fix(ui): lock the server-built domain state of applications and services

The domain rows of applications and previews, and the DNS validation
flags of application and service domains, were not locked. A user
could change them from the browser to skip the DNS check or store
fake DNS results.

app/Livewire/Project/Application/Domains.php

@@ -77,9 +77,11 @@ class Domains extends Component
     public ?string $editingGeneratedHost = null;
 
     /** @var array<int, array{url: string, service: ?string, dns_status: string, dns_message: string, expected_ip: ?string, checked_at?: ?string, is_suggested?: bool, suggested_for?: ?string, suggestion_label?: ?string, needs_force_add?: bool, internal_port?: ?int, has_port_override?: bool}> */
+    #[Locked]
     public array $domainRows = [];
 
     /** When set, the next addSuggestedDomain call for this index skips the DNS block. */
+    #[Locked]
     public ?int $forceAddSuggestedIndex = null;
 
     /** @var array<int, string> */
@@ -122,6 +124,7 @@ class Domains extends Component
 
     public bool $isCheckingDns = false;
 
+    #[Locked]
     public bool $dnsValidationEnabled = true;
 
     /** Resolved or literal IP users should point DNS at. */

app/Livewire/Project/Application/PreviewDomains.php

@@ -11,6 +11,7 @@ use App\Support\DomainUrlParts;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\DB;
+use Livewire\Attributes\Locked;
 use Livewire\Component;
 
 class PreviewDomains extends Component
@@ -19,6 +20,8 @@ class PreviewDomains extends Component
 
     public ApplicationPreview $preview;
 
+    /** @var array<int, array<string, mixed>> */
+    #[Locked]
     public array $domainRows = [];
 
     public array $newDomainParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];

app/Livewire/Project/Service/Domains.php

@@ -110,6 +110,7 @@ class Domains extends Component
 
     public bool $isCheckingDns = false;
 
+    #[Locked]
     public bool $dnsValidationEnabled = true;
 
     #[Locked]

tests/Feature/LockedDomainRowsAndDockerImagesTest.php

@@ -1,7 +1,11 @@
 <?php
 
+use App\Livewire\Project\Application\Domains as ApplicationDomains;
+use App\Livewire\Project\Application\PreviewDomains;
 use App\Livewire\Project\Service\Domains;
 use App\Livewire\Server\DockerImages;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
 use App\Models\PrivateKey;
@@ -36,7 +40,7 @@ beforeEach(function () {
     $this->server->settings()->update(['is_reachable' => true, 'is_usable' => true]);
 });
 
-it('rejects a client update of the service domain rows', function () {
+it('rejects a client update of the service domain state', function (string $property, mixed $value) {
     $destination = StandaloneDocker::withoutEvents(fn () => StandaloneDocker::firstOrCreate(
         ['server_id' => $this->server->id, 'network' => 'coolify'],
         ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
@@ -59,8 +63,11 @@ it('rejects a client update of the service domain rows', function () {
 
     Livewire::test(Domains::class, ['service' => $service->fresh(['applications', 'server'])])
         ->assertSet('domainRows', fn (array $rows): bool => collect($rows)->pluck('url')->all() === ['https://web.example.com'])
-        ->set('domainRows', [['url' => 'https://attacker.example.com']]);
-})->throws(CannotUpdateLockedPropertyException::class);
+        ->set($property, $value);
+})->with([
+    'domain rows' => ['domainRows', [['url' => 'https://attacker.example.com']]],
+    'dns validation' => ['dnsValidationEnabled', false],
+])->throws(CannotUpdateLockedPropertyException::class);
 
 it('rejects a client update of the docker image list', function () {
     $imageId = 'sha256:'.str_repeat('a', 64);
@@ -76,3 +83,48 @@ it('rejects a client update of the docker image list', function () {
         ->assertSet('images.0.containers', ['web'])
         ->set('images.0.containers', []);
 })->throws(CannotUpdateLockedPropertyException::class);
+
+function createLockedDomainRowsApplication(Server $server, Team $team): Application
+{
+    $destination = StandaloneDocker::withoutEvents(fn () => StandaloneDocker::firstOrCreate(
+        ['server_id' => $server->id, 'network' => 'coolify'],
+        ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+    ));
+    $environment = Environment::factory()->create(['project_id' => Project::factory()->create(['team_id' => $team->id])->id]);
+
+    return Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'fqdn' => 'https://app.example.com',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+    ]);
+}
+
+it('rejects a client update of the application domain rows', function (string $property, mixed $value) {
+    $application = createLockedDomainRowsApplication($this->server, $this->team);
+
+    Livewire::test(ApplicationDomains::class, ['application' => $application->fresh()])
+        ->assertSet('domainRows', fn (array $rows): bool => collect($rows)->where('is_suggested', false)->pluck('url')->all() === ['https://app.example.com'])
+        ->set($property, $value);
+})->with([
+    'domain rows' => ['domainRows', [['url' => 'https://app.example.com', 'service' => null, 'dns_status' => 'ok', 'dns_message' => 'faked', 'expected_ip' => null, 'needs_force_add' => true]]],
+    'one row flag' => ['domainRows.0.needs_force_add', true],
+    'forced suggestion index' => ['forceAddSuggestedIndex', 0],
+    'DNS validation flag' => ['dnsValidationEnabled', false],
+])->throws(CannotUpdateLockedPropertyException::class);
+
+it('rejects a client update of the preview domain rows', function () {
+    $application = createLockedDomainRowsApplication($this->server, $this->team);
+    $preview = ApplicationPreview::create([
+        'application_id' => $application->id,
+        'pull_request_id' => 7,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/7',
+        'fqdn' => 'https://pr-7.example.com',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows', fn (array $rows): bool => collect($rows)->pluck('url')->all() === ['https://pr-7.example.com'])
+        ->set('domainRows.0.dns_status', 'ok');
+})->throws(CannotUpdateLockedPropertyException::class);

tests/Feature/ServiceDomainsTest.php

@@ -1003,7 +1003,6 @@ it('shows an inherited internal port badge from the coolify service env port', f
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->assertSet('domainRows.0.internal_port', 3000)
         ->assertSet('domainRows.0.has_port_override', false)
-        ->set('dnsValidationEnabled', false)
         ->call('startEdit', 0)
         ->assertSet('editingDomainParts.port', '3000')
         ->call('updateDomain')