starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-11-06 13:10:37 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(env): keep preview copies of locked variables locked

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Andras Bacsai
2026-10-24 18:12:23 +02:00
co-authored by Claude Opus 5.5
parent 386539ee30
commit 9395c415b3
2 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Models/EnvironmentVariable.php
+1
View File
@@ -134,6 +134,7 @@ class EnvironmentVariable extends BaseModel
'is_runtime' => $environment_variable->is_runtime ?? false,
'is_buildtime' => $environment_variable->is_buildtime ?? false,
'is_required' => $environment_variable->is_required ?? false,
'is_shown_once' => $environment_variable->is_shown_once ?? false,
'comment' => $environment_variable->comment,
'resourceable_type' => Application::class,
'resourceable_id' => $environment_variable->resourceable_id,
tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php
+26
View File
@@ -246,6 +246,32 @@ test('API hides locked env value with root token', function () {
expect($locked)->not->toHaveKey('real_value');
});
test('API hides the value of the automatic preview copy of a locked env', function () {
session(['currentTeam' => $this->team]);
$token = $this->admin->createToken('admin-sensitive-preview', ['read', 'read:sensitive', 'write']);
$headers = ['Authorization' => 'Bearer '.$token->plainTextToken];
$this->withHeaders($headers)->postJson("/api/v1/applications/{$this->application->uuid}/envs", [
'key' => 'API_LOCKED_VAR',
'value' => 'api-secret-value',
'is_shown_once' => true,
])->assertCreated();
$envs = collect($this->withHeaders($headers)
->getJson("/api/v1/applications/{$this->application->uuid}/envs")
->assertOk()
->json())
->where('key', 'API_LOCKED_VAR');
expect($envs)->toHaveCount(2);
expect($envs->pluck('is_preview')->sort()->values()->all())->toBe([false, true]);
$envs->each(function (array $env) {
expect($env['is_shown_once'])->toBeTruthy();
expect($env)->not->toHaveKey('value');
expect($env)->not->toHaveKey('real_value');
});
});
// --- API: member role hides env values ---
test('API hides env values for member even with read:sensitive token', function () {