mirror of
https://github.com/coollabsio/coolify.git
synced 2026-11-15 09:12:32 -04:00
Andras Bacsai
c75e7078b7
- Require the write permission and update policy to open a preview or change its pull request URL, git type, or docker tag via the API; deploy-only tokens can only redeploy an existing preview - Reject rollbacks to commits that are neither a listed rollback image nor a successful production deployment (GetRollbackImages::allows) - Validate git_repository with ValidGitRepositoryUrl when it changes on application update - Add RejectPublishedAppKey global middleware - Show a "still starting" message when the root setup window is pending - Document the new 403 responses and constraints in the OpenAPI spec - Add tests for the new checks
43 lines
1.1 KiB
PHP
43 lines
1.1 KiB
PHP
<?php
|
|
|
|
namespace App\Support;
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Support\Facades\Cache;
|
|
|
|
/**
|
|
* The first registration creates the root user. It is allowed only for a short time after
|
|
* Coolify starts, so a bot cannot claim a fresh install. A restart opens the window again.
|
|
*/
|
|
class RootSetupWindow
|
|
{
|
|
public const MINUTES = 10;
|
|
|
|
private const CACHE_KEY = 'root-setup-window-closes-at';
|
|
|
|
/**
|
|
* The key has no TTL: app:init clears the cache before it calls this, so a missing key
|
|
* means that Coolify has not finished starting, not that the window is closed.
|
|
*/
|
|
public static function openIfNoUserExists(): void
|
|
{
|
|
if (User::query()->exists()) {
|
|
return;
|
|
}
|
|
|
|
Cache::forever(self::CACHE_KEY, now()->addMinutes(self::MINUTES)->getTimestamp());
|
|
}
|
|
|
|
public static function isOpen(): bool
|
|
{
|
|
$closesAt = Cache::get(self::CACHE_KEY);
|
|
|
|
return is_int($closesAt) && now()->getTimestamp() < $closesAt;
|
|
}
|
|
|
|
public static function isPending(): bool
|
|
{
|
|
return ! Cache::has(self::CACHE_KEY);
|
|
}
|
|
}
|