fix(ui): validate secret manager settings and lock server-built lists

- SecretManagerLinks: validate settings when the integration token changes, and save only validated keys - Service Domains: lock domainRows - Server DockerImages: lock images
2026-11-06 13:10:37 -04:00 · 2026-10-05 21:23:29 +02:00
parent 379838251b
commit a331f91c49
5 changed files with 197 additions and 1 deletions
@@ -0,0 +1,78 @@
+<?php
+
+use App\Livewire\Project\Service\Domains;
+use App\Livewire\Server\DockerImages;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Str;
+use Livewire\Features\SupportLockedProperties\CannotUpdateLockedPropertyException;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    $this->withoutVite();
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0, 'is_dns_validation_enabled' => false]));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $this->server = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $privateKey->id, 'ip' => '203.0.113.10']);
+    $this->server->settings()->update(['is_reachable' => true, 'is_usable' => true]);
+});
+
+it('rejects a client update of the service domain rows', function () {
+    $destination = StandaloneDocker::withoutEvents(fn () => StandaloneDocker::firstOrCreate(
+        ['server_id' => $this->server->id, 'network' => 'coolify'],
+        ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+    ));
+    $environment = Environment::factory()->create(['project_id' => Project::factory()->create(['team_id' => $this->team->id])->id]);
+    $service = Service::factory()->create([
+        'server_id' => $this->server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'environment_id' => $environment->id,
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+    ]);
+    ServiceApplication::create([
+        'uuid' => (string) Str::uuid(),
+        'service_id' => $service->id,
+        'name' => 'web',
+        'image' => 'nginx:alpine',
+        'fqdn' => 'https://web.example.com',
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $service->fresh(['applications', 'server'])])
+        ->assertSet('domainRows', fn (array $rows): bool => collect($rows)->pluck('url')->all() === ['https://web.example.com'])
+        ->set('domainRows', [['url' => 'https://attacker.example.com']]);
+})->throws(CannotUpdateLockedPropertyException::class);
+
+it('rejects a client update of the docker image list', function () {
+    $imageId = 'sha256:'.str_repeat('a', 64);
+    Process::fake([
+        '*docker image ls*' => Process::result(output: json_encode(['Repository' => 'nginx', 'Tag' => '1.27', 'ID' => $imageId, 'Size' => '52.5MB', 'CreatedSince' => '3 weeks ago'])),
+        '*docker ps -a*' => Process::result(output: "{$imageId}#/web\n"),
+        '*docker system df*' => Process::result(output: ''),
+        '*docker image rm*' => Process::result(output: 'Deleted'),
+    ]);
+
+    Livewire::test(DockerImages::class, ['server_uuid' => $this->server->uuid])
+        ->call('load')
+        ->assertSet('images.0.containers', ['web'])
+        ->set('images.0.containers', []);
+})->throws(CannotUpdateLockedPropertyException::class);
@@ -0,0 +1,93 @@
+<?php
+
+use App\Livewire\Project\Shared\SecretManagerLinks;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    $this->withoutDefer();
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+    $this->actingAs($this->user);
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+
+    $vaultToken = fn (string $name) => IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'vault',
+        'name' => $name,
+        'token' => 'hvs.token',
+        'capabilities' => ['secrets'],
+        'metadata' => ['base_url' => 'https://vault.internal:8200'],
+    ]);
+    $this->currentToken = $vaultToken('Vault current');
+    $this->nextToken = $vaultToken('Vault next');
+
+    $this->application->secretManagerLink()->create([
+        'integration_token_id' => $this->currentToken->id,
+        'settings' => ['mount' => 'secret', 'path' => 'my-app/production'],
+    ]);
+});
+
+test('switching to a token of the same provider rejects invalid settings and keeps the saved source', function () {
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->set([
+            'settings' => ['mount' => ['nested' => 'value'], 'path' => 'my-app/production'],
+            'integration_token_uuid' => $this->nextToken->uuid,
+        ])
+        ->assertHasErrors(['settings.mount']);
+
+    $link = $this->application->secretManagerLink()->firstOrFail();
+    expect($link->integration_token_id)->toBe($this->currentToken->id)
+        ->and($link->settings)->toBe(['mount' => 'secret', 'path' => 'my-app/production']);
+});
+
+test('switching to a token of the same provider saves only the provider settings fields', function () {
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->set([
+            'settings' => ['mount' => 'kv', 'path' => 'my-app/staging', 'unexpected' => 'value'],
+            'integration_token_uuid' => $this->nextToken->uuid,
+        ])
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    $link = $this->application->secretManagerLink()->firstOrFail();
+    expect($link->integration_token_id)->toBe($this->nextToken->id)
+        ->and($link->settings)->toBe(['mount' => 'kv', 'path' => 'my-app/staging']);
+});
+
+test('switching to a token of the same provider keeps working while the settings are still empty', function () {
+    $this->application->secretManagerLink()->update(['settings' => null]);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->set('integration_token_uuid', $this->nextToken->uuid)
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    $link = $this->application->secretManagerLink()->firstOrFail();
+    expect($link->integration_token_id)->toBe($this->nextToken->id)
+        ->and($link->settings)->toBeNull();
+});