Merge 17f7c940a9 into 24abd51238

app/Http/Controllers/Webhook/Github.php

@@ -43,6 +43,7 @@ class Github extends Controller
                 $removed_files = data_get($payload, 'commits.*.removed');
                 $modified_files = data_get($payload, 'commits.*.modified');
                 $changed_files = collect($added_files)->concat($removed_files)->concat($modified_files)->unique()->flatten();
+                $skip_deploy_commits = self::allCommitsSkipDeploy(data_get($payload, 'commits', []));
             }
             if ($x_github_event === 'pull_request') {
                 $action = data_get($payload, 'action');
@@ -102,31 +103,39 @@ class Github extends Controller
                         if ($application->isDeployable()) {
                             $is_watch_path_triggered = $application->isWatchPathsTriggered($changed_files);
                             if ($is_watch_path_triggered || blank($application->watch_paths)) {
-                                $deployment_uuid = new Cuid2;
-                                $result = queue_application_deployment(
-                                    application: $application,
-                                    deployment_uuid: $deployment_uuid,
-                                    force_rebuild: false,
-                                    commit: data_get($payload, 'after', 'HEAD'),
-                                    is_webhook: true,
-                                );
-                                if ($result['status'] === 'queue_full') {
-                                    return response($result['message'], 429)->header('Retry-After', 60);
-                                } elseif ($result['status'] === 'skipped') {
+                                if ($skip_deploy_commits ?? false) {
                                     $return_payloads->push([
                                         'application' => $application->name,
                                         'status' => 'skipped',
-                                        'message' => $result['message'],
+                                        'message' => 'All commits contain [skip cd] or [skip ci]. Skipping deployment.',
                                     ]);
                                 } else {
-                                    $return_payloads->push([
-                                        'application' => $application->name,
-                                        'status' => 'success',
-                                        'message' => 'Deployment queued.',
-                                        'application_uuid' => $application->uuid,
-                                        'application_name' => $application->name,
-                                        'deployment_uuid' => $result['deployment_uuid'],
-                                    ]);
+                                    $deployment_uuid = new Cuid2;
+                                    $result = queue_application_deployment(
+                                        application: $application,
+                                        deployment_uuid: $deployment_uuid,
+                                        force_rebuild: false,
+                                        commit: data_get($payload, 'after', 'HEAD'),
+                                        is_webhook: true,
+                                    );
+                                    if ($result['status'] === 'queue_full') {
+                                        return response($result['message'], 429)->header('Retry-After', 60);
+                                    } elseif ($result['status'] === 'skipped') {
+                                        $return_payloads->push([
+                                            'application' => $application->name,
+                                            'status' => 'skipped',
+                                            'message' => $result['message'],
+                                        ]);
+                                    } else {
+                                        $return_payloads->push([
+                                            'application' => $application->name,
+                                            'status' => 'success',
+                                            'message' => 'Deployment queued.',
+                                            'application_uuid' => $application->uuid,
+                                            'application_name' => $application->name,
+                                            'deployment_uuid' => $result['deployment_uuid'],
+                                        ]);
+                                    }
                                 }
                             } else {
                                 $paths = str($application->watch_paths)->explode("\n");
@@ -234,6 +243,7 @@ class Github extends Controller
                 $removed_files = data_get($payload, 'commits.*.removed');
                 $modified_files = data_get($payload, 'commits.*.modified');
                 $changed_files = collect($added_files)->concat($removed_files)->concat($modified_files)->unique()->flatten();
+                $skip_deploy_commits = self::allCommitsSkipDeploy(data_get($payload, 'commits', []));
             }
             if ($x_github_event === 'pull_request') {
                 $action = data_get($payload, 'action');
@@ -285,24 +295,33 @@ class Github extends Controller
                         if ($application->isDeployable()) {
                             $is_watch_path_triggered = $application->isWatchPathsTriggered($changed_files);
                             if ($is_watch_path_triggered || blank($application->watch_paths)) {
-                                $deployment_uuid = new Cuid2;
-                                $result = queue_application_deployment(
-                                    application: $application,
-                                    deployment_uuid: $deployment_uuid,
-                                    commit: data_get($payload, 'after', 'HEAD'),
-                                    force_rebuild: false,
-                                    is_webhook: true,
-                                );
-                                if ($result['status'] === 'queue_full') {
-                                    return response($result['message'], 429)->header('Retry-After', 60);
+                                if ($skip_deploy_commits ?? false) {
+                                    $return_payloads->push([
+                                        'status' => 'skipped',
+                                        'message' => 'All commits contain [skip cd] or [skip ci]. Skipping deployment.',
+                                        'application_uuid' => $application->uuid,
+                                        'application_name' => $application->name,
+                                    ]);
+                                } else {
+                                    $deployment_uuid = new Cuid2;
+                                    $result = queue_application_deployment(
+                                        application: $application,
+                                        deployment_uuid: $deployment_uuid,
+                                        commit: data_get($payload, 'after', 'HEAD'),
+                                        force_rebuild: false,
+                                        is_webhook: true,
+                                    );
+                                    if ($result['status'] === 'queue_full') {
+                                        return response($result['message'], 429)->header('Retry-After', 60);
+                                    }
+                                    $return_payloads->push([
+                                        'status' => $result['status'],
+                                        'message' => $result['message'],
+                                        'application_uuid' => $application->uuid,
+                                        'application_name' => $application->name,
+                                        'deployment_uuid' => $result['deployment_uuid'] ?? null,
+                                    ]);
                                 }
-                                $return_payloads->push([
-                                    'status' => $result['status'],
-                                    'message' => $result['message'],
-                                    'application_uuid' => $application->uuid,
-                                    'application_name' => $application->name,
-                                    'deployment_uuid' => $result['deployment_uuid'] ?? null,
-                                ]);
                             } else {
                                 $paths = str($application->watch_paths)->explode("\n");
                                 $return_payloads->push([
@@ -418,4 +437,21 @@ class Github extends Controller
             return handleError($e);
         }
     }
+
+    /**
+     * Returns true if there is at least one commit and every commit message
+     * contains [skip cd] or [skip ci] (case-insensitive).
+     *
+     * @param  array<int, array<string, mixed>>  $commits
+     */
+    public static function allCommitsSkipDeploy(array $commits): bool
+    {
+        $commitList = collect($commits);
+
+        return $commitList->isNotEmpty() && $commitList->every(function (array $commit): bool {
+            $message = strtolower((string) data_get($commit, 'message', ''));
+
+            return str_contains($message, '[skip cd]') || str_contains($message, '[skip ci]');
+        });
+    }
 }

app/Jobs/ApplicationDeploymentJob.php

@@ -2756,28 +2756,46 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
     private function generate_healthcheck_commands()
     {
         if (! $this->application->health_check_port) {
-            $health_check_port = $this->application->ports_exposes_array[0];
+            $health_check_port = (int) $this->application->ports_exposes_array[0];
         } else {
-            $health_check_port = $this->application->health_check_port;
+            $health_check_port = (int) $this->application->health_check_port;
         }
         if ($this->application->settings->is_static || $this->application->build_pack === 'static') {
             $health_check_port = 80;
         }
-        if ($this->application->health_check_path) {
-            $this->full_healthcheck_url = "{$this->application->health_check_method}: {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}{$this->application->health_check_path}";
-            $generated_healthchecks_commands = [
-                "curl -s -X {$this->application->health_check_method} -f {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}{$this->application->health_check_path} > /dev/null || wget -q -O- {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}{$this->application->health_check_path} > /dev/null || exit 1",
-            ];
+
+        $method = $this->sanitizeHealthCheckValue($this->application->health_check_method, '/^[A-Z]+$/', 'GET');
+        $scheme = $this->sanitizeHealthCheckValue($this->application->health_check_scheme, '/^https?$/', 'http');
+        $host = $this->sanitizeHealthCheckValue($this->application->health_check_host, '/^[a-zA-Z0-9.\-_]+$/', 'localhost');
+        $path = $this->application->health_check_path
+            ? $this->sanitizeHealthCheckValue($this->application->health_check_path, '#^[a-zA-Z0-9/\-_.~%]+$#', '/')
+            : null;
+
+        $url = escapeshellarg("{$scheme}://{$host}:{$health_check_port}".($path ?? '/'));
+        $method = escapeshellarg($method);
+
+        if ($path) {
+            $this->full_healthcheck_url = "{$this->application->health_check_method}: {$scheme}://{$host}:{$health_check_port}{$path}";
         } else {
-            $this->full_healthcheck_url = "{$this->application->health_check_method}: {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}/";
-            $generated_healthchecks_commands = [
-                "curl -s -X {$this->application->health_check_method} -f {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}/ > /dev/null || wget -q -O- {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}/ > /dev/null || exit 1",
-            ];
+            $this->full_healthcheck_url = "{$this->application->health_check_method}: {$scheme}://{$host}:{$health_check_port}/";
         }
 
+        $generated_healthchecks_commands = [
+            "curl -s -X {$method} -f {$url} > /dev/null || wget -q -O- {$url} > /dev/null || exit 1",
+        ];
+
         return implode(' ', $generated_healthchecks_commands);
     }
 
+    private function sanitizeHealthCheckValue(string $value, string $pattern, string $default): string
+    {
+        if (preg_match($pattern, $value)) {
+            return $value;
+        }
+
+        return $default;
+    }
+
     private function pull_latest_image($image)
     {
         $this->application_deployment_queue->addLogEntry("Pulling latest image ($image) from the registry.");

app/Livewire/Project/Shared/HealthChecks.php

@@ -16,19 +16,19 @@ class HealthChecks extends Component
     #[Validate(['boolean'])]
     public bool $healthCheckEnabled = false;
 
-    #[Validate(['string'])]
+    #[Validate(['required', 'string', 'in:GET,HEAD,POST,OPTIONS'])]
     public string $healthCheckMethod;
 
-    #[Validate(['string'])]
+    #[Validate(['required', 'string', 'in:http,https'])]
     public string $healthCheckScheme;
 
-    #[Validate(['string'])]
+    #[Validate(['required', 'string', 'regex:/^[a-zA-Z0-9.\-_]+$/'])]
     public string $healthCheckHost;
 
-    #[Validate(['nullable', 'string'])]
+    #[Validate(['nullable', 'integer', 'min:1', 'max:65535'])]
     public ?string $healthCheckPort = null;
 
-    #[Validate(['string'])]
+    #[Validate(['required', 'string', 'regex:#^[a-zA-Z0-9/\-_.~%]+$#'])]
     public string $healthCheckPath;
 
     #[Validate(['integer'])]
@@ -54,12 +54,12 @@ class HealthChecks extends Component
 
     protected $rules = [
         'healthCheckEnabled' => 'boolean',
-        'healthCheckPath' => 'string',
-        'healthCheckPort' => 'nullable|string',
-        'healthCheckHost' => 'string',
-        'healthCheckMethod' => 'string',
+        'healthCheckPath' => ['required', 'string', 'regex:#^[a-zA-Z0-9/\-_.~%]+$#'],
+        'healthCheckPort' => 'nullable|integer|min:1|max:65535',
+        'healthCheckHost' => ['required', 'string', 'regex:/^[a-zA-Z0-9.\-_]+$/'],
+        'healthCheckMethod' => 'required|string|in:GET,HEAD,POST,OPTIONS',
         'healthCheckReturnCode' => 'integer',
-        'healthCheckScheme' => 'string',
+        'healthCheckScheme' => 'required|string|in:http,https',
         'healthCheckResponseText' => 'nullable|string',
         'healthCheckInterval' => 'integer|min:1',
         'healthCheckTimeout' => 'integer|min:1',

app/Livewire/Project/Shared/ResourceOperations.php

@@ -49,9 +49,10 @@ class ResourceOperations extends Component
     {
         $this->authorize('update', $this->resource);
 
-        $new_destination = StandaloneDocker::find($destination_id);
+        $teamScope = fn ($q) => $q->where('team_id', currentTeam()->id);
+        $new_destination = StandaloneDocker::whereHas('server', $teamScope)->find($destination_id);
         if (! $new_destination) {
-            $new_destination = SwarmDocker::find($destination_id);
+            $new_destination = SwarmDocker::whereHas('server', $teamScope)->find($destination_id);
         }
         if (! $new_destination) {
             return $this->addError('destination_id', 'Destination not found.');
@@ -352,7 +353,7 @@ class ResourceOperations extends Component
     {
         try {
             $this->authorize('update', $this->resource);
-            $new_environment = Environment::findOrFail($environment_id);
+            $new_environment = Environment::ownedByCurrentTeam()->findOrFail($environment_id);
             $this->resource->update([
                 'environment_id' => $environment_id,
             ]);

app/Policies/StandaloneDockerPolicy.php

@@ -37,8 +37,7 @@ class StandaloneDockerPolicy
      */
     public function update(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $standaloneDocker->server->team_id);
-        return true;
+        return $user->teams->contains('id', $standaloneDocker->server->team_id);
     }
 
     /**
@@ -46,8 +45,7 @@ class StandaloneDockerPolicy
      */
     public function delete(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $standaloneDocker->server->team_id);
-        return true;
+        return $user->teams->contains('id', $standaloneDocker->server->team_id);
     }
 
     /**
@@ -55,8 +53,7 @@ class StandaloneDockerPolicy
      */
     public function restore(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        // return false;
-        return true;
+        return false;
     }
 
     /**
@@ -64,7 +61,6 @@ class StandaloneDockerPolicy
      */
     public function forceDelete(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        // return false;
-        return true;
+        return false;
     }
 }

app/Policies/SwarmDockerPolicy.php

@@ -37,8 +37,7 @@ class SwarmDockerPolicy
      */
     public function update(User $user, SwarmDocker $swarmDocker): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $swarmDocker->server->team_id);
-        return true;
+        return $user->teams->contains('id', $swarmDocker->server->team_id);
     }
 
     /**
@@ -46,8 +45,7 @@ class SwarmDockerPolicy
      */
     public function delete(User $user, SwarmDocker $swarmDocker): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $swarmDocker->server->team_id);
-        return true;
+        return $user->teams->contains('id', $swarmDocker->server->team_id);
     }
 
     /**
@@ -55,8 +53,7 @@ class SwarmDockerPolicy
      */
     public function restore(User $user, SwarmDocker $swarmDocker): bool
     {
-        // return false;
-        return true;
+        return false;
     }
 
     /**
@@ -64,7 +61,6 @@ class SwarmDockerPolicy
      */
     public function forceDelete(User $user, SwarmDocker $swarmDocker): bool
     {
-        // return false;
-        return true;
+        return false;
     }
 }

bootstrap/helpers/api.php

@@ -104,12 +104,12 @@ function sharedDataApplications()
         'base_directory' => 'string|nullable',
         'publish_directory' => 'string|nullable',
         'health_check_enabled' => 'boolean',
-        'health_check_path' => 'string',
-        'health_check_port' => 'string|nullable',
-        'health_check_host' => 'string',
-        'health_check_method' => 'string',
+        'health_check_path' => ['string', 'regex:#^[a-zA-Z0-9/\-_.~%]+$#'],
+        'health_check_port' => 'integer|nullable|min:1|max:65535',
+        'health_check_host' => ['string', 'regex:/^[a-zA-Z0-9.\-_]+$/'],
+        'health_check_method' => 'string|in:GET,HEAD,POST,OPTIONS',
         'health_check_return_code' => 'numeric',
-        'health_check_scheme' => 'string',
+        'health_check_scheme' => 'string|in:http,https',
         'health_check_response_text' => 'string|nullable',
         'health_check_interval' => 'numeric',
         'health_check_timeout' => 'numeric',

bootstrap/helpers/applications.php

@@ -191,6 +191,10 @@ function clone_application(Application $source, $destination, array $overrides =
     $uuid = $overrides['uuid'] ?? (string) new Cuid2;
     $server = $destination->server;
 
+    if ($server->team_id !== currentTeam()->id) {
+        throw new \RuntimeException('Destination does not belong to the current team.');
+    }
+
     // Prepare name and URL
     $name = $overrides['name'] ?? 'clone-of-'.str($source->name)->limit(20).'-'.$uuid;
     $applicationSettings = $source->settings;

routes/api.php

@@ -55,7 +55,7 @@ Route::group([
     Route::post('/projects/{uuid}/environments', [ProjectController::class, 'create_environment'])->middleware(['api.ability:write']);
     Route::delete('/projects/{uuid}/environments/{environment_name_or_uuid}', [ProjectController::class, 'delete_environment'])->middleware(['api.ability:write']);
 
-    Route::post('/projects', [ProjectController::class, 'create_project'])->middleware(['api.ability:read']);
+    Route::post('/projects', [ProjectController::class, 'create_project'])->middleware(['api.ability:write']);
     Route::patch('/projects/{uuid}', [ProjectController::class, 'update_project'])->middleware(['api.ability:write']);
     Route::delete('/projects/{uuid}', [ProjectController::class, 'delete_project'])->middleware(['api.ability:write']);
 
@@ -86,7 +86,7 @@ Route::group([
 
     Route::get('/servers/{uuid}/validate', [ServersController::class, 'validate_server'])->middleware(['api.ability:read']);
 
-    Route::post('/servers', [ServersController::class, 'create_server'])->middleware(['api.ability:read']);
+    Route::post('/servers', [ServersController::class, 'create_server'])->middleware(['api.ability:write']);
     Route::patch('/servers/{uuid}', [ServersController::class, 'update_server'])->middleware(['api.ability:write']);
     Route::delete('/servers/{uuid}', [ServersController::class, 'delete_server'])->middleware(['api.ability:write']);
 

tests/Feature/ApiTokenPermissionTest.php

@@ -0,0 +1,75 @@
+<?php
+
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+});
+
+describe('POST /api/v1/projects', function () {
+    test('read-only token cannot create a project', function () {
+        $token = $this->user->createToken('read-only', ['read']);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$token->plainTextToken,
+            'Content-Type' => 'application/json',
+        ])->postJson('/api/v1/projects', [
+            'name' => 'Test Project',
+        ]);
+
+        $response->assertStatus(403);
+    });
+
+    test('write token can create a project', function () {
+        $token = $this->user->createToken('write-token', ['write']);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$token->plainTextToken,
+            'Content-Type' => 'application/json',
+        ])->postJson('/api/v1/projects', [
+            'name' => 'Test Project',
+        ]);
+
+        $response->assertStatus(201);
+        $response->assertJsonStructure(['uuid']);
+    });
+
+    test('root token can create a project', function () {
+        $token = $this->user->createToken('root-token', ['root']);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$token->plainTextToken,
+            'Content-Type' => 'application/json',
+        ])->postJson('/api/v1/projects', [
+            'name' => 'Test Project',
+        ]);
+
+        $response->assertStatus(201);
+        $response->assertJsonStructure(['uuid']);
+    });
+});
+
+describe('POST /api/v1/servers', function () {
+    test('read-only token cannot create a server', function () {
+        $token = $this->user->createToken('read-only', ['read']);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$token->plainTextToken,
+            'Content-Type' => 'application/json',
+        ])->postJson('/api/v1/servers', [
+            'name' => 'Test Server',
+            'ip' => '1.2.3.4',
+            'private_key_uuid' => 'fake-uuid',
+        ]);
+
+        $response->assertStatus(403);
+    });
+});

tests/Feature/ResourceOperationsCrossTenantTest.php

@@ -0,0 +1,85 @@
+<?php
+
+use App\Livewire\Project\Shared\ResourceOperations;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Livewire\Livewire;
+
+beforeEach(function () {
+    // Team A (attacker's team)
+    $this->userA = User::factory()->create();
+    $this->teamA = Team::factory()->create();
+    $this->userA->teams()->attach($this->teamA, ['role' => 'owner']);
+
+    $this->serverA = Server::factory()->create(['team_id' => $this->teamA->id]);
+    $this->destinationA = StandaloneDocker::factory()->create(['server_id' => $this->serverA->id]);
+    $this->projectA = Project::factory()->create(['team_id' => $this->teamA->id]);
+    $this->environmentA = Environment::factory()->create(['project_id' => $this->projectA->id]);
+
+    $this->applicationA = Application::factory()->create([
+        'environment_id' => $this->environmentA->id,
+        'destination_id' => $this->destinationA->id,
+        'destination_type' => $this->destinationA->getMorphClass(),
+    ]);
+
+    // Team B (victim's team)
+    $this->teamB = Team::factory()->create();
+    $this->serverB = Server::factory()->create(['team_id' => $this->teamB->id]);
+    $this->destinationB = StandaloneDocker::factory()->create(['server_id' => $this->serverB->id]);
+    $this->projectB = Project::factory()->create(['team_id' => $this->teamB->id]);
+    $this->environmentB = Environment::factory()->create(['project_id' => $this->projectB->id]);
+
+    $this->actingAs($this->userA);
+    session(['currentTeam' => $this->teamA]);
+});
+
+test('cloneTo rejects destination belonging to another team', function () {
+    Livewire::test(ResourceOperations::class, ['resource' => $this->applicationA])
+        ->call('cloneTo', $this->destinationB->id)
+        ->assertHasErrors('destination_id');
+
+    // Ensure no cross-tenant application was created
+    expect(Application::where('destination_id', $this->destinationB->id)->exists())->toBeFalse();
+});
+
+test('cloneTo allows destination belonging to own team', function () {
+    $secondDestination = StandaloneDocker::factory()->create(['server_id' => $this->serverA->id]);
+
+    Livewire::test(ResourceOperations::class, ['resource' => $this->applicationA])
+        ->call('cloneTo', $secondDestination->id)
+        ->assertHasNoErrors('destination_id')
+        ->assertRedirect();
+});
+
+test('moveTo rejects environment belonging to another team', function () {
+    Livewire::test(ResourceOperations::class, ['resource' => $this->applicationA])
+        ->call('moveTo', $this->environmentB->id);
+
+    // Resource should still be in original environment
+    $this->applicationA->refresh();
+    expect($this->applicationA->environment_id)->toBe($this->environmentA->id);
+});
+
+test('moveTo allows environment belonging to own team', function () {
+    $secondEnvironment = Environment::factory()->create(['project_id' => $this->projectA->id]);
+
+    Livewire::test(ResourceOperations::class, ['resource' => $this->applicationA])
+        ->call('moveTo', $secondEnvironment->id)
+        ->assertRedirect();
+
+    $this->applicationA->refresh();
+    expect($this->applicationA->environment_id)->toBe($secondEnvironment->id);
+});
+
+test('StandaloneDockerPolicy denies update for cross-team user', function () {
+    expect($this->userA->can('update', $this->destinationB))->toBeFalse();
+});
+
+test('StandaloneDockerPolicy allows update for same-team user', function () {
+    expect($this->userA->can('update', $this->destinationA))->toBeTrue();
+});

tests/Unit/HealthCheckCommandInjectionTest.php

@@ -0,0 +1,211 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\ApplicationSetting;
+use Illuminate\Support\Facades\Validator;
+use Mockery;
+
+beforeEach(function () {
+    Mockery::close();
+});
+
+afterEach(function () {
+    Mockery::close();
+});
+
+it('sanitizes health_check_host to prevent command injection', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_host' => 'localhost; id > /tmp/pwned #',
+    ]);
+
+    // Should fall back to 'localhost' because input contains shell metacharacters
+    expect($result)->not->toContain('; id')
+        ->and($result)->not->toContain('/tmp/pwned')
+        ->and($result)->toContain('localhost');
+});
+
+it('sanitizes health_check_method to prevent command injection', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_method' => 'GET; curl http://evil.com #',
+    ]);
+
+    expect($result)->not->toContain('evil.com')
+        ->and($result)->not->toContain('; curl');
+});
+
+it('sanitizes health_check_path to prevent command injection', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_path' => '/health; rm -rf / #',
+    ]);
+
+    expect($result)->not->toContain('rm -rf')
+        ->and($result)->not->toContain('; rm');
+});
+
+it('sanitizes health_check_scheme to prevent command injection', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_scheme' => 'http; cat /etc/passwd #',
+    ]);
+
+    expect($result)->not->toContain('/etc/passwd')
+        ->and($result)->not->toContain('; cat');
+});
+
+it('casts health_check_port to integer to prevent injection', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_port' => '8080; whoami',
+    ]);
+
+    // (int) cast on non-numeric after digits yields 8080
+    expect($result)->not->toContain('whoami')
+        ->and($result)->toContain('8080');
+});
+
+it('generates valid healthcheck command with safe inputs', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_method' => 'GET',
+        'health_check_scheme' => 'http',
+        'health_check_host' => 'localhost',
+        'health_check_port' => '8080',
+        'health_check_path' => '/health',
+    ]);
+
+    expect($result)->toContain('curl -s -X')
+        ->and($result)->toContain('http://localhost:8080/health')
+        ->and($result)->toContain('wget -q -O-');
+});
+
+it('uses escapeshellarg on the constructed URL', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_host' => 'my-app.local',
+        'health_check_path' => '/api/health',
+    ]);
+
+    // escapeshellarg wraps in single quotes
+    expect($result)->toContain("'http://my-app.local:80/api/health'");
+});
+
+it('validates health_check_host rejects shell metacharacters via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        ['health_check_host' => 'localhost; id #'],
+        ['health_check_host' => $rules['health_check_host']]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('validates health_check_method rejects invalid methods via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        ['health_check_method' => 'GET; curl evil.com'],
+        ['health_check_method' => $rules['health_check_method']]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('validates health_check_scheme rejects invalid schemes via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        ['health_check_scheme' => 'http; whoami'],
+        ['health_check_scheme' => $rules['health_check_scheme']]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('validates health_check_path rejects shell metacharacters via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        ['health_check_path' => '/health; rm -rf /'],
+        ['health_check_path' => $rules['health_check_path']]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('validates health_check_port rejects non-numeric values via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        ['health_check_port' => '8080; whoami'],
+        ['health_check_port' => $rules['health_check_port']]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('allows valid health check values via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        [
+            'health_check_host' => 'my-app.localhost',
+            'health_check_method' => 'GET',
+            'health_check_scheme' => 'https',
+            'health_check_path' => '/api/v1/health',
+            'health_check_port' => 8080,
+        ],
+        [
+            'health_check_host' => $rules['health_check_host'],
+            'health_check_method' => $rules['health_check_method'],
+            'health_check_scheme' => $rules['health_check_scheme'],
+            'health_check_path' => $rules['health_check_path'],
+            'health_check_port' => $rules['health_check_port'],
+        ]
+    );
+
+    expect($validator->fails())->toBeFalse();
+});
+
+/**
+ * Helper: Invokes the private generate_healthcheck_commands() method via reflection.
+ */
+function callGenerateHealthcheckCommands(array $overrides = []): string
+{
+    $defaults = [
+        'health_check_method' => 'GET',
+        'health_check_scheme' => 'http',
+        'health_check_host' => 'localhost',
+        'health_check_port' => null,
+        'health_check_path' => '/',
+        'ports_exposes' => '80',
+    ];
+
+    $values = array_merge($defaults, $overrides);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('getAttribute')->with('health_check_method')->andReturn($values['health_check_method']);
+    $application->shouldReceive('getAttribute')->with('health_check_scheme')->andReturn($values['health_check_scheme']);
+    $application->shouldReceive('getAttribute')->with('health_check_host')->andReturn($values['health_check_host']);
+    $application->shouldReceive('getAttribute')->with('health_check_port')->andReturn($values['health_check_port']);
+    $application->shouldReceive('getAttribute')->with('health_check_path')->andReturn($values['health_check_path']);
+    $application->shouldReceive('getAttribute')->with('ports_exposes_array')->andReturn(explode(',', $values['ports_exposes']));
+    $application->shouldReceive('getAttribute')->with('build_pack')->andReturn('nixpacks');
+
+    $settings = Mockery::mock(ApplicationSetting::class)->makePartial();
+    $settings->shouldReceive('getAttribute')->with('is_static')->andReturn(false);
+    $application->shouldReceive('getAttribute')->with('settings')->andReturn($settings);
+
+    $deploymentQueue = Mockery::mock(ApplicationDeploymentQueue::class)->makePartial();
+
+    $job = Mockery::mock(ApplicationDeploymentJob::class)->makePartial();
+
+    $reflection = new ReflectionClass($job);
+
+    $appProp = $reflection->getProperty('application');
+    $appProp->setAccessible(true);
+    $appProp->setValue($job, $application);
+
+    $method = $reflection->getMethod('generate_healthcheck_commands');
+    $method->setAccessible(true);
+
+    return $method->invoke($job);
+}

tests/Unit/Webhook/GithubSkipDeployCommitsTest.php

@@ -0,0 +1,54 @@
+<?php
+
+use App\Http\Controllers\Webhook\Github;
+
+describe('Github::allCommitsSkipDeploy', function () {
+    test('returns false when commits array is empty', function () {
+        expect(Github::allCommitsSkipDeploy([]))->toBeFalse();
+    });
+
+    test('returns true when all commits contain [skip ci]', function () {
+        $commits = [
+            ['message' => 'Update docs [skip ci]'],
+            ['message' => 'Fix typo [skip ci]'],
+        ];
+        expect(Github::allCommitsSkipDeploy($commits))->toBeTrue();
+    });
+
+    test('returns true when all commits contain [skip cd]', function () {
+        $commits = [
+            ['message' => 'Update README [skip cd]'],
+        ];
+        expect(Github::allCommitsSkipDeploy($commits))->toBeTrue();
+    });
+
+    test('returns true when all commits contain either marker (case-insensitive)', function () {
+        $commits = [
+            ['message' => 'Docs [SKIP CI]'],
+            ['message' => 'Changelog [Skip Cd]'],
+        ];
+        expect(Github::allCommitsSkipDeploy($commits))->toBeTrue();
+    });
+
+    test('returns false when at least one commit has no skip marker', function () {
+        $commits = [
+            ['message' => 'Update docs [skip ci]'],
+            ['message' => 'Actual feature change'],
+        ];
+        expect(Github::allCommitsSkipDeploy($commits))->toBeFalse();
+    });
+
+    test('returns false when single commit has no skip marker', function () {
+        $commits = [
+            ['message' => 'Deploy this please'],
+        ];
+        expect(Github::allCommitsSkipDeploy($commits))->toBeFalse();
+    });
+
+    test('handles commit with missing message key', function () {
+        $commits = [
+            ['id' => 'abc123'],
+        ];
+        expect(Github::allCommitsSkipDeploy($commits))->toBeFalse();
+    });
+});