Merge 16938aac9e into e436eeef91

The create_application method validates that destination_uuid is
provided when a server has multiple destinations, but then ignores
it and always uses $destinations->first().

This change looks up the destination by UUID when destination_uuid
is provided, and returns a 404 if the UUID doesn't match. When
destination_uuid is not provided, the existing behavior is preserved.

app/Http/Controllers/Api/ApplicationsController.php

@@ -1094,7 +1094,14 @@ class ApplicationsController extends Controller
         if ($destinations->count() > 1 && ! $request->has('destination_uuid')) {
             return response()->json(['message' => 'Server has multiple destinations and you do not set destination_uuid.'], 400);
         }
-        $destination = $destinations->first();
+        if ($request->has('destination_uuid')) {
+            $destination = $destinations->where('uuid', $request->destination_uuid)->first();
+            if (! $destination) {
+                return response()->json(['message' => 'Destination not found.'], 404);
+            }
+        } else {
+            $destination = $destinations->first();
+        }
         if ($type === 'public') {
             $validationRules = [
                 'git_repository' => ['string', 'required', new ValidGitRepositoryUrl],