feat(security): add Cloudflare integration token management

Add encrypted team-scoped integration token storage, admin UI, authorization, and Cloudflare token validation.
2026-08-24 02:24:11 -05:00 · 2026-08-18 16:15:34 +02:00
parent dd4ec1ab5e
commit 743f54b317
14 changed files with 533 additions and 0 deletions
@@ -0,0 +1,81 @@
+<?php
+
+namespace App\Livewire\Security;
+
+use App\Models\IntegrationToken;
+use App\Services\CloudflareTokenValidator;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class IntegrationTokenForm extends Component
+{
+    use AuthorizesRequests;
+
+    public bool $modal_mode = false;
+
+    public string $provider = 'cloudflare';
+
+    public string $name = '';
+
+    public string $token = '';
+
+    public array $capabilities = ['dns'];
+
+    public function mount(): void
+    {
+        $this->authorize('create', IntegrationToken::class);
+    }
+
+    protected function rules(): array
+    {
+        return [
+            'provider' => ['required', 'in:cloudflare'],
+            'name' => ['required', 'string', 'max:255'],
+            'token' => ['required', 'string'],
+            'capabilities' => ['required', 'array', 'min:1'],
+            'capabilities.*' => ['required', 'in:dns'],
+        ];
+    }
+
+    protected function messages(): array
+    {
+        return [
+            'capabilities.required' => 'Select at least one capability.',
+            'capabilities.min' => 'Select at least one capability.',
+        ];
+    }
+
+    public function addToken(CloudflareTokenValidator $validator): void
+    {
+        $validated = $this->validate();
+
+        try {
+            if (! $validator->validate($validated['token'], $validated['capabilities'])) {
+                $this->dispatch('error', 'The token could not access the selected Cloudflare capabilities. Check its permissions and zone resources.');
+
+                return;
+            }
+
+            IntegrationToken::query()->create([
+                ...$validated,
+                'team_id' => currentTeam()->id,
+            ]);
+
+            $this->reset(['name', 'token']);
+            $this->dispatch('integrationTokenAdded')->to(IntegrationTokens::class);
+
+            if ($this->modal_mode) {
+                $this->dispatch('close-modal');
+            }
+
+            $this->dispatch('success', 'Integration token added successfully.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function render()
+    {
+        return view('livewire.security.integration-token-form');
+    }
+}
@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Livewire\Security;
+
+use App\Models\IntegrationToken;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\On;
+use Livewire\Component;
+
+class IntegrationTokens extends Component
+{
+    use AuthorizesRequests;
+
+    public $tokens;
+
+    public function mount(): void
+    {
+        $this->authorize('viewAny', IntegrationToken::class);
+        $this->loadTokens();
+    }
+
+    #[On('integrationTokenAdded')]
+    public function loadTokens(): void
+    {
+        $this->tokens = IntegrationToken::ownedByCurrentTeam()->latest()->get();
+    }
+
+    public function deleteToken(int $tokenId, string $password = ''): void
+    {
+        $token = IntegrationToken::ownedByCurrentTeam()->findOrFail($tokenId);
+        $this->authorize('delete', $token);
+        $token->delete();
+        $this->loadTokens();
+        $this->dispatch('success', 'Integration token deleted successfully.');
+    }
+
+    public function render()
+    {
+        return view('livewire.security.integration-tokens');
+    }
+}
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class IntegrationToken extends BaseModel
+{
+    protected $fillable = [
+        'team_id',
+        'provider',
+        'name',
+        'token',
+        'capabilities',
+    ];
+
+    protected $hidden = [
+        'token',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'token' => 'encrypted',
+            'capabilities' => 'array',
+        ];
+    }
+
+    public function team(): BelongsTo
+    {
+        return $this->belongsTo(Team::class);
+    }
+
+    public static function ownedByCurrentTeam()
+    {
+        return self::query()->where('team_id', currentTeam()->id);
+    }
+}
@@ -304,6 +304,11 @@ class Team extends Model implements SendsDiscord, SendsEmail, SendsPushover, Sen
        return $this->hasMany(CloudProviderToken::class);
    }

+    public function integrationTokens()
+    {
+        return $this->hasMany(IntegrationToken::class);
+    }
+
    public function sources()
    {
        $sources = collect([]);
@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\IntegrationToken;
+use App\Models\User;
+
+class IntegrationTokenPolicy
+{
+    public function viewAny(User $user): bool
+    {
+        return $user->isAdmin();
+    }
+
+    public function create(User $user): bool
+    {
+        return $user->isAdmin();
+    }
+
+    public function delete(User $user, IntegrationToken $integrationToken): bool
+    {
+        return $user->isAdmin() && $integrationToken->team_id === currentTeam()->id;
+    }
+}
@@ -15,6 +15,7 @@ use App\Models\EnvironmentVariable;
 use App\Models\GithubApp;
 use App\Models\GitlabApp;
 use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
 use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\PushoverNotificationSettings;
@@ -51,6 +52,7 @@ use App\Policies\EnvironmentVariablePolicy;
 use App\Policies\GithubAppPolicy;
 use App\Policies\GitlabAppPolicy;
 use App\Policies\InstanceSettingsPolicy;
+use App\Policies\IntegrationTokenPolicy;
 use App\Policies\NotificationPolicy;
 use App\Policies\PrivateKeyPolicy;
 use App\Policies\ProjectPolicy;
@@ -127,6 +129,7 @@ class AuthServiceProvider extends ServiceProvider

        // Cloud provider policies
        CloudProviderToken::class => CloudProviderTokenPolicy::class,
+        IntegrationToken::class => IntegrationTokenPolicy::class,
        CloudInitScript::class => CloudInitScriptPolicy::class,
        Tag::class => TagPolicy::class,

@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Services;
+
+use Illuminate\Http\Client\PendingRequest;
+use Illuminate\Support\Facades\Http;
+
+class CloudflareTokenValidator
+{
+    public function validate(string $token, array $capabilities): bool
+    {
+        $client = $this->client($token);
+        $verification = $client->get('https://api.cloudflare.com/client/v4/user/tokens/verify');
+
+        if (! $verification->successful() || $verification->json('result.status') !== 'active') {
+            return false;
+        }
+
+        if (in_array('dns', $capabilities, true)) {
+            $zones = $client->get('https://api.cloudflare.com/client/v4/zones', ['per_page' => 1]);
+            $zoneId = $zones->json('result.0.id');
+
+            if (! $zones->successful() || ! is_string($zoneId)) {
+                return false;
+            }
+
+            return $client->get("https://api.cloudflare.com/client/v4/zones/{$zoneId}/dns_records", [
+                'per_page' => 1,
+            ])->successful();
+        }
+
+        return true;
+    }
+
+    private function client(string $token): PendingRequest
+    {
+        return Http::withToken($token)
+            ->acceptJson()
+            ->connectTimeout(5)
+            ->timeout(10);
+    }
+}
@@ -0,0 +1,29 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('integration_tokens', function (Blueprint $table) {
+            $table->id();
+            $table->string('uuid')->unique();
+            $table->foreignId('team_id')->constrained()->cascadeOnDelete();
+            $table->string('provider');
+            $table->string('name');
+            $table->text('token');
+            $table->json('capabilities');
+            $table->timestamps();
+
+            $table->index(['team_id', 'provider']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('integration_tokens');
+    }
+};
@@ -12,6 +12,12 @@
            'active' => request()->routeIs('security.cloud-tokens*'),
            'icon' => 'cloud',
        ] : null,
+        auth()->user()?->can('viewAny', App\Models\IntegrationToken::class) ? [
+            'label' => 'Integration Tokens',
+            'route' => 'security.integration-tokens',
+            'active' => request()->routeIs('security.integration-tokens'),
+            'icon' => 'network',
+        ] : null,
        auth()->user()?->can('viewAny', App\Models\CloudInitScript::class) ? [
            'label' => 'Cloud-Init Scripts',
            'route' => 'security.cloud-init-scripts',
@@ -0,0 +1,49 @@
+<div class="w-full">
+    <form class="application-settings-form flex w-full flex-col gap-4" wire:submit="addToken">
+        <x-forms.listbox required id="provider" label="Provider" :options="[
+            ['value' => 'cloudflare', 'label' => 'Cloudflare'],
+        ]" />
+
+        <div class="grid gap-4 lg:grid-cols-2">
+            <x-forms.input required id="name" label="Token name" placeholder="Production DNS" />
+            <x-forms.input required type="password" id="token" label="API token"
+                placeholder="Paste the provider token" />
+        </div>
+
+        <fieldset>
+            <legend class="text-sm font-medium text-black dark:text-fg">Capabilities</legend>
+            <div class="mt-3 rounded-lg border border-neutral-200 p-1 dark:border-white/[0.08]">
+                <x-forms.checkbox id="dns-capability" label="DNS" domValue="dns" fullWidth
+                    wire:model.live="capabilities" />
+                <p class="px-2.5 pb-2 text-[11px] text-neutral-500 dark:text-fg-dim">
+                    Manage Cloudflare DNS records.
+                </p>
+            </div>
+            @error('capabilities')
+                <span class="text-xs text-red-500">{{ $message }}</span>
+            @enderror
+        </fieldset>
+
+        @if (in_array('dns', $capabilities, true))
+            <div class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+                <div class="font-medium text-black dark:text-fg">Required Cloudflare permissions</div>
+                <ul class="list-inside list-disc">
+                    <li>Zone - DNS - Edit</li>
+                    <li>Zone - Zone - Read</li>
+                </ul>
+                <p>Limit zone resources to the zones Coolify should manage.</p>
+                <a href="https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%5D&amp;accountId=%2A&amp;zoneId=all&amp;name=Coolify%20DNS%20Management"
+                    target="_blank" rel="noopener noreferrer"
+                    class="font-medium text-coollabs hover:underline dark:text-warning">
+                    Create this token in Cloudflare
+                </a>
+            </div>
+        @endif
+
+        <div class="flex justify-end border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+            <x-forms.button type="submit" wire:target="addToken" isHighlighted>
+                Validate and add
+            </x-forms.button>
+        </div>
+    </form>
+</div>
@@ -0,0 +1,68 @@
+<div>
+    <x-slot:title>
+        Integration Tokens | Coolify
+    </x-slot>
+
+    <x-security.settings-layout>
+        <div class="application-settings-form">
+            <x-application.settings-section title="Integration tokens"
+                description="Credentials used by third-party integrations such as DNS providers." flush>
+                <x-slot:actions>
+                    @can('create', App\Models\IntegrationToken::class)
+                        <x-modal-input title="New Integration Token">
+                            <x-slot:content>
+                                <button type="button" class="button button-highlighted">
+                                    <x-reicon name="plus" class="size-3.5" />
+                                    New token
+                                </button>
+                            </x-slot:content>
+                            <livewire:security.integration-token-form :modal_mode="true"
+                                wire:key="new-integration-token" />
+                        </x-modal-input>
+                    @endcan
+                </x-slot:actions>
+
+                @if ($tokens->isEmpty())
+                    <x-empty title="No integration tokens"
+                        description="Add a provider token to connect a third-party integration."
+                        icon-name="keys" size="sm" />
+                @else
+                    <div class="divide-y divide-neutral-200 dark:divide-white/[0.07]">
+                        @foreach ($tokens as $savedToken)
+                            <div wire:key="integration-token-{{ $savedToken->id }}"
+                                class="grid min-h-14 grid-cols-[minmax(0,1fr)_8rem_minmax(0,1fr)_2rem] items-center gap-3 px-4 py-2.5">
+                                <div class="min-w-0">
+                                    <h3 class="truncate text-[13px]! font-semibold! text-black dark:text-fg">
+                                        {{ $savedToken->name }}
+                                    </h3>
+                                </div>
+                                <div class="text-center text-[12px] text-neutral-500 dark:text-fg-dim">
+                                    {{ ucfirst($savedToken->provider) }}
+                                </div>
+                                <div class="flex flex-wrap gap-1">
+                                    @foreach ($savedToken->capabilities ?? [] as $capability)
+                                        <span class="rounded-full bg-neutral-100 px-2 py-0.5 text-[10px] font-medium uppercase text-neutral-600 dark:bg-white/[0.06] dark:text-fg-dim">
+                                            {{ $capability }}
+                                        </span>
+                                    @endforeach
+                                </div>
+                                <x-modal-confirmation title="Delete integration token?" isErrorButton
+                                    submitAction="deleteToken({{ $savedToken->id }})"
+                                    confirmationText="{{ $savedToken->name }}"
+                                    confirmationLabel="Enter the token name to confirm"
+                                    shortConfirmationLabel="Token name" :confirmWithPassword="false"
+                                    step2ButtonText="Delete token">
+                                    <x-slot:trigger>
+                                        <button type="button" class="icon-button" title="Delete token">
+                                            <x-reicon name="trash" class="size-3.5" />
+                                        </button>
+                                    </x-slot:trigger>
+                                </x-modal-confirmation>
+                            </div>
+                        @endforeach
+                    </div>
+                @endif
+            </x-application.settings-section>
+        </div>
+    </x-security.settings-layout>
+</div>
@@ -47,6 +47,7 @@ use App\Livewire\Security\CloudInitScript\Show as SecurityCloudInitScriptShow;
 use App\Livewire\Security\CloudInitScripts;
 use App\Livewire\Security\CloudProviderToken\Show as SecurityCloudProviderTokenShow;
 use App\Livewire\Security\CloudTokens;
+use App\Livewire\Security\IntegrationTokens;
 use App\Livewire\Security\PrivateKey\Index as SecurityPrivateKeyIndex;
 use App\Livewire\Security\PrivateKey\Show as SecurityPrivateKeyShow;
 use App\Livewire\Server\Advanced as ServerAdvanced;
@@ -388,6 +389,7 @@ Route::middleware(['auth', 'verified'])->group(function () {
    Route::get('/security/private-key/{private_key_uuid}', SecurityPrivateKeyShow::class)->name('security.private-key.show');

    Route::get('/security/cloud-tokens', CloudTokens::class)->name('security.cloud-tokens');
+    Route::get('/security/integration-tokens', IntegrationTokens::class)->name('security.integration-tokens');
    Route::get('/security/cloud-tokens/{cloud_token_uuid}', SecurityCloudProviderTokenShow::class)->name('security.cloud-tokens.show');
    Route::get('/security/cloud-init-scripts', CloudInitScripts::class)->name('security.cloud-init-scripts');
    Route::get('/security/cloud-init-scripts/{cloud_init_script_uuid}', SecurityCloudInitScriptShow::class)->name('security.cloud-init-scripts.show');
@@ -0,0 +1,143 @@
+<?php
+
+use App\Livewire\Security\IntegrationTokenForm;
+use App\Livewire\Security\IntegrationTokens;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    if (! InstanceSettings::query()->whereKey(0)->exists()) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->save();
+    }
+    Once::flush();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+    $this->actingAs($this->user);
+});
+
+test('a cloudflare dns token is validated with read only requests before it is saved', function () {
+    Http::fake([
+        'https://api.cloudflare.com/client/v4/user/tokens/verify' => Http::response([
+            'success' => true,
+            'result' => ['status' => 'active'],
+        ]),
+        'https://api.cloudflare.com/client/v4/zones?per_page=1' => Http::response([
+            'success' => true,
+            'result' => [['id' => 'zone-id']],
+        ]),
+        'https://api.cloudflare.com/client/v4/zones/zone-id/dns_records?per_page=1' => Http::response([
+            'success' => true,
+            'result' => [],
+        ]),
+    ]);
+
+    Livewire::test(IntegrationTokenForm::class, ['modal_mode' => true])
+        ->set('provider', 'cloudflare')
+        ->set('name', 'Production DNS')
+        ->set('token', 'cloudflare-token')
+        ->set('capabilities', ['dns'])
+        ->call('addToken')
+        ->assertHasNoErrors()
+        ->assertDispatched('close-modal');
+
+    $this->assertDatabaseHas('integration_tokens', [
+        'team_id' => $this->team->id,
+        'provider' => 'cloudflare',
+        'name' => 'Production DNS',
+    ]);
+
+    Http::assertSentCount(3);
+    Http::assertSent(fn ($request) => $request->method() === 'GET'
+        && $request->url() === 'https://api.cloudflare.com/client/v4/zones/zone-id/dns_records?per_page=1');
+});
+
+test('a cloudflare token is not saved when scope validation fails', function () {
+    Http::fake([
+        'https://api.cloudflare.com/client/v4/user/tokens/verify' => Http::response([
+            'success' => true,
+            'result' => ['status' => 'active'],
+        ]),
+        'https://api.cloudflare.com/client/v4/zones?per_page=1' => Http::response([
+            'success' => false,
+            'errors' => [['message' => 'Authentication error']],
+        ], 403),
+    ]);
+
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('name', 'Invalid DNS token')
+        ->set('token', 'cloudflare-token')
+        ->set('capabilities', ['dns'])
+        ->call('addToken')
+        ->assertDispatched('error');
+
+    $this->assertDatabaseCount('integration_tokens', 0);
+});
+
+test('at least one capability is required when adding a cloudflare token', function () {
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('name', 'Account token')
+        ->set('token', 'cloudflare-token')
+        ->set('capabilities', [])
+        ->call('addToken')
+        ->assertHasErrors(['capabilities' => 'required']);
+
+    $this->assertDatabaseCount('integration_tokens', 0);
+    Http::assertNothingSent();
+});
+
+test('integration tokens page lists saved provider and capabilities', function () {
+    IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'cloudflare',
+        'name' => 'Production DNS',
+        'token' => 'secret',
+        'capabilities' => ['dns'],
+    ]);
+
+    Livewire::test(IntegrationTokens::class)
+        ->assertSee('Production DNS')
+        ->assertSee('Cloudflare')
+        ->assertSee('DNS');
+});
+
+test('cloudflare dns scope guidance and token creation link are shown', function () {
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('capabilities', ['dns'])
+        ->assertSee('Zone - DNS - Edit')
+        ->assertSee('Zone - Zone - Read')
+        ->assertSeeHtml('https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%5D&amp;accountId=%2A&amp;zoneId=all&amp;name=Coolify%20DNS%20Management');
+
+    expect(file_get_contents(resource_path('views/livewire/security/integration-token-form.blade.php')))
+        ->toContain('permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%5D');
+});
+
+test('capability selection uses the shared checkbox component', function () {
+    $view = file_get_contents(resource_path('views/livewire/security/integration-token-form.blade.php'));
+
+    expect($view)
+        ->toContain('<x-forms.checkbox')
+        ->toContain('class="mt-3 rounded-lg border')
+        ->not->toContain('<input type="checkbox"');
+});
+
+test('submit button uses the shared highlighted loading state', function () {
+    $view = file_get_contents(resource_path('views/livewire/security/integration-token-form.blade.php'));
+
+    expect($view)
+        ->toContain('wire:target="addToken" isHighlighted')
+        ->not->toContain('class="button-highlighted"');
+});
@@ -8,6 +8,7 @@ it('uses shared sidebar navigation for keys and tokens pages', function () {
        'security/private-key/index.blade.php',
        'security/private-key/show.blade.php',
        'security/cloud-tokens.blade.php',
+        'security/integration-tokens.blade.php',
        'security/cloud-provider-token/show.blade.php',
        'security/cloud-init-scripts.blade.php',
        'security/cloud-init-script/show.blade.php',
@@ -22,6 +23,7 @@ it('uses shared sidebar navigation for keys and tokens pages', function () {
        ->toContain('application-settings-navigation')
        ->toContain("'label' => 'Private Keys'")
        ->toContain("'label' => 'Cloud Tokens'")
+        ->toContain("'label' => 'Integration Tokens'")
        ->toContain("'label' => 'Cloud-Init Scripts'")
        ->toContain("'label' => 'API Tokens'");