'file']); InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]); $this->team = Team::factory()->create(); $this->user = User::factory()->create(); $this->user->teams()->attach($this->team, ['role' => 'owner']); $this->otherTeam = Team::factory()->create(); session(['currentTeam' => $this->team]); $this->privateKey = PrivateKey::withoutEvents(fn () => PrivateKey::forceCreate([ 'uuid' => (string) Str::uuid(), 'name' => 'IDOR test key', 'private_key' => 'test-private-key', 'team_id' => $this->team->id, ])); $token = $this->user->createToken('idor-hardening', ['*']); $token->accessToken->forceFill(['team_id' => $this->team->id])->save(); $this->token = $token->plainTextToken; }); test('server creation returns a consistent duplicate address response', function () { $ownServer = Server::factory()->create([ 'ip' => '192.0.2.10', 'team_id' => $this->team->id, ]); $otherServer = Server::factory()->create([ 'ip' => '192.0.2.20', 'team_id' => $this->otherTeam->id, ]); $payload = fn (Server $server): array => [ 'name' => 'Duplicate server', 'ip' => $server->ip, 'private_key_uuid' => $this->privateKey->uuid, 'user' => 'root', ]; $ownResponse = $this->withToken($this->token)->postJson('/api/v1/servers', $payload($ownServer)); $otherResponse = $this->withToken($this->token)->postJson('/api/v1/servers', $payload($otherServer)); $ownResponse->assertBadRequest(); $otherResponse->assertBadRequest(); expect($ownResponse->json('message')) ->toBe('A server with this IP/Domain is already in use.') ->toBe($otherResponse->json('message')); }); test('environment details applies the project view policy', function () { $project = Project::factory()->create(['team_id' => $this->team->id]); $environment = Environment::factory()->create(['project_id' => $project->id]); Gate::before(fn (User $user, string $ability): ?bool => $ability === 'view' ? false : null); $this->withToken($this->token) ->getJson("/api/v1/projects/{$project->uuid}/{$environment->uuid}") ->assertForbidden(); }); test('docker cleanup execution selection only uses the mounted server', function () { $this->actingAs($this->user); $server = Server::factory()->create(['team_id' => $this->team->id]); $otherServer = Server::factory()->create(['team_id' => $this->otherTeam->id]); $otherExecution = DockerCleanupExecution::create([ 'server_id' => $otherServer->id, 'status' => 'success', 'message' => 'other team cleanup output', ]); Livewire::test(DockerCleanupExecutions::class, ['server' => $server]) ->call('selectExecution', $otherExecution->id) ->assertSet('selectedExecution', null); }); test('scheduled task form only mounts applications from the current team', function () { $this->actingAs($this->user); $server = Server::factory()->create(['team_id' => $this->otherTeam->id]); $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail(); $project = Project::factory()->create(['team_id' => $this->otherTeam->id]); $environment = Environment::factory()->create(['project_id' => $project->id]); $application = Application::factory()->create([ 'environment_id' => $environment->id, 'destination_id' => $destination->id, 'destination_type' => $destination->getMorphClass(), ]); Livewire::test(Add::class, [ 'id' => (string) $application->id, 'type' => 'application', 'containerNames' => collect(), ]); })->throws(ModelNotFoundException::class);