feat(security): add integration token editing and rotation

2026-08-24 02:24:11 -05:00 · 2026-08-18 16:24:53 +02:00
parent 85e0821dd4
commit da8665330b
5 changed files with 329 additions and 27 deletions
@@ -0,0 +1,114 @@
+<?php
+
+namespace App\Livewire\Security;
+
+use App\Models\IntegrationToken;
+use App\Services\CloudflareTokenValidator;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class IntegrationTokenEditor extends Component
+{
+    use AuthorizesRequests;
+
+    public IntegrationToken $integrationToken;
+
+    public string $name = '';
+
+    public string $newToken = '';
+
+    public array $capabilities = [];
+
+    public function mount(string $integration_token_uuid): void
+    {
+        $this->integrationToken = IntegrationToken::ownedByCurrentTeam()
+            ->whereUuid($integration_token_uuid)
+            ->firstOrFail();
+
+        $this->authorize('view', $this->integrationToken);
+
+        $this->name = $this->integrationToken->name;
+        $this->capabilities = $this->integrationToken->capabilities;
+    }
+
+    protected function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'newToken' => ['nullable', 'string'],
+            'capabilities' => ['required', 'array', 'min:1'],
+            'capabilities.*' => ['required', 'in:dns'],
+        ];
+    }
+
+    protected function messages(): array
+    {
+        return [
+            'capabilities.required' => 'Select at least one capability.',
+            'capabilities.min' => 'Select at least one capability.',
+        ];
+    }
+
+    public function save(CloudflareTokenValidator $validator): void
+    {
+        $this->authorize('update', $this->integrationToken);
+        $validated = $this->validate();
+        $token = filled($validated['newToken']) ? $validated['newToken'] : $this->integrationToken->token;
+        $capabilitiesChanged = collect($validated['capabilities'])->sort()->values()->all()
+            !== collect($this->integrationToken->capabilities)->sort()->values()->all();
+
+        try {
+            if ((filled($validated['newToken']) || $capabilitiesChanged)
+                && ! $validator->validate($token, $validated['capabilities'])) {
+                $this->dispatch('error', 'The token could not access the selected Cloudflare capabilities. Check its permissions and zone resources.');
+
+                return;
+            }
+
+            $updates = [
+                'name' => $validated['name'],
+                'capabilities' => $validated['capabilities'],
+            ];
+
+            if (filled($validated['newToken'])) {
+                $updates['token'] = $validated['newToken'];
+            }
+
+            $this->integrationToken->update($updates);
+            $this->newToken = '';
+
+            auditLog('ui.integration_token.updated', [
+                'team_id' => currentTeam()->id,
+                'integration_token_uuid' => $this->integrationToken->uuid,
+                'integration_token_name' => $this->integrationToken->name,
+                'provider' => $this->integrationToken->provider,
+                'rotated' => array_key_exists('token', $updates),
+            ]);
+
+            $this->dispatch(
+                'integration-token-updated',
+                uuid: $this->integrationToken->uuid,
+                name: $this->integrationToken->name,
+                capabilities: $this->integrationToken->capabilities,
+            );
+            $this->dispatch('success', 'Integration token updated successfully.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function delete(string $password = ''): void
+    {
+        $this->authorize('delete', $this->integrationToken);
+        $this->integrationToken->delete();
+
+        $this->dispatch('integration-token-deleted', uuid: $this->integrationToken->uuid);
+        $this->dispatch('close-modal');
+        $this->dispatch('success', 'Integration token deleted successfully.');
+    }
+
+    public function render()
+    {
+        return view('livewire.security.integration-token-editor');
+    }
+}
@@ -17,6 +17,16 @@ class IntegrationTokenPolicy
        return $user->isAdmin();
    }

+    public function view(User $user, IntegrationToken $integrationToken): bool
+    {
+        return $user->isAdmin() && $integrationToken->team_id === currentTeam()->id;
+    }
+
+    public function update(User $user, IntegrationToken $integrationToken): bool
+    {
+        return $user->isAdmin() && $integrationToken->team_id === currentTeam()->id;
+    }
+
    public function delete(User $user, IntegrationToken $integrationToken): bool
    {
        return $user->isAdmin() && $integrationToken->team_id === currentTeam()->id;
@@ -0,0 +1,52 @@
+<div class="w-full">
+    <form class="application-settings-form flex w-full flex-col gap-4" wire:submit="save">
+        <div class="grid gap-4 lg:grid-cols-2">
+            <x-forms.input required id="name" label="Token name" />
+            <x-forms.input readonly label="Provider" value="Cloudflare" />
+            <div class="lg:col-span-2">
+                <x-forms.input type="password" id="newToken" label="New API token"
+                    placeholder="Leave blank to keep the current token"
+                    helper="Paste a replacement token to rotate this credential." />
+            </div>
+        </div>
+
+        <fieldset>
+            <legend class="text-sm font-medium text-black dark:text-fg">Capabilities</legend>
+            <div class="mt-3 rounded-lg border border-neutral-200 p-1 dark:border-white/[0.08]">
+                <x-forms.checkbox id="edit-dns-capability" label="DNS" domValue="dns" fullWidth
+                    wire:model.live="capabilities" />
+                <p class="px-2.5 pb-2 text-[11px] text-neutral-500 dark:text-fg-dim">
+                    Manage Cloudflare DNS records.
+                </p>
+            </div>
+            @error('capabilities')
+                <span class="text-xs text-red-500">{{ $message }}</span>
+            @enderror
+        </fieldset>
+
+        @if (in_array('dns', $capabilities, true))
+            <div class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+                <div class="font-medium text-black dark:text-fg">Required Cloudflare permissions</div>
+                <ul class="list-inside list-disc">
+                    <li>Zone - DNS - Edit</li>
+                    <li>Zone - Zone - Read</li>
+                </ul>
+                <a href="https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%5D&amp;accountId=%2A&amp;zoneId=all&amp;name=Coolify%20DNS%20Management"
+                    target="_blank" rel="noopener noreferrer"
+                    class="font-medium text-coollabs hover:underline dark:text-warning">
+                    Create a replacement token in Cloudflare
+                </a>
+            </div>
+        @endif
+
+        <div class="flex items-center justify-between gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+            <x-modal-confirmation title="Delete integration token?" isErrorButton buttonTitle="Delete"
+                submitAction="delete" :actions="['This integration token will be permanently deleted.']"
+                confirmationText="{{ $integrationToken->name }}" :confirmWithPassword="false"
+                step2ButtonText="Delete token" />
+            <x-forms.button type="submit" wire:target="save" isHighlighted>
+                Validate and save
+            </x-forms.button>
+        </div>
+    </form>
+</div>
@@ -30,34 +30,50 @@
                    <div class="divide-y divide-neutral-200 dark:divide-white/[0.07]">
                        @foreach ($tokens as $savedToken)
                            <div wire:key="integration-token-{{ $savedToken->id }}"
-                                class="grid min-h-14 grid-cols-[minmax(0,1fr)_8rem_minmax(0,1fr)_2rem] items-center gap-3 px-4 py-2.5">
-                                <div class="min-w-0">
-                                    <h3 class="truncate text-[13px]! font-semibold! text-black dark:text-fg">
-                                        {{ $savedToken->name }}
-                                    </h3>
-                                </div>
-                                <div class="text-center text-[12px] text-neutral-500 dark:text-fg-dim">
-                                    {{ ucfirst($savedToken->provider) }}
-                                </div>
-                                <div class="flex flex-wrap gap-1">
-                                    @foreach ($savedToken->capabilities ?? [] as $capability)
-                                        <span class="rounded-full bg-neutral-100 px-2 py-0.5 text-[10px] font-medium uppercase text-neutral-600 dark:bg-white/[0.06] dark:text-fg-dim">
-                                            {{ $capability }}
-                                        </span>
-                                    @endforeach
-                                </div>
-                                <x-modal-confirmation title="Delete integration token?" isErrorButton
-                                    submitAction="deleteToken({{ $savedToken->id }})"
-                                    confirmationText="{{ $savedToken->name }}"
-                                    confirmationLabel="Enter the token name to confirm"
-                                    shortConfirmationLabel="Token name" :confirmWithPassword="false"
-                                    step2ButtonText="Delete token">
-                                    <x-slot:trigger>
-                                        <button type="button" class="icon-button" title="Delete token">
-                                            <x-reicon name="trash" class="size-3.5" />
+                                x-data="{
+                                    visible: true,
+                                    tokenName: @js($savedToken->name),
+                                    tokenCapabilities: @js($savedToken->capabilities),
+                                }"
+                                x-show="visible"
+                                x-on:integration-token-updated.window="
+                                    if ($event.detail.uuid === @js($savedToken->uuid)) {
+                                        tokenName = $event.detail.name;
+                                        tokenCapabilities = $event.detail.capabilities;
+                                    }
+                                "
+                                x-on:integration-token-deleted.window="
+                                    if ($event.detail.uuid === @js($savedToken->uuid)) visible = false
+                                ">
+                            <x-modal-input title="Edit Integration Token" isFullWidth :wireIgnore="false"
+                                :contentClicks="false"
+                                class="border-b border-neutral-200 last:border-b-0 dark:border-white/[0.07]">
+                                <x-slot:content>
+                                    <div class="grid min-h-14 w-full grid-cols-[minmax(0,1fr)_8rem_minmax(0,1fr)_2rem] items-center gap-3 px-4 py-2.5 text-left transition-colors hover:bg-neutral-50 dark:hover:bg-white/[0.025]">
+                                        <div class="min-w-0">
+                                            <h3 class="truncate text-[13px]! font-semibold! text-black dark:text-fg">
+                                                <span x-text="tokenName"></span>
+                                            </h3>
+                                        </div>
+                                        <div class="text-center text-[12px] text-neutral-500 dark:text-fg-dim">
+                                            {{ ucfirst($savedToken->provider) }}
+                                        </div>
+                                        <div class="flex flex-wrap gap-1">
+                                            <template x-for="capability in tokenCapabilities" :key="capability">
+                                                <span x-text="capability"
+                                                    class="rounded-full bg-neutral-100 px-2 py-0.5 text-[10px] font-medium uppercase text-neutral-600 dark:bg-white/[0.06] dark:text-fg-dim"></span>
+                                            </template>
+                                        </div>
+                                        <button type="button" class="icon-button" title="Edit integration token"
+                                            :aria-label="`Edit ${tokenName}`" @click="modalOpen=true">
+                                            <x-reicon name="settings" class="size-3.5" />
                                        </button>
-                                    </x-slot:trigger>
-                                </x-modal-confirmation>
+                                    </div>
+                                </x-slot:content>
+                                <livewire:security.integration-token-editor
+                                    :integration_token_uuid="$savedToken->uuid"
+                                    :key="'integration-token-editor-'.$savedToken->uuid" />
+                            </x-modal-input>
                            </div>
                        @endforeach
                    </div>
@@ -1,5 +1,6 @@
 <?php

+use App\Livewire\Security\IntegrationTokenEditor;
 use App\Livewire\Security\IntegrationTokenForm;
 use App\Livewire\Security\IntegrationTokens;
 use App\Models\InstanceSettings;
@@ -141,3 +142,112 @@ test('submit button uses the shared highlighted loading state', function () {
        ->toContain('wire:target="addToken" isHighlighted')
        ->not->toContain('class="button-highlighted"');
 });
+
+test('saved integration token rows render modal editors with a gear button', function () {
+    IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'cloudflare',
+        'name' => 'Production DNS',
+        'token' => 'original-token',
+        'capabilities' => ['dns'],
+    ]);
+
+    Livewire::test(IntegrationTokens::class)
+        ->assertSee('Edit Integration Token')
+        ->assertSee('Production DNS')
+        ->assertSeeHtml(':aria-label="`Edit ${tokenName}`"');
+});
+
+test('an integration token can be rotated after validating its capabilities', function () {
+    Http::fake([
+        'https://api.cloudflare.com/client/v4/user/tokens/verify' => Http::response([
+            'success' => true,
+            'result' => ['status' => 'active'],
+        ]),
+        'https://api.cloudflare.com/client/v4/zones?per_page=1' => Http::response([
+            'success' => true,
+            'result' => [['id' => 'zone-id']],
+        ]),
+        'https://api.cloudflare.com/client/v4/zones/zone-id/dns_records?per_page=1' => Http::response([
+            'success' => true,
+            'result' => [],
+        ]),
+    ]);
+
+    $savedToken = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'cloudflare',
+        'name' => 'Production DNS',
+        'token' => 'original-token',
+        'capabilities' => ['dns'],
+    ]);
+
+    Livewire::test(IntegrationTokenEditor::class, ['integration_token_uuid' => $savedToken->uuid])
+        ->set('name', 'Rotated DNS')
+        ->set('newToken', 'rotated-token')
+        ->call('save')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    $savedToken->refresh();
+
+    expect($savedToken->name)->toBe('Rotated DNS')
+        ->and($savedToken->token)->toBe('rotated-token');
+});
+
+test('leaving the token field blank keeps the existing integration token', function () {
+    Http::fake();
+
+    $savedToken = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'cloudflare',
+        'name' => 'Production DNS',
+        'token' => 'original-token',
+        'capabilities' => ['dns'],
+    ]);
+
+    Livewire::test(IntegrationTokenEditor::class, ['integration_token_uuid' => $savedToken->uuid])
+        ->set('name', 'Renamed DNS')
+        ->set('newToken', '')
+        ->call('save')
+        ->assertHasNoErrors();
+
+    $savedToken->refresh();
+
+    expect($savedToken->name)->toBe('Renamed DNS')
+        ->and($savedToken->token)->toBe('original-token');
+
+    Http::assertNothingSent();
+});
+
+test('an invalid replacement does not rotate the integration token', function () {
+    Http::fake([
+        'https://api.cloudflare.com/client/v4/user/tokens/verify' => Http::response([
+            'success' => false,
+        ], 403),
+    ]);
+
+    $savedToken = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'cloudflare',
+        'name' => 'Production DNS',
+        'token' => 'original-token',
+        'capabilities' => ['dns'],
+    ]);
+
+    Livewire::test(IntegrationTokenEditor::class, ['integration_token_uuid' => $savedToken->uuid])
+        ->set('newToken', 'invalid-token')
+        ->call('save')
+        ->assertDispatched('error');
+
+    expect($savedToken->fresh()->token)->toBe('original-token');
+});
+
+test('editor updates its row without rerendering the teleported parent modal', function () {
+    $component = file_get_contents(app_path('Livewire/Security/IntegrationTokenEditor.php'));
+
+    expect($component)
+        ->toContain("'integration-token-updated'")
+        ->toContain("'integration-token-deleted'")
+        ->not->toContain('integrationTokenChanged');
+});