starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-09-28 02:06:37 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): hide nested server secrets from read tokens

Browse Source 
Require read:sensitive for nested server logdrain and sentinel fields in
application and database API responses.

Limit deployment configuration column migration SQL to PostgreSQL.
This commit is contained in:
Andras Bacsai
2026-06-04 16:51:52 +02:00
parent 2fcc42b0a9
commit 70eda65d19
7 changed files with 743 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Controllers/Api/ApplicationsController.php
+26
View File
@@ -61,11 +61,37 @@ class ApplicationsController extends Controller
$application->makeHidden([
'private_key_id',
]);
$this->hideNestedServerSecrets($application);
}
return serializeApiResponse($application);
}
private function hideNestedServerSecrets($model): void
{
$server = $model->destination?->server ?? null;
if (! $server) {
return;
}
$server->makeHidden([
'logdrain_axiom_api_key',
'logdrain_newrelic_license_key',
]);
$settings = $server->settings ?? null;
if ($settings) {
$settings->makeHidden([
'sentinel_token',
'sentinel_custom_url',
'logdrain_newrelic_license_key',
'logdrain_axiom_api_key',
'logdrain_custom_config',
'logdrain_custom_config_parser',
]);
}
}
/**
* Expose sensitive fields on eager-loaded nested Server + ServerSetting
* relations for callers with the `read:sensitive` or `root` token ability.
app/Http/Controllers/Api/DatabasesController.php
+26
View File
@@ -51,11 +51,37 @@ class DatabasesController extends Controller
'mariadb_root_password',
]);
$this->exposeNestedServerSecrets($database);
} else {
$this->hideNestedServerSecrets($database);
}
return serializeApiResponse($database);
}
private function hideNestedServerSecrets(Model $model): void
{
$server = $model->destination?->server;
if ($server === null) {
return;
}
$server->makeHidden([
'logdrain_axiom_api_key',
'logdrain_newrelic_license_key',
]);
if ($server->settings !== null) {
$server->settings->makeHidden([
'sentinel_token',
'sentinel_custom_url',
'logdrain_newrelic_license_key',
'logdrain_axiom_api_key',
'logdrain_custom_config',
'logdrain_custom_config_parser',
]);
}
}
/**
* Expose sensitive fields on eager-loaded nested Server + ServerSetting
* relations for callers with the `read:sensitive` or `root` token ability.
app/Models/CloudProviderToken.php
+4
View File
@@ -2,8 +2,12 @@
namespace App\Models;
use Illuminate\Database\Eloquent\Factories\HasFactory;
class CloudProviderToken extends BaseModel
{
use HasFactory;
protected $fillable = [
'team_id',
'provider',