Please copy this token now. For your security, it won't be shown
- again.
+
- @forelse ($tokens as $token)
-
-
Description: {{ $token->name }}
-
Last used: {{ $token->last_used_at ? $token->last_used_at->diffForHumans() : 'Never' }}
-
- @if ($token->abilities)
- Permissions:
- @foreach ($token->abilities as $ability)
-
{{ $ability }}
- @endforeach
+
+
+
Issued Tokens
+ @if ($tokens->count() > 1)
+
+ @endif
+
+
+ @forelse ($tokens as $token)
+
+
+
+ {{ $token->name }}
+ @if ($token->abilities)
+ @foreach ($token->abilities as $ability)
+
+ {{ $ability }}
+
+ @endforeach
+ @endif
+
+
+ Last used: {{ $token->last_used_at ? $token->last_used_at->diffForHumans() : 'Never' }}
+
+
+ @if (auth()->id() === $token->tokenable_id)
+
@endif
-
- @if (auth()->id() === $token->tokenable_id)
-
- @endif
-
- @empty
-
- @endforelse
+ @empty
+
No API tokens found.
+ @endforelse
+
@endif
diff --git a/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php b/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php
new file mode 100644
index 000000000..e30e2ad62
--- /dev/null
+++ b/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php
@@ -0,0 +1,274 @@
+ 0], ['is_api_enabled' => true]);
+
+ $this->team = Team::factory()->create();
+
+ $this->admin = User::factory()->create();
+ $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+ $this->member = User::factory()->create();
+ $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+ $keyId = DB::table('private_keys')->insertGetId([
+ 'uuid' => (string) Str::uuid(),
+ 'name' => 'Test Key',
+ 'private_key' => 'test-key',
+ 'team_id' => $this->team->id,
+ 'created_at' => now(),
+ 'updated_at' => now(),
+ ]);
+
+ $this->server = Server::factory()->create([
+ 'team_id' => $this->team->id,
+ 'private_key_id' => $keyId,
+ ]);
+
+ StandaloneDocker::withoutEvents(function () {
+ $this->destination = StandaloneDocker::firstOrCreate(
+ ['server_id' => $this->server->id, 'network' => 'coolify'],
+ ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+ );
+ });
+
+ $this->project = Project::create([
+ 'uuid' => (string) Str::uuid(),
+ 'name' => 'Test Project',
+ 'team_id' => $this->team->id,
+ ]);
+
+ $this->environment = $this->project->environments()->first();
+
+ $this->application = Application::factory()->create([
+ 'uuid' => (string) Str::uuid(),
+ 'name' => 'Test App',
+ 'environment_id' => $this->environment->id,
+ 'destination_id' => $this->destination->id,
+ 'destination_type' => $this->destination->getMorphClass(),
+ ]);
+
+ $this->unlockedEnv = EnvironmentVariable::create([
+ 'key' => 'UNLOCKED_VAR',
+ 'value' => 'secret-unlocked-value',
+ 'resourceable_type' => Application::class,
+ 'resourceable_id' => $this->application->id,
+ 'is_preview' => false,
+ 'is_shown_once' => false,
+ 'is_multiline' => false,
+ 'is_literal' => false,
+ 'is_runtime' => true,
+ 'is_buildtime' => true,
+ ]);
+
+ $this->lockedEnv = EnvironmentVariable::create([
+ 'key' => 'LOCKED_VAR',
+ 'value' => 'secret-locked-value',
+ 'resourceable_type' => Application::class,
+ 'resourceable_id' => $this->application->id,
+ 'is_preview' => false,
+ 'is_shown_once' => true,
+ 'is_multiline' => false,
+ 'is_literal' => false,
+ 'is_runtime' => true,
+ 'is_buildtime' => true,
+ ]);
+});
+
+// --- Livewire Show component: locked env values ---
+
+test('admin sees unlocked env value in Show component', function () {
+ $this->actingAs($this->admin);
+ session(['currentTeam' => $this->team]);
+
+ $component = Livewire::test(EnvironmentVariableShow::class, [
+ 'env' => $this->unlockedEnv,
+ 'type' => 'application',
+ ]);
+
+ expect($component->get('value'))->toBe('secret-unlocked-value');
+});
+
+test('admin cannot see locked env value in Show component', function () {
+ $this->actingAs($this->admin);
+ session(['currentTeam' => $this->team]);
+
+ $component = Livewire::test(EnvironmentVariableShow::class, [
+ 'env' => $this->lockedEnv,
+ 'type' => 'application',
+ ]);
+
+ expect($component->get('value'))->toBeNull();
+ expect($component->get('real_value'))->toBeNull();
+});
+
+test('member cannot see any env value in Show component', function () {
+ $this->actingAs($this->member);
+ session(['currentTeam' => $this->team]);
+
+ $component = Livewire::test(EnvironmentVariableShow::class, [
+ 'env' => $this->unlockedEnv,
+ 'type' => 'application',
+ ]);
+
+ expect($component->get('value'))->toBeNull();
+ expect($component->get('real_value'))->toBeNull();
+});
+
+test('member has isValueHidden flag set to true', function () {
+ $this->actingAs($this->member);
+ session(['currentTeam' => $this->team]);
+
+ $component = Livewire::test(EnvironmentVariableShow::class, [
+ 'env' => $this->unlockedEnv,
+ 'type' => 'application',
+ ]);
+
+ expect($component->get('isValueHidden'))->toBeTrue();
+});
+
+test('admin has isValueHidden flag set to false', function () {
+ $this->actingAs($this->admin);
+ session(['currentTeam' => $this->team]);
+
+ $component = Livewire::test(EnvironmentVariableShow::class, [
+ 'env' => $this->unlockedEnv,
+ 'type' => 'application',
+ ]);
+
+ expect($component->get('isValueHidden'))->toBeFalse();
+});
+
+// --- Livewire All component: dev view ---
+
+test('admin dev view shows unlocked env value', function () {
+ $this->actingAs($this->admin);
+ session(['currentTeam' => $this->team]);
+
+ $component = Livewire::test(EnvironmentVariableAll::class, [
+ 'resource' => $this->application,
+ ]);
+
+ expect($component->get('variables'))->toContain('UNLOCKED_VAR=secret-unlocked-value');
+});
+
+test('admin dev view hides locked env value', function () {
+ $this->actingAs($this->admin);
+ session(['currentTeam' => $this->team]);
+
+ $component = Livewire::test(EnvironmentVariableAll::class, [
+ 'resource' => $this->application,
+ ]);
+
+ expect($component->get('variables'))->toContain('LOCKED_VAR=(Locked Secret, delete and add again to change)');
+ expect($component->get('variables'))->not->toContain('secret-locked-value');
+});
+
+test('member dev view hides all env values', function () {
+ $this->actingAs($this->member);
+ session(['currentTeam' => $this->team]);
+
+ $component = Livewire::test(EnvironmentVariableAll::class, [
+ 'resource' => $this->application,
+ ]);
+
+ expect($component->get('variables'))->not->toContain('secret-unlocked-value');
+ expect($component->get('variables'))->not->toContain('secret-locked-value');
+ expect($component->get('variables'))->toContain('UNLOCKED_VAR=(Hidden');
+});
+
+// --- API: locked env values hidden ---
+
+test('API hides locked env value even with read:sensitive token', function () {
+ session(['currentTeam' => $this->team]);
+ $token = $this->admin->createToken('admin-sensitive', ['read', 'read:sensitive']);
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$token->plainTextToken,
+ ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
+ $response->assertOk();
+
+ $envs = collect($response->json());
+ $locked = $envs->firstWhere('key', 'LOCKED_VAR');
+ $unlocked = $envs->firstWhere('key', 'UNLOCKED_VAR');
+
+ expect($locked)->not->toBeNull();
+ expect($locked)->not->toHaveKey('value');
+ expect($locked)->not->toHaveKey('real_value');
+
+ expect($unlocked)->not->toBeNull();
+ expect($unlocked)->toHaveKey('value');
+});
+
+test('API hides locked env value with root token', function () {
+ session(['currentTeam' => $this->team]);
+ $token = $this->admin->createToken('admin-root', ['root']);
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$token->plainTextToken,
+ ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
+ $response->assertOk();
+
+ $envs = collect($response->json());
+ $locked = $envs->firstWhere('key', 'LOCKED_VAR');
+
+ expect($locked)->not->toBeNull();
+ expect($locked)->not->toHaveKey('value');
+ expect($locked)->not->toHaveKey('real_value');
+});
+
+// --- API: member role hides env values ---
+
+test('API hides env values for member even with read:sensitive token', function () {
+ session(['currentTeam' => $this->team]);
+ $token = $this->member->createToken('member-sensitive', ['read', 'read:sensitive']);
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$token->plainTextToken,
+ ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
+ $response->assertOk();
+
+ $envs = collect($response->json());
+ $unlocked = $envs->firstWhere('key', 'UNLOCKED_VAR');
+
+ expect($unlocked)->not->toBeNull();
+ expect($unlocked)->not->toHaveKey('value');
+ expect($unlocked)->not->toHaveKey('real_value');
+});
+
+test('API shows env values for admin with read:sensitive token', function () {
+ session(['currentTeam' => $this->team]);
+ $token = $this->admin->createToken('admin-sensitive-2', ['read', 'read:sensitive']);
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$token->plainTextToken,
+ ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
+ $response->assertOk();
+
+ $envs = collect($response->json());
+ $unlocked = $envs->firstWhere('key', 'UNLOCKED_VAR');
+
+ expect($unlocked)->not->toBeNull();
+ expect($unlocked)->toHaveKey('value');
+});
diff --git a/tests/Feature/Authorization/LegacyMemberTokenTest.php b/tests/Feature/Authorization/LegacyMemberTokenTest.php
new file mode 100644
index 000000000..273327985
--- /dev/null
+++ b/tests/Feature/Authorization/LegacyMemberTokenTest.php
@@ -0,0 +1,127 @@
+ 0, 'is_api_enabled' => true]);
+
+ $this->team = Team::factory()->create();
+ $this->member = User::factory()->create();
+ $this->admin = User::factory()->create();
+
+ $this->team->members()->attach($this->member->id, ['role' => 'member']);
+ $this->team->members()->attach($this->admin->id, ['role' => 'admin']);
+
+ session(['currentTeam' => $this->team]);
+});
+
+function apiRequest($test, string $token, string $method = 'get', string $url = '/api/v1/version')
+{
+ return $test->withHeaders([
+ 'Authorization' => 'Bearer '.$token,
+ 'Content-Type' => 'application/json',
+ ])->{$method.'Json'}($url);
+}
+
+describe('member with legacy elevated token is rejected', function () {
+ test('member with legacy write token gets 403 with descriptive message', function () {
+ $token = $this->member->createToken('legacy-write', ['read', 'write']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(403);
+ $response->assertJsonFragment([
+ 'message' => 'This API token has permissions (write) that exceed your current role as a team member. Members are restricted to read-only API access. Please revoke this token and create a new one with only read permissions.',
+ ]);
+ });
+
+ test('member with legacy deploy token gets 403', function () {
+ $token = $this->member->createToken('legacy-deploy', ['read', 'deploy']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(403);
+ $response->assertSee('deploy');
+ $response->assertSee('revoke this token');
+ });
+
+ test('member with legacy root token gets 403', function () {
+ $token = $this->member->createToken('legacy-root', ['root']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(403);
+ $response->assertSee('root');
+ });
+
+ test('member with legacy read:sensitive token gets 403', function () {
+ $token = $this->member->createToken('legacy-sensitive', ['read', 'read:sensitive']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(403);
+ $response->assertSee('read:sensitive');
+ });
+
+ test('member with legacy write:sensitive token gets 403', function () {
+ $token = $this->member->createToken('legacy-ws', ['read', 'write:sensitive']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(403);
+ $response->assertSee('write:sensitive');
+ });
+
+ test('member with multiple disallowed abilities lists them all', function () {
+ $token = $this->member->createToken('legacy-multi', ['read', 'write', 'deploy', 'read:sensitive']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(403);
+ $json = $response->json();
+ expect($json['message'])->toContain('write');
+ expect($json['message'])->toContain('deploy');
+ expect($json['message'])->toContain('read:sensitive');
+ });
+});
+
+describe('member with read-only token passes through', function () {
+ test('member with read token can access read endpoints', function () {
+ $token = $this->member->createToken('read-only', ['read']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(200);
+ });
+});
+
+describe('admin with elevated token passes through', function () {
+ test('admin with write token is not blocked', function () {
+ $token = $this->admin->createToken('admin-write', ['read', 'write']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(200);
+ });
+
+ test('admin with root token is not blocked', function () {
+ $token = $this->admin->createToken('admin-root', ['root']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(200);
+ });
+
+ test('admin with deploy token is not blocked', function () {
+ $token = $this->admin->createToken('admin-deploy', ['read', 'deploy']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(200);
+ });
+});
diff --git a/tests/Unit/Policies/ApiTokenPolicyTest.php b/tests/Unit/Policies/ApiTokenPolicyTest.php
index 98b59319a..98c60aae8 100644
--- a/tests/Unit/Policies/ApiTokenPolicyTest.php
+++ b/tests/Unit/Policies/ApiTokenPolicyTest.php
@@ -165,3 +165,29 @@ it('denies member from using deploy permissions', function () {
$policy = new ApiTokenPolicy;
expect($policy->useDeployPermissions($user))->toBeFalse();
});
+
+it('allows admin to use sensitive permissions', function () {
+ $user = Mockery::mock(User::class)->makePartial();
+ $user->shouldReceive('isAdmin')->andReturn(true);
+
+ $policy = new ApiTokenPolicy;
+ expect($policy->useSensitivePermissions($user))->toBeTrue();
+});
+
+it('allows owner to use sensitive permissions', function () {
+ $user = Mockery::mock(User::class)->makePartial();
+ $user->shouldReceive('isAdmin')->andReturn(false);
+ $user->shouldReceive('isOwner')->andReturn(true);
+
+ $policy = new ApiTokenPolicy;
+ expect($policy->useSensitivePermissions($user))->toBeTrue();
+});
+
+it('denies member from using sensitive permissions', function () {
+ $user = Mockery::mock(User::class)->makePartial();
+ $user->shouldReceive('isAdmin')->andReturn(false);
+ $user->shouldReceive('isOwner')->andReturn(false);
+
+ $policy = new ApiTokenPolicy;
+ expect($policy->useSensitivePermissions($user))->toBeFalse();
+});
diff --git a/tests/Unit/Policies/S3StoragePolicyTest.php b/tests/Unit/Policies/S3StoragePolicyTest.php
index 4ea580d0f..70ffdf718 100644
--- a/tests/Unit/Policies/S3StoragePolicyTest.php
+++ b/tests/Unit/Policies/S3StoragePolicyTest.php
@@ -52,7 +52,23 @@ it('allows team admin to update S3 storage from their team', function () {
expect($policy->update($user, $storage))->toBeTrue();
});
-it('denies team member to update S3 storage from another team', function () {
+it('denies team member to update S3 storage from their team', function () {
+ $teams = collect([
+ (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+ ]);
+
+ $user = Mockery::mock(User::class)->makePartial();
+ $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+ $storage = Mockery::mock(S3Storage::class)->makePartial();
+ $storage->shouldReceive('getAttribute')->with('team_id')->andReturn(1);
+ $storage->team_id = 1;
+
+ $policy = new S3StoragePolicy;
+ expect($policy->update($user, $storage))->toBeFalse();
+});
+
+it('denies team admin to update S3 storage from another team', function () {
$teams = collect([
(object) ['id' => 1, 'pivot' => (object) ['role' => 'admin']],
]);
@@ -68,9 +84,9 @@ it('denies team member to update S3 storage from another team', function () {
expect($policy->update($user, $storage))->toBeFalse();
});
-it('allows team member to delete S3 storage from their team', function () {
+it('allows team admin to delete S3 storage from their team', function () {
$teams = collect([
- (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+ (object) ['id' => 1, 'pivot' => (object) ['role' => 'admin']],
]);
$user = Mockery::mock(User::class)->makePartial();
@@ -84,7 +100,23 @@ it('allows team member to delete S3 storage from their team', function () {
expect($policy->delete($user, $storage))->toBeTrue();
});
-it('denies team member to delete S3 storage from another team', function () {
+it('denies team member to delete S3 storage from their team', function () {
+ $teams = collect([
+ (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+ ]);
+
+ $user = Mockery::mock(User::class)->makePartial();
+ $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+ $storage = Mockery::mock(S3Storage::class)->makePartial();
+ $storage->shouldReceive('getAttribute')->with('team_id')->andReturn(1);
+ $storage->team_id = 1;
+
+ $policy = new S3StoragePolicy;
+ expect($policy->delete($user, $storage))->toBeFalse();
+});
+
+it('denies team admin to delete S3 storage from another team', function () {
$teams = collect([
(object) ['id' => 1, 'pivot' => (object) ['role' => 'owner']],
]);
@@ -116,9 +148,9 @@ it('denies non-admin to create S3 storage', function () {
expect($policy->create($user))->toBeFalse();
});
-it('allows team member to validate connection of S3 storage from their team', function () {
+it('allows team admin to validate connection of S3 storage from their team', function () {
$teams = collect([
- (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+ (object) ['id' => 1, 'pivot' => (object) ['role' => 'admin']],
]);
$user = Mockery::mock(User::class)->makePartial();
@@ -132,7 +164,23 @@ it('allows team member to validate connection of S3 storage from their team', fu
expect($policy->validateConnection($user, $storage))->toBeTrue();
});
-it('denies team member to validate connection of S3 storage from another team', function () {
+it('denies team member to validate connection of S3 storage from their team', function () {
+ $teams = collect([
+ (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+ ]);
+
+ $user = Mockery::mock(User::class)->makePartial();
+ $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+ $storage = Mockery::mock(S3Storage::class)->makePartial();
+ $storage->shouldReceive('getAttribute')->with('team_id')->andReturn(1);
+ $storage->team_id = 1;
+
+ $policy = new S3StoragePolicy;
+ expect($policy->validateConnection($user, $storage))->toBeFalse();
+});
+
+it('denies team admin to validate connection of S3 storage from another team', function () {
$teams = collect([
(object) ['id' => 1, 'pivot' => (object) ['role' => 'admin']],
]);
From dbbc77830e8ec027022cabc8038ed96526c55eb2 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 27 Feb 2026 11:48:48 +0100
Subject: [PATCH 13/20] fix(storage): add error handling for S3 connection
error notifications
Wrap email notification logic in try-catch to prevent email sending failures from breaking the connection test. If notification fails, log a warning and continue instead of letting the exception propagate.
---
app/Models/S3Storage.php | 28 ++++++++++++++++------------
1 file changed, 16 insertions(+), 12 deletions(-)
diff --git a/app/Models/S3Storage.php b/app/Models/S3Storage.php
index 3aae55966..5d1c3b8b5 100644
--- a/app/Models/S3Storage.php
+++ b/app/Models/S3Storage.php
@@ -127,21 +127,25 @@ class S3Storage extends BaseModel
} catch (\Throwable $e) {
$this->is_usable = false;
if ($this->unusable_email_sent === false && is_transactional_emails_enabled()) {
- $mail = new MailMessage;
- $mail->subject('Coolify: S3 Storage Connection Error');
- $mail->view('emails.s3-connection-error', ['name' => $this->name, 'reason' => $e->getMessage(), 'url' => route('storage.show', ['storage_uuid' => $this->uuid])]);
+ try {
+ $mail = new MailMessage;
+ $mail->subject('Coolify: S3 Storage Connection Error');
+ $mail->view('emails.s3-connection-error', ['name' => $this->name, 'reason' => $e->getMessage(), 'url' => route('storage.show', ['storage_uuid' => $this->uuid])]);
- // Load the team with its members and their roles explicitly
- $team = $this->team()->with(['members' => function ($query) {
- $query->withPivot('role');
- }])->first();
+ // Load the team with its members and their roles explicitly
+ $team = $this->team()->with(['members' => function ($query) {
+ $query->withPivot('role');
+ }])->first();
- // Get admins directly from the pivot relationship for this specific team
- $users = $team->members()->wherePivotIn('role', ['admin', 'owner'])->get(['users.id', 'users.email']);
- foreach ($users as $user) {
- send_user_an_email($mail, $user->email);
+ // Get admins directly from the pivot relationship for this specific team
+ $users = $team->members()->wherePivotIn('role', ['admin', 'owner'])->get(['users.id', 'users.email']);
+ foreach ($users as $user) {
+ send_user_an_email($mail, $user->email);
+ }
+ $this->unusable_email_sent = true;
+ } catch (\Throwable $emailException) {
+ \Log::warning('Failed to send S3 connection error notification: '.$emailException->getMessage());
}
- $this->unusable_email_sent = true;
}
throw $e;
From cebef8e2583d69a50d6483c227ab04fe1a8652df Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 27 Feb 2026 11:54:22 +0100
Subject: [PATCH 14/20] fix(policies): ensure instance-level databases use root
team
Instance-level databases like coolify-db (with id = 0) should always
be assigned to the root team (id = 0) rather than attempting to resolve
their team from the database object itself.
---
app/Policies/DatabasePolicy.php | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/app/Policies/DatabasePolicy.php b/app/Policies/DatabasePolicy.php
index 6a5348224..f62ffdde2 100644
--- a/app/Policies/DatabasePolicy.php
+++ b/app/Policies/DatabasePolicy.php
@@ -109,6 +109,11 @@ class DatabasePolicy
private function getTeamId($database): ?int
{
+ // Instance-level databases (e.g., coolify-db) belong to root team
+ if (isset($database->id) && $database->id === 0) {
+ return 0;
+ }
+
if (method_exists($database, 'team')) {
return $database->team()?->id;
}
From 68f81df0bb13d0715e3f49350e8955cbf058b02f Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 27 Feb 2026 11:59:26 +0100
Subject: [PATCH 15/20] refactor(auth): enforce authorization checks across
livewire components
Add authorization checks to multiple Livewire components to ensure users
have proper permissions before performing sensitive operations. This includes:
- Adding AuthorizesRequests trait to components handling deployments, backups,
services, and configuration uploads
- Enforcing 'deploy', 'update', and 'manageBackups' authorization checks
- Adding instance admin check for system upgrade operations
- Improving database queries with team ownership scope
- Moving backup trigger from component to button with new backupNow() method
---
app/Livewire/Admin/Index.php | 6 +++
.../Project/Application/DeploymentNavbar.php | 6 +++
app/Livewire/Project/Application/Swarm.php | 5 +++
app/Livewire/Project/Database/BackupEdit.php | 12 ++++++
.../Project/Database/BackupExecutions.php | 43 +++++++++++++------
app/Livewire/Project/Service/EditCompose.php | 31 +++++++++----
app/Livewire/Project/Service/StackForm.php | 15 +++++--
app/Livewire/Project/Shared/UploadConfig.php | 12 +++---
app/Livewire/Upgrade.php | 3 ++
.../project/database/backup-edit.blade.php | 2 +-
10 files changed, 105 insertions(+), 30 deletions(-)
diff --git a/app/Livewire/Admin/Index.php b/app/Livewire/Admin/Index.php
index b5f6d2929..c68bba3e8 100644
--- a/app/Livewire/Admin/Index.php
+++ b/app/Livewire/Admin/Index.php
@@ -45,6 +45,9 @@ class Index extends Component
public function submitSearch()
{
+ if (Auth::id() !== 0 && ! session('impersonating')) {
+ return redirect()->route('dashboard');
+ }
if ($this->search !== '') {
$this->foundUsers = User::where(function ($query) {
$query->where('name', 'like', "%{$this->search}%")
@@ -55,6 +58,9 @@ class Index extends Component
public function getSubscribers()
{
+ if (Auth::id() !== 0 && ! session('impersonating')) {
+ return redirect()->route('dashboard');
+ }
$this->inactiveSubscribers = Team::whereRelation('subscription', 'stripe_invoice_paid', false)->count();
$this->activeSubscribers = Team::whereRelation('subscription', 'stripe_invoice_paid', true)->count();
}
diff --git a/app/Livewire/Project/Application/DeploymentNavbar.php b/app/Livewire/Project/Application/DeploymentNavbar.php
index f71b7f753..fcd0d4cf4 100644
--- a/app/Livewire/Project/Application/DeploymentNavbar.php
+++ b/app/Livewire/Project/Application/DeploymentNavbar.php
@@ -52,6 +52,7 @@ class DeploymentNavbar extends Component
public function force_start()
{
try {
+ $this->authorize('deploy', $this->application);
force_start_deployment($this->application_deployment_queue);
} catch (\Throwable $e) {
return handleError($e, $this);
@@ -82,6 +83,11 @@ class DeploymentNavbar extends Component
public function cancel()
{
+ try {
+ $this->authorize('deploy', $this->application);
+ } catch (\Throwable $e) {
+ return handleError($e, $this);
+ }
$deployment_uuid = $this->application_deployment_queue->deployment_uuid;
$kill_command = "docker rm -f {$deployment_uuid}";
$build_server_id = $this->application_deployment_queue->build_server_id ?? $this->application->destination->server_id;
diff --git a/app/Livewire/Project/Application/Swarm.php b/app/Livewire/Project/Application/Swarm.php
index 197dc41ed..94d627e67 100644
--- a/app/Livewire/Project/Application/Swarm.php
+++ b/app/Livewire/Project/Application/Swarm.php
@@ -3,11 +3,14 @@
namespace App\Livewire\Project\Application;
use App\Models\Application;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
use Livewire\Attributes\Validate;
use Livewire\Component;
class Swarm extends Component
{
+ use AuthorizesRequests;
+
public Application $application;
#[Validate('required')]
@@ -51,6 +54,7 @@ class Swarm extends Component
public function instantSave()
{
try {
+ $this->authorize('update', $this->application);
$this->syncData(true);
$this->dispatch('success', 'Swarm settings updated.');
} catch (\Throwable $e) {
@@ -61,6 +65,7 @@ class Swarm extends Component
public function submit()
{
try {
+ $this->authorize('update', $this->application);
$this->syncData(true);
$this->dispatch('success', 'Swarm settings updated.');
} catch (\Throwable $e) {
diff --git a/app/Livewire/Project/Database/BackupEdit.php b/app/Livewire/Project/Database/BackupEdit.php
index 35262d7b0..8b67105cc 100644
--- a/app/Livewire/Project/Database/BackupEdit.php
+++ b/app/Livewire/Project/Database/BackupEdit.php
@@ -201,6 +201,18 @@ class BackupEdit extends Component
}
}
+ public function backupNow()
+ {
+ try {
+ $this->authorize('manageBackups', $this->backup->database);
+
+ \App\Jobs\DatabaseBackupJob::dispatch($this->backup);
+ $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
+ } catch (\Throwable $e) {
+ return handleError($e, $this);
+ }
+ }
+
public function instantSave()
{
try {
diff --git a/app/Livewire/Project/Database/BackupExecutions.php b/app/Livewire/Project/Database/BackupExecutions.php
index 44f903fcc..5ffe6f509 100644
--- a/app/Livewire/Project/Database/BackupExecutions.php
+++ b/app/Livewire/Project/Database/BackupExecutions.php
@@ -3,12 +3,15 @@
namespace App\Livewire\Project\Database;
use App\Models\ScheduledDatabaseBackup;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
use Illuminate\Support\Collection;
use Illuminate\Support\Facades\Auth;
use Livewire\Component;
class BackupExecutions extends Component
{
+ use AuthorizesRequests;
+
public ?ScheduledDatabaseBackup $backup = null;
public $database;
@@ -44,29 +47,45 @@ class BackupExecutions extends Component
public function cleanupFailed()
{
- if ($this->backup) {
- $this->backup->executions()->where('status', 'failed')->delete();
- $this->refreshBackupExecutions();
- $this->dispatch('success', 'Failed backups cleaned up.');
+ try {
+ $this->authorize('manageBackups', $this->database);
+ if ($this->backup) {
+ $this->backup->executions()->where('status', 'failed')->delete();
+ $this->refreshBackupExecutions();
+ $this->dispatch('success', 'Failed backups cleaned up.');
+ }
+ } catch (\Throwable $e) {
+ return handleError($e, $this);
}
}
public function cleanupDeleted()
{
- if ($this->backup) {
- $deletedCount = $this->backup->executions()->where('local_storage_deleted', true)->count();
- if ($deletedCount > 0) {
- $this->backup->executions()->where('local_storage_deleted', true)->delete();
- $this->refreshBackupExecutions();
- $this->dispatch('success', "Cleaned up {$deletedCount} backup entries deleted from local storage.");
- } else {
- $this->dispatch('info', 'No backup entries found that are deleted from local storage.');
+ try {
+ $this->authorize('manageBackups', $this->database);
+ if ($this->backup) {
+ $deletedCount = $this->backup->executions()->where('local_storage_deleted', true)->count();
+ if ($deletedCount > 0) {
+ $this->backup->executions()->where('local_storage_deleted', true)->delete();
+ $this->refreshBackupExecutions();
+ $this->dispatch('success', "Cleaned up {$deletedCount} backup entries deleted from local storage.");
+ } else {
+ $this->dispatch('info', 'No backup entries found that are deleted from local storage.');
+ }
}
+ } catch (\Throwable $e) {
+ return handleError($e, $this);
}
}
public function deleteBackup($executionId, $password)
{
+ try {
+ $this->authorize('manageBackups', $this->database);
+ } catch (\Throwable $e) {
+ return handleError($e, $this);
+ }
+
if (! verifyPasswordConfirmation($password, $this)) {
return;
}
diff --git a/app/Livewire/Project/Service/EditCompose.php b/app/Livewire/Project/Service/EditCompose.php
index 32cf72067..0f5c739b1 100644
--- a/app/Livewire/Project/Service/EditCompose.php
+++ b/app/Livewire/Project/Service/EditCompose.php
@@ -3,10 +3,13 @@
namespace App\Livewire\Project\Service;
use App\Models\Service;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
use Livewire\Component;
class EditCompose extends Component
{
+ use AuthorizesRequests;
+
public Service $service;
public $serviceId;
@@ -72,19 +75,29 @@ class EditCompose extends Component
public function saveEditedCompose()
{
- $this->dispatch('info', 'Saving new docker compose...');
- $this->dispatch('saveCompose', $this->dockerComposeRaw);
- $this->dispatch('refreshStorages');
+ try {
+ $this->authorize('update', $this->service);
+ $this->dispatch('info', 'Saving new docker compose...');
+ $this->dispatch('saveCompose', $this->dockerComposeRaw);
+ $this->dispatch('refreshStorages');
+ } catch (\Throwable $e) {
+ return handleError($e, $this);
+ }
}
public function instantSave()
{
- $this->validate([
- 'isContainerLabelEscapeEnabled' => 'required',
- ]);
- $this->syncData(true);
- $this->service->save(['is_container_label_escape_enabled' => $this->isContainerLabelEscapeEnabled]);
- $this->dispatch('success', 'Service updated successfully');
+ try {
+ $this->authorize('update', $this->service);
+ $this->validate([
+ 'isContainerLabelEscapeEnabled' => 'required',
+ ]);
+ $this->syncData(true);
+ $this->service->save(['is_container_label_escape_enabled' => $this->isContainerLabelEscapeEnabled]);
+ $this->dispatch('success', 'Service updated successfully');
+ } catch (\Throwable $e) {
+ return handleError($e, $this);
+ }
}
public function render()
diff --git a/app/Livewire/Project/Service/StackForm.php b/app/Livewire/Project/Service/StackForm.php
index 64a7d8d8b..678db17e8 100644
--- a/app/Livewire/Project/Service/StackForm.php
+++ b/app/Livewire/Project/Service/StackForm.php
@@ -4,12 +4,15 @@ namespace App\Livewire\Project\Service;
use App\Models\Service;
use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
use Illuminate\Support\Collection;
use Illuminate\Support\Facades\DB;
use Livewire\Component;
class StackForm extends Component
{
+ use AuthorizesRequests;
+
public Service $service;
public Collection $fields;
@@ -128,14 +131,20 @@ class StackForm extends Component
public function instantSave()
{
- $this->syncData(true);
- $this->service->save();
- $this->dispatch('success', 'Service settings saved.');
+ try {
+ $this->authorize('update', $this->service);
+ $this->syncData(true);
+ $this->service->save();
+ $this->dispatch('success', 'Service settings saved.');
+ } catch (\Throwable $e) {
+ return handleError($e, $this);
+ }
}
public function submit($notify = true)
{
try {
+ $this->authorize('update', $this->service);
$this->validate();
$this->syncData(true);
diff --git a/app/Livewire/Project/Shared/UploadConfig.php b/app/Livewire/Project/Shared/UploadConfig.php
index 1b10f588b..0f0894687 100644
--- a/app/Livewire/Project/Shared/UploadConfig.php
+++ b/app/Livewire/Project/Shared/UploadConfig.php
@@ -3,10 +3,13 @@
namespace App\Livewire\Project\Shared;
use App\Models\Application;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
use Livewire\Component;
class UploadConfig extends Component
{
+ use AuthorizesRequests;
+
public $config;
public $applicationId;
@@ -29,13 +32,12 @@ class UploadConfig extends Component
public function uploadConfig()
{
try {
- $application = Application::findOrFail($this->applicationId);
+ $application = Application::ownedByCurrentTeam()->findOrFail($this->applicationId);
+ $this->authorize('update', $application);
$application->setConfig($this->config);
$this->dispatch('success', 'Application settings updated');
- } catch (\Exception $e) {
- $this->dispatch('error', $e->getMessage());
-
- return;
+ } catch (\Throwable $e) {
+ return handleError($e, $this);
}
}
diff --git a/app/Livewire/Upgrade.php b/app/Livewire/Upgrade.php
index 7948ad6a9..be4ea1cf0 100644
--- a/app/Livewire/Upgrade.php
+++ b/app/Livewire/Upgrade.php
@@ -44,6 +44,9 @@ class Upgrade extends Component
public function upgrade()
{
try {
+ if (! isInstanceAdmin()) {
+ abort(403);
+ }
if ($this->updateInProgress) {
return;
}
diff --git a/resources/views/livewire/project/database/backup-edit.blade.php b/resources/views/livewire/project/database/backup-edit.blade.php
index bb5dcfc4d..b818e8f75 100644
--- a/resources/views/livewire/project/database/backup-edit.blade.php
+++ b/resources/views/livewire/project/database/backup-edit.blade.php
@@ -5,7 +5,7 @@
Save
@if (str($status)->startsWith('running'))
-
+
Backup Now
@endif
@if ($backup->database_id !== 0)
Date: Thu, 26 Feb 2026 16:27:02 +0100
Subject: [PATCH 16/20] chore: prepare for PR
---
app/Models/PrivateKey.php | 2 +-
scripts/upgrade.sh | 9 +++++++++
tests/Unit/PrivateKeyStorageTest.php | 2 +-
3 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/app/Models/PrivateKey.php b/app/Models/PrivateKey.php
index bb76d5ed6..7163ae7b5 100644
--- a/app/Models/PrivateKey.php
+++ b/app/Models/PrivateKey.php
@@ -237,7 +237,7 @@ class PrivateKey extends BaseModel
$testSuccess = $disk->put($testFilename, 'test');
if (! $testSuccess) {
- throw new \Exception('SSH keys storage directory is not writable');
+ throw new \Exception('SSH keys storage directory is not writable. Run on the host: sudo chown -R 9999 /data/coolify/ssh && sudo chmod -R 700 /data/coolify/ssh && docker restart coolify');
}
// Clean up test file
diff --git a/scripts/upgrade.sh b/scripts/upgrade.sh
index 648849d5c..f32db9b8d 100644
--- a/scripts/upgrade.sh
+++ b/scripts/upgrade.sh
@@ -141,6 +141,15 @@ else
log "Network 'coolify' already exists"
fi
+# Fix SSH directory ownership if not owned by container user UID 9999 (fixes #6621)
+# Only changes owner — preserves existing group to respect custom setups
+SSH_OWNER=$(stat -c '%u' /data/coolify/ssh 2>/dev/null || echo "unknown")
+if [ "$SSH_OWNER" != "9999" ]; then
+ log "Fixing SSH directory ownership (was owned by UID $SSH_OWNER)"
+ chown -R 9999 /data/coolify/ssh
+ chmod -R 700 /data/coolify/ssh
+fi
+
# Check if Docker config file exists
DOCKER_CONFIG_MOUNT=""
if [ -f /root/.docker/config.json ]; then
diff --git a/tests/Unit/PrivateKeyStorageTest.php b/tests/Unit/PrivateKeyStorageTest.php
index 00f39e3df..09472604b 100644
--- a/tests/Unit/PrivateKeyStorageTest.php
+++ b/tests/Unit/PrivateKeyStorageTest.php
@@ -112,7 +112,7 @@ uZx9iFkCELtxrh31QJ68AAAAEXNhaWxANzZmZjY2ZDJlMmRkAQIDBA==
);
$this->expectException(\Exception::class);
- $this->expectExceptionMessage('SSH keys storage directory is not writable');
+ $this->expectExceptionMessage('SSH keys storage directory is not writable. Run on the host: sudo chown -R 9999 /data/coolify/ssh && sudo chmod -R 700 /data/coolify/ssh && docker restart coolify');
PrivateKey::createAndStore([
'name' => 'Test Key',
From c9246559994f5006390c7665825e3bbd60370bb6 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 27 Feb 2026 22:42:48 +0100
Subject: [PATCH 17/20] feat(auth): restrict sensitive data visibility for team
members
Hide database passwords, connection URLs, and debug logs from team members:
- Database components: hide passwords and connection URLs for members
- Deployment UI: gate debug log toggle behind update permission
- Debug logs: prevent members from viewing debug output
- Storage/services: hide sensitive credentials from members
Members can still view non-sensitive configuration while admins retain full access to all data.
---
app/Http/Middleware/ApiAbility.php | 4 +-
.../Project/Application/Deployment/Show.php | 4 +-
.../Project/Application/DeploymentNavbar.php | 9 ++-
.../Project/Database/Clickhouse/General.php | 9 +++
.../Project/Database/Dragonfly/General.php | 9 +++
.../Project/Database/Keydb/General.php | 9 +++
.../Project/Database/Mariadb/General.php | 10 ++++
.../Project/Database/Mongodb/General.php | 9 +++
.../Project/Database/Mysql/General.php | 10 ++++
.../Project/Database/Postgresql/General.php | 9 +++
.../Project/Database/Redis/General.php | 9 +++
app/Livewire/Project/Service/FileStorage.php | 3 +-
app/Livewire/Project/Service/StackForm.php | 13 +++++
app/Livewire/Storage/Form.php | 8 +++
bootstrap/helpers/remoteProcess.php | 5 ++
.../application/deployment/show.blade.php | 2 +
.../database/clickhouse/general.blade.php | 42 +++++++++-----
.../database/dragonfly/general.blade.php | 44 ++++++++++-----
.../project/database/keydb/general.blade.php | 42 +++++++++-----
.../database/mariadb/general.blade.php | 56 +++++++++++++------
.../database/mongodb/general.blade.php | 40 +++++++++----
.../project/database/mysql/general.blade.php | 52 ++++++++++++-----
.../database/postgresql/general.blade.php | 38 +++++++++----
.../project/database/redis/general.blade.php | 38 +++++++++----
.../project/service/file-storage.blade.php | 2 +-
.../project/service/stack-form.blade.php | 12 ++--
.../views/livewire/storage/form.blade.php | 13 +++--
27 files changed, 382 insertions(+), 119 deletions(-)
diff --git a/app/Http/Middleware/ApiAbility.php b/app/Http/Middleware/ApiAbility.php
index d42e09136..874e63825 100644
--- a/app/Http/Middleware/ApiAbility.php
+++ b/app/Http/Middleware/ApiAbility.php
@@ -21,9 +21,9 @@ class ApiAbility extends CheckForAnyAbility
{
try {
$token = $request->user()->currentAccessToken();
- $teamId = (int) data_get($token, 'team_id');
+ $teamId = data_get($token, 'team_id');
- if ($teamId && ! $request->user()->isAdminOfTeam($teamId)) {
+ if ($teamId !== null && ! $request->user()->isAdminOfTeam((int) $teamId)) {
$tokenAbilities = $token->abilities ?? [];
$disallowed = array_intersect($tokenAbilities, self::MEMBER_DISALLOWED_ABILITIES);
diff --git a/app/Livewire/Project/Application/Deployment/Show.php b/app/Livewire/Project/Application/Deployment/Show.php
index 189dcca9b..b8f5e891a 100644
--- a/app/Livewire/Project/Application/Deployment/Show.php
+++ b/app/Livewire/Project/Application/Deployment/Show.php
@@ -59,7 +59,9 @@ class Show extends Component
$this->application_deployment_queue = $application_deployment_queue;
$this->horizon_job_status = $this->application_deployment_queue->getHorizonJobStatus();
$this->deployment_uuid = $deploymentUuid;
- $this->is_debug_enabled = $this->application->settings->is_debug_enabled;
+ $this->is_debug_enabled = auth()->user()->isMember()
+ ? false
+ : $this->application->settings->is_debug_enabled;
$this->isKeepAliveOn();
}
diff --git a/app/Livewire/Project/Application/DeploymentNavbar.php b/app/Livewire/Project/Application/DeploymentNavbar.php
index fcd0d4cf4..b60f543ba 100644
--- a/app/Livewire/Project/Application/DeploymentNavbar.php
+++ b/app/Livewire/Project/Application/DeploymentNavbar.php
@@ -28,7 +28,9 @@ class DeploymentNavbar extends Component
{
$this->application = Application::ownedByCurrentTeam()->find($this->application_deployment_queue->application_id);
$this->server = $this->application->destination->server;
- $this->is_debug_enabled = $this->application->settings->is_debug_enabled;
+ $this->is_debug_enabled = auth()->user()->isMember()
+ ? false
+ : $this->application->settings->is_debug_enabled;
}
public function deploymentFinished()
@@ -67,10 +69,15 @@ class DeploymentNavbar extends Component
return '';
}
+ $isMember = auth()->user()->isMember();
+
$markdown = "# Deployment Logs\n\n";
$markdown .= "```\n";
foreach ($logs as $log) {
+ if ($isMember && ! empty($log['hidden'])) {
+ continue;
+ }
if (isset($log['output'])) {
$markdown .= $log['output']."\n";
}
diff --git a/app/Livewire/Project/Database/Clickhouse/General.php b/app/Livewire/Project/Database/Clickhouse/General.php
index 7ad453fd5..e790f2a40 100644
--- a/app/Livewire/Project/Database/Clickhouse/General.php
+++ b/app/Livewire/Project/Database/Clickhouse/General.php
@@ -44,6 +44,8 @@ class General extends Component
public bool $isLogDrainEnabled = false;
+ public bool $isPasswordHiddenForMember = false;
+
public function getListeners()
{
$teamId = Auth::user()->currentTeam()->id;
@@ -67,6 +69,13 @@ class General extends Component
} catch (\Throwable $e) {
return handleError($e, $this);
}
+
+ $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+ if ($this->isPasswordHiddenForMember) {
+ $this->clickhouseAdminPassword = '';
+ $this->dbUrl = null;
+ $this->dbUrlPublic = null;
+ }
}
protected function rules(): array
diff --git a/app/Livewire/Project/Database/Dragonfly/General.php b/app/Livewire/Project/Database/Dragonfly/General.php
index 4e325b9ee..4d74dbe22 100644
--- a/app/Livewire/Project/Database/Dragonfly/General.php
+++ b/app/Livewire/Project/Database/Dragonfly/General.php
@@ -48,6 +48,8 @@ class General extends Component
public bool $enable_ssl = false;
+ public bool $isPasswordHiddenForMember = false;
+
public function getListeners()
{
$userId = Auth::id();
@@ -79,6 +81,13 @@ class General extends Component
} catch (\Throwable $e) {
return handleError($e, $this);
}
+
+ $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+ if ($this->isPasswordHiddenForMember) {
+ $this->dragonflyPassword = '';
+ $this->dbUrl = null;
+ $this->dbUrlPublic = null;
+ }
}
protected function rules(): array
diff --git a/app/Livewire/Project/Database/Keydb/General.php b/app/Livewire/Project/Database/Keydb/General.php
index f02aa6674..1877f0cb8 100644
--- a/app/Livewire/Project/Database/Keydb/General.php
+++ b/app/Livewire/Project/Database/Keydb/General.php
@@ -50,6 +50,8 @@ class General extends Component
public bool $enable_ssl = false;
+ public bool $isPasswordHiddenForMember = false;
+
public function getListeners()
{
$userId = Auth::id();
@@ -81,6 +83,13 @@ class General extends Component
} catch (\Throwable $e) {
return handleError($e, $this);
}
+
+ $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+ if ($this->isPasswordHiddenForMember) {
+ $this->keydbPassword = '';
+ $this->dbUrl = null;
+ $this->dbUrlPublic = null;
+ }
}
protected function rules(): array
diff --git a/app/Livewire/Project/Database/Mariadb/General.php b/app/Livewire/Project/Database/Mariadb/General.php
index 74658e2a4..ccf7a440d 100644
--- a/app/Livewire/Project/Database/Mariadb/General.php
+++ b/app/Livewire/Project/Database/Mariadb/General.php
@@ -56,6 +56,8 @@ class General extends Component
public ?Carbon $certificateValidUntil = null;
+ public bool $isPasswordHiddenForMember = false;
+
public function getListeners()
{
$userId = Auth::id();
@@ -137,6 +139,14 @@ class General extends Component
} catch (Exception $e) {
return handleError($e, $this);
}
+
+ $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+ if ($this->isPasswordHiddenForMember) {
+ $this->mariadbRootPassword = '';
+ $this->mariadbPassword = '';
+ $this->db_url = null;
+ $this->db_url_public = null;
+ }
}
public function syncData(bool $toModel = false)
diff --git a/app/Livewire/Project/Database/Mongodb/General.php b/app/Livewire/Project/Database/Mongodb/General.php
index 9f34b73d5..20490c4e1 100644
--- a/app/Livewire/Project/Database/Mongodb/General.php
+++ b/app/Livewire/Project/Database/Mongodb/General.php
@@ -56,6 +56,8 @@ class General extends Component
public ?Carbon $certificateValidUntil = null;
+ public bool $isPasswordHiddenForMember = false;
+
public function getListeners()
{
$userId = Auth::id();
@@ -137,6 +139,13 @@ class General extends Component
} catch (Exception $e) {
return handleError($e, $this);
}
+
+ $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+ if ($this->isPasswordHiddenForMember) {
+ $this->mongoInitdbRootPassword = '';
+ $this->db_url = null;
+ $this->db_url_public = null;
+ }
}
public function syncData(bool $toModel = false)
diff --git a/app/Livewire/Project/Database/Mysql/General.php b/app/Livewire/Project/Database/Mysql/General.php
index 86b109251..3a82af581 100644
--- a/app/Livewire/Project/Database/Mysql/General.php
+++ b/app/Livewire/Project/Database/Mysql/General.php
@@ -58,6 +58,8 @@ class General extends Component
public ?Carbon $certificateValidUntil = null;
+ public bool $isPasswordHiddenForMember = false;
+
public function getListeners()
{
$userId = Auth::id();
@@ -142,6 +144,14 @@ class General extends Component
} catch (Exception $e) {
return handleError($e, $this);
}
+
+ $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+ if ($this->isPasswordHiddenForMember) {
+ $this->mysqlRootPassword = '';
+ $this->mysqlPassword = '';
+ $this->db_url = null;
+ $this->db_url_public = null;
+ }
}
public function syncData(bool $toModel = false)
diff --git a/app/Livewire/Project/Database/Postgresql/General.php b/app/Livewire/Project/Database/Postgresql/General.php
index e24674315..fbea4506a 100644
--- a/app/Livewire/Project/Database/Postgresql/General.php
+++ b/app/Livewire/Project/Database/Postgresql/General.php
@@ -66,6 +66,8 @@ class General extends Component
public ?Carbon $certificateValidUntil = null;
+ public bool $isPasswordHiddenForMember = false;
+
public function getListeners()
{
$userId = Auth::id();
@@ -155,6 +157,13 @@ class General extends Component
} catch (Exception $e) {
return handleError($e, $this);
}
+
+ $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+ if ($this->isPasswordHiddenForMember) {
+ $this->postgresPassword = '';
+ $this->db_url = null;
+ $this->db_url_public = null;
+ }
}
public function syncData(bool $toModel = false)
diff --git a/app/Livewire/Project/Database/Redis/General.php b/app/Livewire/Project/Database/Redis/General.php
index 08bcdc343..b777768ea 100644
--- a/app/Livewire/Project/Database/Redis/General.php
+++ b/app/Livewire/Project/Database/Redis/General.php
@@ -54,6 +54,8 @@ class General extends Component
public ?Carbon $certificateValidUntil = null;
+ public bool $isPasswordHiddenForMember = false;
+
public function getListeners()
{
$userId = Auth::id();
@@ -130,6 +132,13 @@ class General extends Component
} catch (\Throwable $e) {
return handleError($e, $this);
}
+
+ $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+ if ($this->isPasswordHiddenForMember) {
+ $this->redisPassword = '';
+ $this->dbUrl = null;
+ $this->dbUrlPublic = null;
+ }
}
public function syncData(bool $toModel = false)
diff --git a/app/Livewire/Project/Service/FileStorage.php b/app/Livewire/Project/Service/FileStorage.php
index 079115bb6..596a2646c 100644
--- a/app/Livewire/Project/Service/FileStorage.php
+++ b/app/Livewire/Project/Service/FileStorage.php
@@ -101,8 +101,7 @@ class FileStorage extends Component
public function loadStorageOnServer()
{
try {
- // Loading content is a read operation, so we use 'view' permission
- $this->authorize('view', $this->resource);
+ $this->authorize('update', $this->resource);
$this->fileStorage->loadStorageOnServer();
$this->syncData();
diff --git a/app/Livewire/Project/Service/StackForm.php b/app/Livewire/Project/Service/StackForm.php
index 678db17e8..86d5a57c1 100644
--- a/app/Livewire/Project/Service/StackForm.php
+++ b/app/Livewire/Project/Service/StackForm.php
@@ -17,6 +17,8 @@ class StackForm extends Component
public Collection $fields;
+ public bool $isPasswordHiddenForMember = false;
+
protected $listeners = ['saveCompose'];
// Explicit properties
@@ -121,6 +123,17 @@ class StackForm extends Component
})->flatMap(function ($group) {
return $group;
});
+
+ $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+ if ($this->isPasswordHiddenForMember) {
+ $this->fields = $this->fields->map(function ($field) {
+ if (data_get($field, 'isPassword')) {
+ $field['value'] = null;
+ }
+
+ return $field;
+ });
+ }
}
public function saveCompose($raw)
diff --git a/app/Livewire/Storage/Form.php b/app/Livewire/Storage/Form.php
index 4dc0b6ae2..bc1726f10 100644
--- a/app/Livewire/Storage/Form.php
+++ b/app/Livewire/Storage/Form.php
@@ -31,6 +31,8 @@ class Form extends Component
public ?bool $isUsable = null;
+ public bool $isPasswordHiddenForMember = false;
+
protected function rules(): array
{
return [
@@ -109,6 +111,12 @@ class Form extends Component
public function mount()
{
$this->syncData(false);
+
+ $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+ if ($this->isPasswordHiddenForMember) {
+ $this->key = '';
+ $this->secret = '';
+ }
}
public function testConnection()
diff --git a/bootstrap/helpers/remoteProcess.php b/bootstrap/helpers/remoteProcess.php
index 217c82929..cb9f3bcab 100644
--- a/bootstrap/helpers/remoteProcess.php
+++ b/bootstrap/helpers/remoteProcess.php
@@ -183,6 +183,11 @@ function decode_remote_command_output(?ApplicationDeploymentQueue $application_d
$application = Application::find(data_get($application_deployment_queue, 'application_id'));
$is_debug_enabled = data_get($application, 'settings.is_debug_enabled');
+ // Members should never see debug logs, even if an admin enabled debug mode
+ if ($is_debug_enabled && auth()->check() && auth()->user()->isMember()) {
+ $is_debug_enabled = false;
+ }
+
$logs = data_get($application_deployment_queue, 'logs');
if (empty($logs)) {
return collect([]);
diff --git a/resources/views/livewire/project/application/deployment/show.blade.php b/resources/views/livewire/project/application/deployment/show.blade.php
index 5861cef30..4ea4a65bc 100644
--- a/resources/views/livewire/project/application/deployment/show.blade.php
+++ b/resources/views/livewire/project/application/deployment/show.blade.php
@@ -290,6 +290,7 @@
d="M12 6v6h4.5m4.5 0a9 9 0 1 1-18 0 9 9 0 0 1 18 0Z" />
+ @can('update', $application)
+ @endcan
+ type="password" readonly wire:model="dbUrl" canGate="update" :canResource="$database" />
+ @endif
+ @if ($isPasswordHiddenForMember)
+