boolean",
@@ -14772,7 +14786,8 @@
"timeout": {
"type": "integer",
"description": "The timeout of the scheduled task in seconds.",
"default": 300
"default": 300,
"maximum": 36000
},
"enabled": {
"type": "boolean",
@@ -14925,7 +14940,8 @@
"timeout": {
"type": "integer",
"description": "The timeout of the scheduled task in seconds.",
"default": 300
"default": 300,
"maximum": 36000
},
"enabled": {
"type": "boolean",
@@ -16919,6 +16935,7 @@
},
"traffic_topn": {
"type": "integer",
"maximum": 1000,
"minimum": 1
},
"traffic_sample_threshold": {
@@ -16927,10 +16944,12 @@
},
"traffic_retention_1h_days": {
"type": "integer",
"maximum": 365,
"minimum": 1
},
"traffic_retention_1d_days": {
"type": "integer",
"maximum": 3650,
"minimum": 1
},
"is_geoip_enabled": {
@@ -20362,7 +20381,7 @@
},
"fs_path": {
"type": "string",
"description": "Host directory path (required when is_directory is true)."
"description": "Host path. Required for directory mounts and host file mounts. Optional for file mounts with content (default: inside the resource directory). An absolute path can be anywhere on the host; a relative path is inside the resource directory. A directory or file mount outside the resource directory needs a token with the deploy permission. Coolify never deletes a path outside the resource directory."
}
},
"type": "object",
@@ -20391,6 +20410,9 @@
"404": {
"$ref": "#\/components\/responses\/404"
},
"403": {
"description": "The token needs the deploy permission for a mount outside the resource directory."
},
"422": {
"$ref": "#\/components\/responses\/422"
}
@@ -20460,7 +20482,7 @@
"content": {
"type": "string",
"nullable": true,
"description": "The file content (file only, not allowed for read-only storages)."
"description": "The file content (file only, not allowed for read-only storages). Changing the content of a file outside the resource directory needs the deploy permission."
}
},
"type": "object",
@@ -20489,6 +20511,9 @@
"404": {
"$ref": "#\/components\/responses\/404"
},
"403": {
"description": "The token needs the deploy permission to change the content of a file outside the resource directory."
},
"422": {
"$ref": "#\/components\/responses\/422"
}