starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-09-27 17:55:59 -04:00
Code Issues Packages Projects Releases Wiki Activity

feat(security): add Cloudflare integration token management

Browse Source 
Add encrypted team-scoped integration token storage, admin UI, authorization, and Cloudflare token validation.
This commit is contained in:
Andras Bacsai
2026-08-18 16:15:34 +02:00
parent dd4ec1ab5e
commit 743f54b317
14 changed files with 533 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Feature/Security/IntegrationTokenFormTest.php
+143
View File
@@ -0,0 +1,143 @@
<?php
use App\Livewire\Security\IntegrationTokenForm;
use App\Livewire\Security\IntegrationTokens;
use App\Models\InstanceSettings;
use App\Models\IntegrationToken;
use App\Models\Team;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Http;
use Illuminate\Support\Once;
use Livewire\Livewire;
uses(RefreshDatabase::class);
beforeEach(function () {
if (! InstanceSettings::query()->whereKey(0)->exists()) {
$settings = new InstanceSettings;
$settings->id = 0;
$settings->save();
}
Once::flush();
$this->team = Team::factory()->create();
$this->user = User::factory()->create();
$this->team->members()->attach($this->user->id, ['role' => 'owner']);
session(['currentTeam' => $this->team]);
$this->actingAs($this->user);
});
test('a cloudflare dns token is validated with read only requests before it is saved', function () {
Http::fake([
'https://api.cloudflare.com/client/v4/user/tokens/verify' => Http::response([
'success' => true,
'result' => ['status' => 'active'],
]),
'https://api.cloudflare.com/client/v4/zones?per_page=1' => Http::response([
'success' => true,
'result' => [['id' => 'zone-id']],
]),
'https://api.cloudflare.com/client/v4/zones/zone-id/dns_records?per_page=1' => Http::response([
'success' => true,
'result' => [],
]),
]);
Livewire::test(IntegrationTokenForm::class, ['modal_mode' => true])
->set('provider', 'cloudflare')
->set('name', 'Production DNS')
->set('token', 'cloudflare-token')
->set('capabilities', ['dns'])
->call('addToken')
->assertHasNoErrors()
->assertDispatched('close-modal');
$this->assertDatabaseHas('integration_tokens', [
'team_id' => $this->team->id,
'provider' => 'cloudflare',
'name' => 'Production DNS',
]);
Http::assertSentCount(3);
Http::assertSent(fn ($request) => $request->method() === 'GET'
&& $request->url() === 'https://api.cloudflare.com/client/v4/zones/zone-id/dns_records?per_page=1');
});
test('a cloudflare token is not saved when scope validation fails', function () {
Http::fake([
'https://api.cloudflare.com/client/v4/user/tokens/verify' => Http::response([
'success' => true,
'result' => ['status' => 'active'],
]),
'https://api.cloudflare.com/client/v4/zones?per_page=1' => Http::response([
'success' => false,
'errors' => [['message' => 'Authentication error']],
], 403),
]);
Livewire::test(IntegrationTokenForm::class)
->set('name', 'Invalid DNS token')
->set('token', 'cloudflare-token')
->set('capabilities', ['dns'])
->call('addToken')
->assertDispatched('error');
$this->assertDatabaseCount('integration_tokens', 0);
});
test('at least one capability is required when adding a cloudflare token', function () {
Livewire::test(IntegrationTokenForm::class)
->set('name', 'Account token')
->set('token', 'cloudflare-token')
->set('capabilities', [])
->call('addToken')
->assertHasErrors(['capabilities' => 'required']);
$this->assertDatabaseCount('integration_tokens', 0);
Http::assertNothingSent();
});
test('integration tokens page lists saved provider and capabilities', function () {
IntegrationToken::query()->create([
'team_id' => $this->team->id,
'provider' => 'cloudflare',
'name' => 'Production DNS',
'token' => 'secret',
'capabilities' => ['dns'],
]);
Livewire::test(IntegrationTokens::class)
->assertSee('Production DNS')
->assertSee('Cloudflare')
->assertSee('DNS');
});
test('cloudflare dns scope guidance and token creation link are shown', function () {
Livewire::test(IntegrationTokenForm::class)
->set('capabilities', ['dns'])
->assertSee('Zone - DNS - Edit')
->assertSee('Zone - Zone - Read')
->assertSeeHtml('https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%5D&amp;accountId=%2A&amp;zoneId=all&amp;name=Coolify%20DNS%20Management');
expect(file_get_contents(resource_path('views/livewire/security/integration-token-form.blade.php')))
->toContain('permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%5D');
});
test('capability selection uses the shared checkbox component', function () {
$view = file_get_contents(resource_path('views/livewire/security/integration-token-form.blade.php'));
expect($view)
->toContain('<x-forms.checkbox')
->toContain('class="mt-3 rounded-lg border')
->not->toContain('<input type="checkbox"');
});
test('submit button uses the shared highlighted loading state', function () {
$view = file_get_contents(resource_path('views/livewire/security/integration-token-form.blade.php'));
expect($view)
->toContain('wire:target="addToken" isHighlighted')
->not->toContain('class="button-highlighted"');
});
tests/Feature/SecuritySettingsNavigationTest.php
+2
View File
@@ -8,6 +8,7 @@ it('uses shared sidebar navigation for keys and tokens pages', function () {
'security/private-key/index.blade.php',
'security/private-key/show.blade.php',
'security/cloud-tokens.blade.php',
'security/integration-tokens.blade.php',
'security/cloud-provider-token/show.blade.php',
'security/cloud-init-scripts.blade.php',
'security/cloud-init-script/show.blade.php',
@@ -22,6 +23,7 @@ it('uses shared sidebar navigation for keys and tokens pages', function () {
->toContain('application-settings-navigation')
->toContain("'label' => 'Private Keys'")
->toContain("'label' => 'Cloud Tokens'")
->toContain("'label' => 'Integration Tokens'")
->toContain("'label' => 'Cloud-Init Scripts'")
->toContain("'label' => 'API Tokens'");