fix(api): require the deploy ability for database imports from a server path

An import with source=server reads a file at an absolute path on the
server, but it needed only the write ability.

- Return 403 without the deploy or root ability, the same as other host
  paths outside the resource directory

app/Http/Controllers/Api/Concerns/HandlesDatabaseImportsApi.php

@@ -82,6 +82,12 @@ trait HandlesDatabaseImportsApi
 
             return response()->json(['message' => 'Validation failed.', 'errors' => $errors], 422);
         }
+        // A server import reads any absolute path on the host, so it needs the same permission as host mounts outside the resource directory.
+        if ($payload['source'] === 'server' && ! $request->user()->tokenCan('deploy') && ! $request->user()->tokenCan('root')) {
+            return response()->json([
+                'message' => 'Missing required permissions: deploy. An import from a server path needs a token with the deploy permission.',
+            ], 403);
+        }
 
         try {
             $source = new DatabaseImportSource((string) $payload['source'], $payload['upload_id'] ?? null, $payload['path'] ?? null, $payload['s3_storage_uuid'] ?? null, (bool) ($payload['dump_all'] ?? false), (bool) ($payload['replace_existing'] ?? false), (bool) ($payload['keep_owners'] ?? false), isset($payload['sqlite_database']) ? (string) $payload['sqlite_database'] : null, (bool) ($payload['restore_mysql_users'] ?? false));

tests/Feature/Api/DatabaseImportApiTest.php

@@ -26,7 +26,7 @@ beforeEach(function () {
     $this->user = User::factory()->create();
     $this->team->members()->attach($this->user, ['role' => 'owner']);
     session(['currentTeam' => $this->team]);
-    $this->token = $this->user->tokens()->create(['name' => 'imports', 'token' => hash('sha256', 'secret'), 'abilities' => ['write', 'read'], 'team_id' => $this->team->id]);
+    $this->token = $this->user->tokens()->create(['name' => 'imports', 'token' => hash('sha256', 'secret'), 'abilities' => ['write', 'read', 'deploy'], 'team_id' => $this->team->id]);
     $this->headers = ['Authorization' => 'Bearer '.$this->token->id.'|secret'];
     $this->server = Server::factory()->create(['team_id' => $this->team->id]);
     $this->destination = StandaloneDocker::firstOrCreate(['server_id' => $this->server->id, 'network' => 'coolify'], ['uuid' => (string) Str::uuid(), 'name' => 'docker']);

tests/Feature/Api/DatabaseImportServerSourceDeployAbilityApiTest.php

@@ -0,0 +1,89 @@
+<?php
+
+use App\Actions\Database\StartDatabaseImport;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+use Spatie\Activitylog\Models\Activity;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::firstOrCreate(['server_id' => $server->id, 'network' => 'coolify'], ['uuid' => (string) Str::uuid(), 'name' => 'docker']);
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $database = StandalonePostgresql::create(['uuid' => (string) Str::uuid(), 'name' => 'db', 'postgres_user' => 'postgres', 'postgres_password' => 'password', 'postgres_db' => 'db', 'image' => 'postgres:17', 'status' => 'running', 'environment_id' => $environment->id, 'destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass()]);
+    $service = Service::factory()->create(['environment_id' => $environment->id, 'server_id' => $server->id, 'destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass(), 'docker_compose_raw' => "services:\n  postgres:\n    image: postgres:17\n"]);
+    $serviceDatabase = ServiceDatabase::create(['uuid' => (string) Str::uuid(), 'name' => 'postgres', 'service_id' => $service->id, 'image' => 'postgres:17']);
+
+    $this->importPaths = [
+        'standalone' => "/api/v1/databases/{$database->uuid}/imports",
+        'service' => "/api/v1/services/{$service->uuid}/databases/{$serviceDatabase->uuid}/imports",
+    ];
+});
+
+function serverSourceImportToken(User $user, Team $team, array $abilities): string
+{
+    $token = $user->createToken('server-source-import', $abilities);
+    $token->accessToken->forceFill(['team_id' => $team->id])->save();
+
+    return $token->plainTextToken;
+}
+
+function expectServerSourceImportStarts(): void
+{
+    $activity = Activity::create(['log_name' => 'default', 'description' => 'queued', 'properties' => ['status' => 'queued']]);
+    $action = Mockery::mock(StartDatabaseImport::class);
+    $action->shouldReceive('handle')->once()->andReturn($activity);
+    app()->instance(StartDatabaseImport::class, $action);
+}
+
+dataset('server source import variants', ['standalone', 'service']);
+
+test('a write token cannot import from a server path', function (string $variant) {
+    $action = Mockery::mock(StartDatabaseImport::class);
+    $action->shouldNotReceive('handle');
+    app()->instance(StartDatabaseImport::class, $action);
+
+    $this->withToken(serverSourceImportToken($this->user, $this->team, ['read', 'write']))
+        ->postJson($this->importPaths[$variant], ['source' => 'server', 'path' => '/etc/hostname'])
+        ->assertForbidden()
+        ->assertJsonPath('message', 'Missing required permissions: deploy. An import from a server path needs a token with the deploy permission.');
+})->with('server source import variants');
+
+test('a write token with deploy or a root token can import from a server path', function (string $variant, array $abilities) {
+    expectServerSourceImportStarts();
+
+    $this->withToken(serverSourceImportToken($this->user, $this->team, $abilities))
+        ->postJson($this->importPaths[$variant], ['source' => 'server', 'path' => '/tmp/backup.sql'])
+        ->assertAccepted();
+})->with('server source import variants')->with([
+    'write and deploy' => [['read', 'write', 'deploy']],
+    'root' => [['root']],
+]);
+
+test('a write token can still import from an upload without deploy', function () {
+    expectServerSourceImportStarts();
+
+    $this->withToken(serverSourceImportToken($this->user, $this->team, ['read', 'write']))
+        ->postJson($this->importPaths['standalone'], ['source' => 'upload', 'upload_id' => (string) Str::uuid()])
+        ->assertAccepted();
+});