starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-11-06 13:10:37 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(gitlab): check the private key before using it for git commands

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Andras Bacsai
2026-09-28 14:06:14 +02:00
co-authored by Claude Opus 5.5
parent 739d9e9d23
commit 7c21c330c9
3 changed files with 45 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Models/Application.php
+2 -2
View File
@@ -1608,7 +1608,7 @@ class Application extends BaseModel
];
}
$private_key = data_get($gitlabSource, 'privateKey.private_key');
$private_key = gitlabAppPrivateKey($gitlabSource)?->private_key;
if ($private_key) {
$fullRepoUrl = $customRepository;
@@ -1910,7 +1910,7 @@ class Application extends BaseModel
];
}
$private_key = data_get($gitlabSource, 'privateKey.private_key');
$private_key = gitlabAppPrivateKey($gitlabSource)?->private_key;
if ($private_key) {
$fullRepoUrl = $customRepository;
bootstrap/helpers/gitlab.php
+8
View File
@@ -1,6 +1,7 @@
<?php
use App\Models\GitlabApp;
use App\Models\PrivateKey;
use Illuminate\Support\Facades\Cache;
use Illuminate\Support\Facades\Http;
@@ -83,6 +84,13 @@ function gitlabApi(GitlabApp $source, string $endpoint, string $method = 'get',
];
}
function gitlabAppPrivateKey(GitlabApp $source): ?PrivateKey
{
$privateKey = $source->privateKey;
return $privateKey?->team_id === $source->team_id ? $privateKey : null;
}
function generateGitlabCloneToken(GitlabApp $source): string
{
refreshGitlabToken($source);
tests/Unit/GitlabSourceCommandsTest.php
+35
View File
@@ -213,3 +213,38 @@ it('applies OAuth git config to GitLab merge-request fetch and submodule checkou
->toContain("http.version=HTTP/1.1 fetch origin 'merge-requests/2/head:pr-2-coolify'")
->toContain('http.version=HTTP/1.1 submodule update --init --recursive');
});
it('uses a GitLab source private key only when it belongs to the source team', function (int $keyTeamId, bool $expectKey) {
$privateKey = new PrivateKey;
$privateKey->forceFill(['team_id' => $keyTeamId, 'private_key' => 'fake-private-key']);
$gitlabSource = new GitlabApp(['html_url' => 'https://gitlab.com', 'custom_port' => 22]);
$gitlabSource->forceFill(['team_id' => 1]);
$gitlabSource->setRelation('privateKey', $privateKey);
$application = Mockery::mock(Application::class)->makePartial();
$application->git_branch = 'main';
$application->shouldReceive('deploymentType')->andReturn('source');
$application->shouldReceive('customRepository')->andReturn([
'repository' => 'git@gitlab.com:user/repo.git',
'port' => 22,
]);
$application->shouldReceive('getAttribute')->with('source')->andReturn($gitlabSource);
$application->shouldReceive('getAttribute')->with('settings')->andReturn((object) [
'is_git_shallow_clone_enabled' => false,
'is_git_submodules_enabled' => false,
]);
$application->source = $gitlabSource;
$lsRemote = $application->generateGitLsRemoteCommands('test-deployment-uuid', false)['commands'];
$import = $application->generateGitImportCommands(deployment_uuid: 'test-deployment-uuid', exec_in_docker: false)['commands'];
foreach ([$lsRemote, $import] as $commands) {
$expectKey
? expectGitlabCommandListToContain($commands, 'id_rsa_coolify_')
: expectGitlabCommandListNotToContain($commands, 'id_rsa_coolify_');
}
})->with([
'same team' => [1, true],
'other team' => [2, false],
]);