fix(terminal): pass the cloudflared Access service token to SSH

Closes #12312

docker/coolify-terminal/terminal-utils.js

@@ -123,10 +123,22 @@ export function createTerminalUpgradeHandler({ wss, authenticate, onRejected = (
 
 const DEFAULT_TERMINAL_PATH = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin';
 
+// Variables passed to the SSH process besides PATH. `cloudflared access ssh` reads the
+// Access service token from them in the ProxyCommand of Cloudflare Tunnel servers.
+const ALLOWED_TERMINAL_ENV = ['TUNNEL_SERVICE_TOKEN_ID', 'TUNNEL_SERVICE_TOKEN_SECRET'];
+
 export function getTerminalProcessEnv(environment = process.env) {
-    return {
+    const env = {
         PATH: environment.PATH || DEFAULT_TERMINAL_PATH,
     };
+
+    for (const name of ALLOWED_TERMINAL_ENV) {
+        if (environment[name]) {
+            env[name] = environment[name];
+        }
+    }
+
+    return env;
 }
 
 export function getTerminalSessionTimeout() {

docker/coolify-terminal/terminal-utils.test.js

@@ -54,6 +54,29 @@ test('getTerminalProcessEnv uses the default PATH when PATH is empty', () => {
     });
 });
 
+test('getTerminalProcessEnv passes the cloudflared Access service token to SSH proxy commands', () => {
+    assert.deepEqual(getTerminalProcessEnv({
+        PATH: '/usr/bin:/bin',
+        TUNNEL_SERVICE_TOKEN_ID: 'token-id.access',
+        TUNNEL_SERVICE_TOKEN_SECRET: 'token-secret',
+        TUNNEL_SERVICE_URL: 'must-not-be-inherited',
+        APP_KEY: 'must-not-be-inherited',
+    }), {
+        PATH: '/usr/bin:/bin',
+        TUNNEL_SERVICE_TOKEN_ID: 'token-id.access',
+        TUNNEL_SERVICE_TOKEN_SECRET: 'token-secret',
+    });
+});
+
+test('getTerminalProcessEnv omits empty cloudflared service token variables', () => {
+    assert.deepEqual(getTerminalProcessEnv({
+        PATH: '/usr/bin:/bin',
+        TUNNEL_SERVICE_TOKEN_ID: '',
+    }), {
+        PATH: '/usr/bin:/bin',
+    });
+});
+
 test('extractTargetHost normalizes quoted IPv4 hosts from generated ssh commands', () => {
     const sshArgs = extractSshArgs(
         "timeout 3600 ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o ServerAliveInterval=20 -o ConnectTimeout=10 'root'@'10.0.0.5' 'bash -se' << \\\\$abc\necho hi\nabc"