From e58e4900612a58e626dfd3f24a65594670f1bfeb Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 11 Oct 2026 16:53:35 +0200
Subject: [PATCH] fix(api): link to API settings where disabled API blocks a
 feature

---
 .../components/api-disabled-callout.blade.php | 14 ++++
 .../project/shared/webhooks.blade.php         |  4 +
 .../livewire/security/api-tokens.blade.php    | 16 ++--
 tests/Feature/ApiDisabledCalloutTest.php      | 79 +++++++++++++++++++
 4 files changed, 106 insertions(+), 7 deletions(-)
 create mode 100644 resources/views/components/api-disabled-callout.blade.php
 create mode 100644 tests/Feature/ApiDisabledCalloutTest.php

diff --git a/resources/views/components/api-disabled-callout.blade.php b/resources/views/components/api-disabled-callout.blade.php
new file mode 100644
index 0000000000..1bc9dec11e
--- /dev/null
+++ b/resources/views/components/api-disabled-callout.blade.php
@@ -0,0 +1,14 @@
+@props(['message' => 'This feature uses the Coolify API.'])
+
+@unless (instanceSettings()->is_api_enabled)
+    <x-callout type="warning" title="API access is turned off" {{ $attributes }}>
+        {{ $message }}
+        @if (isInstanceAdmin())
+            <div class="mt-2">
+                <a href="{{ route('settings.advanced') }}" class="button" {{ wireNavigate() }}>Enable API access</a>
+            </div>
+        @else
+            Ask an instance admin to enable API access.
+        @endif
+    </x-callout>
+@endunless
diff --git a/resources/views/livewire/project/shared/webhooks.blade.php b/resources/views/livewire/project/shared/webhooks.blade.php
index 3e332bf440..8e5483b283 100644
--- a/resources/views/livewire/project/shared/webhooks.blade.php
+++ b/resources/views/livewire/project/shared/webhooks.blade.php
@@ -43,6 +43,8 @@
                         <x-external-link />
                     </a>
                 </x-slot:actions>
+                <x-api-disabled-callout class="mb-4"
+                    message="Enable API access before external services can call the deploy webhook." />
                 <x-forms.copy-input label="Deploy webhook URL" :text="$deploywebhook ?? ''" />
             </x-application.settings-section>
 
@@ -117,6 +119,8 @@
                         <x-external-link />
                     </a>
                 </x-slot:actions>
+                <x-api-disabled-callout class="mb-4"
+                    message="Enable API access before external services can call the deploy webhook." />
                 <x-forms.copy-input label="Deploy webhook URL" :text="$deploywebhook ?? ''" />
             </x-application.settings-section>
         </div>
diff --git a/resources/views/livewire/security/api-tokens.blade.php b/resources/views/livewire/security/api-tokens.blade.php
index ddffd51094..8b05a0679b 100644
--- a/resources/views/livewire/security/api-tokens.blade.php
+++ b/resources/views/livewire/security/api-tokens.blade.php
@@ -10,13 +10,15 @@
             <x-application.settings-section title="API disabled"
                 description="Enable the Coolify API before creating access tokens.">
                 <x-empty title="API access is turned off"
-                    description="Enable API access in instance settings to issue tokens." icon-name="keys"
-                    size="sm">
-                    <x-slot:actions>
-                        <a href="{{ route('settings.advanced') }}" class="button" {{ wireNavigate() }}>
-                            Open settings
-                        </a>
-                    </x-slot:actions>
+                    description="{{ isInstanceAdmin() ? 'Enable API access in instance settings to issue tokens.' : 'Ask an instance admin to enable API access.' }}"
+                    icon-name="keys" size="sm">
+                    @if (isInstanceAdmin())
+                        <x-slot:actions>
+                            <a href="{{ route('settings.advanced') }}" class="button" {{ wireNavigate() }}>
+                                Enable API access
+                            </a>
+                        </x-slot:actions>
+                    @endif
                 </x-empty>
             </x-application.settings-section>
         </div>
diff --git a/tests/Feature/ApiDisabledCalloutTest.php b/tests/Feature/ApiDisabledCalloutTest.php
new file mode 100644
index 0000000000..7f6ca8f6f8
--- /dev/null
+++ b/tests/Feature/ApiDisabledCalloutTest.php
@@ -0,0 +1,79 @@
+<?php
+
+use App\Livewire\Project\Shared\Webhooks;
+use App\Livewire\Security\ApiTokens;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Server::flushIdentityMap();
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => false]);
+
+    $this->rootTeam = Team::factory()->create(['id' => 0]);
+    $this->instanceAdmin = User::factory()->create();
+    $this->rootTeam->members()->attach($this->instanceAdmin->id, ['role' => 'admin']);
+
+    $this->team = Team::factory()->create();
+    $this->teamAdmin = User::factory()->create();
+    $this->team->members()->attach($this->teamAdmin->id, ['role' => 'admin']);
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+});
+
+afterEach(function () {
+    Server::flushIdentityMap();
+});
+
+it('links instance admins to the API settings when the API is disabled', function (string $component) {
+    $this->actingAs($this->instanceAdmin);
+    session(['currentTeam' => $this->rootTeam]);
+
+    $params = $component === Webhooks::class ? ['resource' => $this->application] : [];
+
+    Livewire::test($component, $params)
+        ->assertSee('API access is turned off')
+        ->assertSee(route('settings.advanced'))
+        ->assertSee('Enable API access');
+})->with(['webhooks' => Webhooks::class, 'api tokens' => ApiTokens::class]);
+
+it('tells other users to ask an instance admin when the API is disabled', function (string $component) {
+    $this->actingAs($this->teamAdmin);
+    session(['currentTeam' => $this->team]);
+
+    $params = $component === Webhooks::class ? ['resource' => $this->application] : [];
+
+    Livewire::test($component, $params)
+        ->assertSee('API access is turned off')
+        ->assertSee('Ask an instance admin to enable API access.')
+        ->assertDontSee(route('settings.advanced'));
+})->with(['webhooks' => Webhooks::class, 'api tokens' => ApiTokens::class]);
+
+it('does not show the API notice on the webhooks page when the API is enabled', function () {
+    InstanceSettings::query()->whereKey(0)->update(['is_api_enabled' => true]);
+    Once::flush();
+    $this->actingAs($this->teamAdmin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Webhooks::class, ['resource' => $this->application])
+        ->assertDontSee('API access is turned off');
+});