starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-11-06 13:10:37 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(shared-variables): show server variable values only to admins

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Andras Bacsai
2026-09-28 12:40:16 +02:00
co-authored by Claude Opus 5.5
parent 1e910394fd
commit c6fd0a0b0d
2 changed files with 31 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Livewire/SharedVariables/Server/Show.php
+6 -1
View File
@@ -75,7 +75,12 @@ class Show extends Component
private function formatEnvironmentVariables($variables)
{
return $variables->map(function ($item) {
$isMember = auth()->user()?->isMember();
return $variables->map(function ($item) use ($isMember) {
if ($isMember) {
return "$item->key=(Hidden, only admins can view)";
}
if ($item->is_shown_once) {
return "$item->key=(Locked Secret, delete and add again to change)";
}
tests/Feature/SharedVariableDevViewTest.php
+25
View File
@@ -203,3 +203,28 @@ test('server built-ins are visible to team members but not other teams', functio
->assertRedirect(route('dashboard'))
->assertDontSee($otherServer->uuid);
});
test('server shared variable values are only visible to admins', function () {
$server = Server::factory()->create(['team_id' => $this->team->id]);
SharedEnvironmentVariable::create([
'key' => 'SERVER_TOKEN',
'value' => 'stored-server-variable-value',
'type' => 'server',
'server_id' => $server->id,
'team_id' => $this->team->id,
]);
Livewire::test(App\Livewire\SharedVariables\Server\Show::class, ['server_uuid' => $server->uuid])
->assertSet('variables', 'SERVER_TOKEN=stored-server-variable-value');
$this->user->teams()->updateExistingPivot($this->team->id, ['role' => 'member']);
$this->actingAs($this->user->fresh());
$component = Livewire::test(App\Livewire\SharedVariables\Server\Show::class, ['server_uuid' => $server->uuid])
->assertSet('variables', 'SERVER_TOKEN=(Hidden, only admins can view)')
->call('switch')
->call('refreshEnvs')
->assertSet('variables', 'SERVER_TOKEN=(Hidden, only admins can view)');
expect(json_encode($component->snapshot).$component->html())->not->toContain('stored-server-variable-value');
});