Refund
-
- @if ($refundCheckLoading)
- Request Full Refund
- @elseif ($isRefundEligible && !currentTeam()->subscription->stripe_cancel_at_period_end)
-
- @else
- Request Full Refund
- @endif
-
+ @if ($refundCheckLoading || ($isRefundEligible && !currentTeam()->subscription->stripe_cancel_at_period_end))
+
+ @if ($refundCheckLoading)
+ Request Full Refund
+ @else
+
+ @endif
+
+ @endif
@if ($refundCheckLoading)
Checking refund eligibility...
diff --git a/resources/views/livewire/switch-team.blade.php b/resources/views/livewire/switch-team.blade.php
index b46c1ecf6..b979647cb 100644
--- a/resources/views/livewire/switch-team.blade.php
+++ b/resources/views/livewire/switch-team.blade.php
@@ -1,6 +1,49 @@
-
-
- @foreach (auth()->user()->teams as $team)
-
- @endforeach
-
+@php
+ $currentTeam = auth()->user()->currentTeam();
+ $teamInitial = strtoupper(mb_substr($currentTeam->name, 0, 1));
+@endphp
+
+
+
+
+ @foreach (auth()->user()->teams as $team)
+
+ @endforeach
+
+
+
+
+
+
Switch team
+ @foreach (auth()->user()->teams as $team)
+
+ @endforeach
+
+
+
toBeLessThan(strpos($layoutView, ''));
+});
diff --git a/tests/Feature/DeprecatedDockerComposeApplicationEndpointTest.php b/tests/Feature/DeprecatedDockerComposeApplicationEndpointTest.php
new file mode 100644
index 000000000..35dff7bd4
--- /dev/null
+++ b/tests/Feature/DeprecatedDockerComposeApplicationEndpointTest.php
@@ -0,0 +1,22 @@
+getRoutes())
+ ->filter(fn ($route) => in_array('POST', $route->methods(), true))
+ ->filter(fn ($route) => $route->uri() === 'api/v1/applications/dockercompose');
+
+ expect($routes)->toBeEmpty();
+
+ $this->postJson('/api/v1/applications/dockercompose')->assertNotFound();
+});
+
+test('custom docker compose services endpoint remains registered', function () {
+ $route = collect(Route::getRoutes()->getRoutes())
+ ->first(fn ($route) => in_array('POST', $route->methods(), true) && $route->uri() === 'api/v1/services');
+
+ expect($route)->not->toBeNull()
+ ->and($route->getActionName())->toBe(ServicesController::class.'@create_service');
+});
diff --git a/tests/Feature/DevelopmentRailpackExamplesSeederTest.php b/tests/Feature/DevelopmentRailpackExamplesSeederTest.php
new file mode 100644
index 000000000..59646a804
--- /dev/null
+++ b/tests/Feature/DevelopmentRailpackExamplesSeederTest.php
@@ -0,0 +1,141 @@
+seed([
+ UserSeeder::class,
+ TeamSeeder::class,
+ PrivateKeySeeder::class,
+ ServerSeeder::class,
+ ProjectSeeder::class,
+ StandaloneDockerSeeder::class,
+ GithubAppSeeder::class,
+ ]);
+}
+
+it('can seed the railpack examples directly on a clean development database', function () {
+ config()->set('app.env', 'local');
+
+ $this->seed(DevelopmentRailpackExamplesSeeder::class);
+
+ expect(Team::query()->find(0))->not->toBeNull();
+ expect(PrivateKey::query()->find(1))->not->toBeNull();
+ expect(Server::query()->find(0))->not->toBeNull();
+ expect(StandaloneDocker::query()->find(0))->not->toBeNull();
+ expect(GithubApp::query()->find(0))->not->toBeNull();
+ expect(Project::query()->where('uuid', DevelopmentRailpackExamplesSeeder::PROJECT_UUID)->exists())->toBeTrue();
+ expect(Application::query()->count())->toBe(count(DevelopmentRailpackExamplesSeeder::examples()));
+});
+
+it('seeds the railpack examples in development mode', function () {
+ config()->set('app.env', 'local');
+
+ seedRailpackExamplePrerequisites();
+ $this->seed(DevelopmentRailpackExamplesSeeder::class);
+
+ $project = Project::query()
+ ->where('uuid', DevelopmentRailpackExamplesSeeder::PROJECT_UUID)
+ ->first();
+
+ expect($project)
+ ->not->toBeNull()
+ ->and($project->name)->toBe('Railpack Examples')
+ ->and($project->environments)->toHaveCount(1)
+ ->and($project->environments->first()->uuid)->toBe(DevelopmentRailpackExamplesSeeder::ENVIRONMENT_UUID);
+
+ $applications = $project->applications()->with('settings')->orderBy('uuid')->get();
+
+ expect($applications)->toHaveCount(count(DevelopmentRailpackExamplesSeeder::examples()));
+ expect($applications->every(fn (Application $application) => $application->build_pack === 'railpack'))->toBeTrue();
+ expect($applications->every(fn (Application $application) => $application->git_repository === DevelopmentRailpackExamplesSeeder::GIT_REPOSITORY))->toBeTrue();
+
+ $examples = collect(DevelopmentRailpackExamplesSeeder::examples())->keyBy('uuid');
+ expect($applications->every(
+ fn (Application $application) => $application->git_branch === ($examples->get($application->uuid)['git_branch'] ?? DevelopmentRailpackExamplesSeeder::GIT_BRANCH)
+ ))->toBeTrue();
+
+ $nestjs = $applications->firstWhere('uuid', 'railpack-nestjs');
+ $angularStatic = $applications->firstWhere('uuid', 'railpack-angular-static');
+ $eleventyStatic = $applications->firstWhere('uuid', 'railpack-eleventy-static');
+ $pythonFlask = $applications->firstWhere('uuid', 'railpack-python-flask');
+ $goGin = $applications->firstWhere('uuid', 'railpack-go-gin');
+ $rust = $applications->firstWhere('uuid', 'railpack-rust');
+
+ expect($nestjs)
+ ->not->toBeNull()
+ ->and($nestjs->base_directory)->toBe('/node/nestjs')
+ ->and($nestjs->ports_exposes)->toBe('3000')
+ ->and($nestjs->build_command)->toBe('npm run build')
+ ->and($nestjs->start_command)->toBe('npm run start:prod')
+ ->and($nestjs->settings->is_static)->toBeFalse();
+
+ expect($angularStatic)
+ ->not->toBeNull()
+ ->and($angularStatic->publish_directory)->toBe('/dist/static/browser')
+ ->and($angularStatic->ports_exposes)->toBe('80')
+ ->and($angularStatic->settings->is_static)->toBeTrue()
+ ->and($angularStatic->settings->is_spa)->toBeTrue();
+
+ expect($eleventyStatic)
+ ->not->toBeNull()
+ ->and($eleventyStatic->publish_directory)->toBe('/_site')
+ ->and($eleventyStatic->settings->is_static)->toBeTrue()
+ ->and($eleventyStatic->settings->is_spa)->toBeFalse();
+
+ expect($pythonFlask)
+ ->not->toBeNull()
+ ->and($pythonFlask->ports_exposes)->toBe('5000')
+ ->and($pythonFlask->start_command)->toBe('flask run --host=0.0.0.0 --port=5000');
+
+ expect($goGin)
+ ->not->toBeNull()
+ ->and($goGin->ports_exposes)->toBe('3000');
+
+ expect($rust)
+ ->not->toBeNull()
+ ->and($rust->ports_exposes)->toBe('8000');
+});
+
+it('skips the railpack examples outside development mode', function () {
+ config()->set('app.env', 'testing');
+
+ seedRailpackExamplePrerequisites();
+ $this->seed(DevelopmentRailpackExamplesSeeder::class);
+
+ expect(Project::query()->where('uuid', DevelopmentRailpackExamplesSeeder::PROJECT_UUID)->exists())->toBeFalse();
+ expect(Application::query()->where('uuid', 'railpack-nextjs-ssr')->exists())->toBeFalse();
+});
+
+it('is idempotent when run multiple times', function () {
+ config()->set('app.env', 'local');
+
+ seedRailpackExamplePrerequisites();
+ $this->seed(DevelopmentRailpackExamplesSeeder::class);
+ $this->seed(DevelopmentRailpackExamplesSeeder::class);
+
+ $project = Project::query()
+ ->where('uuid', DevelopmentRailpackExamplesSeeder::PROJECT_UUID)
+ ->first();
+
+ expect($project)->not->toBeNull();
+ expect($project->applications()->count())->toBe(count(DevelopmentRailpackExamplesSeeder::examples()));
+});
diff --git a/tests/Feature/EnvironmentVariableKeyValidationTest.php b/tests/Feature/EnvironmentVariableKeyValidationTest.php
new file mode 100644
index 000000000..4f41ed3d6
--- /dev/null
+++ b/tests/Feature/EnvironmentVariableKeyValidationTest.php
@@ -0,0 +1,39 @@
+set('key', 'BAD=KEY')
+ ->set('value', 'value')
+ ->call('submit')
+ ->assertHasErrors(['key' => 'regex']);
+});
+
+it('allows Docker-compatible environment variable keys in the add form', function (string $key) {
+ Livewire::test(Add::class)
+ ->set('key', $key)
+ ->set('value', 'value')
+ ->call('submit')
+ ->assertHasNoErrors()
+ ->assertDispatched('saveKey', function ($event, array $data) use ($key) {
+ return data_get($data, 'key') === $key || data_get($data, '0.key') === $key;
+ });
+})->with([
+ 'starts with digit' => '1BAD',
+ 'hyphen' => 'BAD-KEY',
+ 'dot' => 'node.name',
+ 'uppercase dots' => 'XPACK.SECURITY.ENABLED',
+]);
+
+it('trims surrounding whitespace in environment variable keys in the add form', function () {
+ Livewire::test(Add::class)
+ ->set('key', ' node.name ')
+ ->set('value', 'value')
+ ->call('submit')
+ ->assertHasNoErrors()
+ ->assertDispatched('saveKey', function ($event, array $data) {
+ return data_get($data, 'key') === 'node.name' || data_get($data, '0.key') === 'node.name';
+ });
+});
diff --git a/tests/Feature/Livewire/ConfigurationCheckerTest.php b/tests/Feature/Livewire/ConfigurationCheckerTest.php
new file mode 100644
index 000000000..edf8c5044
--- /dev/null
+++ b/tests/Feature/Livewire/ConfigurationCheckerTest.php
@@ -0,0 +1,158 @@
+team = Team::factory()->create();
+ $this->user = User::factory()->create();
+ $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+ $this->actingAs($this->user);
+ session(['currentTeam' => $this->team]);
+
+ $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+ $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+});
+
+function configurationCheckerApplication(Environment $environment, array $attributes = []): Application
+{
+ return Application::factory()->create(array_merge([
+ 'environment_id' => $environment->id,
+ 'status' => 'running:healthy',
+ 'build_command' => 'npm run build',
+ 'fqdn' => 'https://example.com',
+ ], $attributes));
+}
+
+function markConfigurationCheckerApplicationDeployed(Application $application): void
+{
+ $deployment = ApplicationDeploymentQueue::create([
+ 'application_id' => (string) $application->id,
+ 'deployment_uuid' => (string) Str::uuid(),
+ 'status' => 'finished',
+ 'commit' => 'HEAD',
+ ]);
+
+ $application->markDeploymentConfigurationApplied($deployment);
+}
+
+it('does not render the notification for preview deployment toggles', function () {
+ $application = configurationCheckerApplication($this->environment);
+ markConfigurationCheckerApplicationDeployed($application);
+
+ $application->settings->update(['is_preview_deployments_enabled' => true]);
+
+ Livewire::test(ConfigurationChecker::class, ['resource' => $application->refresh()])
+ ->assertDontSee('The latest deployment is not using the current configuration')
+ ->assertSet('isConfigurationChanged', false);
+});
+
+it('renders the changed configuration labels', function () {
+ $application = configurationCheckerApplication($this->environment);
+ markConfigurationCheckerApplicationDeployed($application);
+
+ $application->update(['build_command' => 'pnpm build']);
+
+ Livewire::test(ConfigurationChecker::class, ['resource' => $application->refresh()])
+ ->assertSee('The latest configuration has not been applied')
+ ->assertSee('Build command')
+ ->assertSee('A rebuild is required.');
+});
+
+it('refreshes configuration changes when the event is received', function () {
+ $application = configurationCheckerApplication($this->environment);
+ markConfigurationCheckerApplicationDeployed($application);
+
+ $component = Livewire::test(ConfigurationChecker::class, ['resource' => $application->refresh()])
+ ->assertSet('isConfigurationChanged', false)
+ ->assertDontSee('The latest configuration has not been applied');
+
+ $application->update(['build_command' => 'pnpm build']);
+
+ $component
+ ->dispatch('configurationChanged')
+ ->assertSet('isConfigurationChanged', true)
+ ->assertSee('The latest configuration has not been applied')
+ ->assertSee('Build command');
+});
+
+it('refreshes stale modal configuration diff before opening changes', function () {
+ $application = configurationCheckerApplication($this->environment);
+ markConfigurationCheckerApplicationDeployed($application);
+
+ $application->update(['build_command' => 'pnpm build']);
+
+ $component = Livewire::test(ConfigurationChecker::class, ['resource' => $application->refresh()])
+ ->assertSee('Build command')
+ ->assertDontSee('Start command');
+
+ $application->update([
+ 'build_command' => 'npm run build',
+ 'start_command' => 'node server.js',
+ ]);
+
+ $component
+ ->call('refreshConfigurationChanges')
+ ->assertSet('isConfigurationChanged', true)
+ ->assertSee('Start command')
+ ->assertDontSee('Build command');
+});
+
+it('does not render environment variable secret values', function () {
+ $application = configurationCheckerApplication($this->environment);
+ EnvironmentVariable::create([
+ 'key' => 'API_TOKEN',
+ 'value' => 'old-secret',
+ 'is_buildtime' => false,
+ 'is_runtime' => true,
+ 'is_preview' => false,
+ 'resourceable_type' => Application::class,
+ 'resourceable_id' => $application->id,
+ ]);
+ markConfigurationCheckerApplicationDeployed($application->refresh());
+
+ $application->environment_variables()->where('key', 'API_TOKEN')->first()->update(['value' => 'new-secret']);
+
+ Livewire::test(ConfigurationChecker::class, ['resource' => $application->refresh()])
+ ->assertSee('API_TOKEN')
+ ->assertSee('changed')
+ ->assertSee('Set')
+ ->assertDontSee('Hidden')
+ ->assertDontSee('old-secret')
+ ->assertDontSee('new-secret');
+});
+
+it('renders added environment variables as set without exposing secret values', function () {
+ $application = configurationCheckerApplication($this->environment);
+ markConfigurationCheckerApplicationDeployed($application);
+
+ EnvironmentVariable::create([
+ 'key' => 'API_TOKEN',
+ 'value' => 'new-secret',
+ 'is_buildtime' => false,
+ 'is_runtime' => true,
+ 'is_preview' => false,
+ 'resourceable_type' => Application::class,
+ 'resourceable_id' => $application->id,
+ ]);
+
+ Livewire::test(ConfigurationChecker::class, ['resource' => $application->refresh()])
+ ->assertSee('API_TOKEN')
+ ->assertSee('From')
+ ->assertSee('Not set')
+ ->assertSee('To')
+ ->assertSee('Set')
+ ->assertDontSee('Hidden')
+ ->assertDontSee('new-secret');
+});
diff --git a/tests/Feature/Livewire/Project/Application/AdvancedStopGracePeriodTest.php b/tests/Feature/Livewire/Project/Application/AdvancedStopGracePeriodTest.php
new file mode 100644
index 000000000..1bc179502
--- /dev/null
+++ b/tests/Feature/Livewire/Project/Application/AdvancedStopGracePeriodTest.php
@@ -0,0 +1,108 @@
+create();
+ $server = Server::factory()->create(['team_id' => $team->id]);
+ $project = Project::factory()->create(['team_id' => $team->id]);
+ $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+ return Application::create([
+ 'name' => 'stop-grace-period-test-app',
+ 'git_repository' => 'https://github.com/coollabsio/coolify',
+ 'git_branch' => 'main',
+ 'build_pack' => 'nixpacks',
+ 'ports_exposes' => '3000',
+ 'environment_id' => $environment->id,
+ 'destination_id' => $server->standaloneDockers()->firstOrFail()->id,
+ 'destination_type' => $server->standaloneDockers()->firstOrFail()->getMorphClass(),
+ ]);
+}
+
+beforeEach(function () {
+ $this->actingAs(User::factory()->create());
+});
+
+it('saves a valid stop grace period', function () {
+ $application = createApplicationForAdvancedStopGracePeriodTest();
+
+ Livewire::test(Advanced::class, ['application' => $application])
+ ->set('stopGracePeriod', '300')
+ ->call('saveStopGracePeriod')
+ ->assertHasNoErrors()
+ ->assertDispatched('success');
+
+ expect($application->settings()->first()->stop_grace_period)->toBe(300);
+});
+
+it('dispatches configuration changed when advanced settings are saved', function () {
+ $application = createApplicationForAdvancedStopGracePeriodTest();
+
+ Livewire::test(Advanced::class, ['application' => $application])
+ ->set('includeSourceCommitInBuild', true)
+ ->call('submit')
+ ->assertHasNoErrors()
+ ->assertDispatched('configurationChanged');
+});
+
+it('clears the stop grace period when submitted empty', function () {
+ $application = createApplicationForAdvancedStopGracePeriodTest();
+ $application->settings->update(['stop_grace_period' => 300]);
+
+ Livewire::test(Advanced::class, ['application' => $application->fresh()])
+ ->set('stopGracePeriod', '')
+ ->call('saveStopGracePeriod')
+ ->assertHasNoErrors()
+ ->assertDispatched('success');
+
+ expect($application->settings()->first()->stop_grace_period)->toBeNull();
+});
+
+it('rejects invalid stop grace periods', function (string $value, string $rule) {
+ $application = createApplicationForAdvancedStopGracePeriodTest();
+
+ Livewire::test(Advanced::class, ['application' => $application])
+ ->set('stopGracePeriod', $value)
+ ->call('saveStopGracePeriod')
+ ->assertHasErrors(['stopGracePeriod' => [$rule]]);
+
+ expect($application->settings()->first()->stop_grace_period)->toBeNull();
+})->with([
+ 'below minimum' => ['0', 'min'],
+ 'above maximum' => [(string) (MAX_STOP_GRACE_PERIOD_SECONDS + 1), 'max'],
+ 'malformed integer' => ['10abc', 'integer'],
+ 'decimal' => ['1.9', 'integer'],
+]);
+
+it('uses one second deployment timeout in local only when stop grace period is unset', function () {
+ config(['app.env' => 'local']);
+
+ $setting = new ApplicationSetting;
+
+ expect($setting->deploymentStopGracePeriodSeconds())->toBe(MIN_STOP_GRACE_PERIOD_SECONDS);
+
+ $setting->stop_grace_period = 10;
+
+ expect($setting->deploymentStopGracePeriodSeconds())->toBe(10);
+});
+
+it('uses default deployment timeout outside local when stop grace period is unset', function () {
+ config(['app.env' => 'production']);
+
+ $setting = new ApplicationSetting;
+
+ expect($setting->deploymentStopGracePeriodSeconds())->toBe(DEFAULT_STOP_GRACE_PERIOD_SECONDS);
+});
diff --git a/tests/Feature/Livewire/RailpackLivewireUiTest.php b/tests/Feature/Livewire/RailpackLivewireUiTest.php
new file mode 100644
index 000000000..b21037b11
--- /dev/null
+++ b/tests/Feature/Livewire/RailpackLivewireUiTest.php
@@ -0,0 +1,121 @@
+team = Team::factory()->create();
+ $this->user = User::factory()->create();
+ $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+ $this->actingAs($this->user);
+ session(['currentTeam' => $this->team]);
+ InstanceSettings::unguarded(function () {
+ InstanceSettings::updateOrCreate(['id' => 0], []);
+ });
+
+ $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+ $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+});
+
+describe('PublicGitRepository port handling for railpack', function () {
+ test('switching to railpack resets port to 3000 when not static', function () {
+ Livewire::test(PublicGitRepository::class, ['type' => 'public'])
+ ->set('build_pack', 'dockerfile')
+ ->assertSet('port', 3000)
+ ->set('build_pack', 'railpack')
+ ->assertSet('port', 3000);
+ });
+
+ test('switching to railpack preserves port when isStatic is true', function () {
+ $component = Livewire::test(PublicGitRepository::class, ['type' => 'public'])
+ ->set('isStatic', true)
+ ->call('instantSave');
+
+ // After instantSave with isStatic=true, port becomes 80
+ $component->assertSet('port', 80);
+
+ // Switching from nixpacks to railpack should NOT clobber port back to 3000
+ $component->set('build_pack', 'railpack')
+ ->assertSet('port', 80);
+ });
+
+ test('switching to static sets port to 80 and disables show_is_static', function () {
+ Livewire::test(PublicGitRepository::class, ['type' => 'public'])
+ ->set('build_pack', 'static')
+ ->assertSet('port', 80)
+ ->assertSet('isStatic', false)
+ ->assertSet('show_is_static', false);
+ });
+});
+
+describe('General view railpack helper text', function () {
+ beforeEach(function () {
+ $this->privateKey = PrivateKey::create([
+ 'name' => 'Test Key',
+ 'private_key' => '-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevAAAAJi/QySHv0Mk
+hwAAAAtzc2gtZWQyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevA
+AAAECBQw4jg1WRT2IGHMncCiZhURCts2s24HoDS0thHnnRKVuGmoeGq/pojrsyP1pszcNV
+uZx9iFkCELtxrh31QJ68AAAAEXNhaWxANzZmZjY2ZDJlMmRkAQIDBA==
+-----END OPENSSH PRIVATE KEY-----',
+ 'team_id' => $this->team->id,
+ ]);
+ $this->server = Server::factory()->create([
+ 'team_id' => $this->team->id,
+ 'private_key_id' => $this->privateKey->id,
+ ]);
+ $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first()
+ ?? StandaloneDocker::factory()->create(['server_id' => $this->server->id, 'network' => 'coolify-test']);
+ });
+
+ test('railpack app shows railpack.json helper text and not nixpacks.toml', function () {
+ $application = Application::factory()->create([
+ 'environment_id' => $this->environment->id,
+ 'destination_id' => $this->destination->id,
+ 'destination_type' => StandaloneDocker::class,
+ 'build_pack' => 'railpack',
+ 'static_image' => 'nginx:alpine',
+ 'base_directory' => '/',
+ 'is_http_basic_auth_enabled' => false,
+ 'redirect' => 'no',
+ ]);
+
+ Livewire::test(General::class, ['application' => $application])
+ ->assertSuccessful()
+ ->assertSee('railpack.json')
+ ->assertDontSee('nixpacks.toml');
+ });
+
+ test('nixpacks app shows nixpacks.toml helper text and not railpack.json', function () {
+ $application = Application::factory()->create([
+ 'environment_id' => $this->environment->id,
+ 'destination_id' => $this->destination->id,
+ 'destination_type' => StandaloneDocker::class,
+ 'build_pack' => 'nixpacks',
+ 'static_image' => 'nginx:alpine',
+ 'base_directory' => '/',
+ 'is_http_basic_auth_enabled' => false,
+ 'redirect' => 'no',
+ ]);
+
+ Livewire::test(General::class, ['application' => $application])
+ ->assertSuccessful()
+ ->assertSee('nixpacks.toml')
+ ->assertDontSee('railpack.json');
+ });
+});
diff --git a/tests/Feature/Mcp/McpEndpointTest.php b/tests/Feature/Mcp/McpEndpointTest.php
new file mode 100644
index 000000000..34ae493cc
--- /dev/null
+++ b/tests/Feature/Mcp/McpEndpointTest.php
@@ -0,0 +1,194 @@
+where('id', 0)->delete();
+ InstanceSettings::query()->delete();
+ $settings = new InstanceSettings(['is_mcp_server_enabled' => true]);
+ $settings->id = 0;
+ $settings->save();
+
+ $this->team = Team::factory()->create();
+ $this->user = User::factory()->create();
+ $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+ session(['currentTeam' => $this->team]);
+});
+
+function mcpPost(array $payload, ?string $token = null)
+{
+ $headers = [
+ 'Content-Type' => 'application/json',
+ 'Accept' => 'application/json, text/event-stream',
+ ];
+ if ($token) {
+ $headers['Authorization'] = 'Bearer '.$token;
+ }
+
+ return test()->withHeaders($headers)->postJson('/mcp', $payload);
+}
+
+function mcpListTools(string $token)
+{
+ return mcpPost([
+ 'jsonrpc' => '2.0',
+ 'id' => 1,
+ 'method' => 'tools/list',
+ 'params' => (object) [],
+ ], $token);
+}
+
+function mcpCallTool(string $token, string $name, array $arguments = [])
+{
+ return mcpPost([
+ 'jsonrpc' => '2.0',
+ 'id' => 1,
+ 'method' => 'tools/call',
+ 'params' => [
+ 'name' => $name,
+ 'arguments' => (object) $arguments,
+ ],
+ ], $token);
+}
+
+function mcpToolJson($response): array
+{
+ return json_decode($response->json('result.content.0.text'), true);
+}
+
+test('MCP endpoint returns 404 when the instance setting is disabled', function () {
+ InstanceSettings::query()->where('id', 0)->update(['is_mcp_server_enabled' => false]);
+ Once::flush();
+
+ $response = mcpPost(['jsonrpc' => '2.0', 'id' => 1, 'method' => 'tools/list']);
+ $response->assertStatus(404);
+});
+
+test('MCP endpoint rejects unauthenticated requests', function () {
+ $response = mcpPost(['jsonrpc' => '2.0', 'id' => 1, 'method' => 'tools/list']);
+ $response->assertStatus(401);
+});
+
+test('MCP endpoint lists tools for an authenticated token', function () {
+ $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
+
+ $response = mcpListTools($token);
+ $response->assertOk();
+
+ $toolNames = collect($response->json('result.tools'))->pluck('name')->all();
+ expect($toolNames)->toContain(
+ 'get_infrastructure_overview',
+ 'list_servers',
+ 'get_server',
+ 'list_projects',
+ 'list_applications',
+ 'get_application',
+ 'list_databases',
+ 'get_database',
+ 'list_services',
+ 'get_service',
+ );
+ expect($toolNames)->not->toContain('get_resource_status');
+});
+
+test('list_projects returns summary + pagination scoped to the token team', function () {
+ $project = Project::create(['name' => 'Mine', 'team_id' => $this->team->id]);
+
+ $otherTeam = Team::factory()->create();
+ Project::create(['name' => 'Theirs', 'team_id' => $otherTeam->id]);
+
+ $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
+
+ $response = mcpCallTool($token, 'list_projects');
+ $response->assertOk();
+
+ $body = mcpToolJson($response);
+
+ expect($body)->toHaveKey('data');
+ expect($body)->toHaveKey('_pagination');
+ expect($body['_pagination']['total'])->toBe(1);
+ expect($body['_pagination']['per_page'])->toBe(50);
+ expect($body['_pagination'])->not->toHaveKey('next');
+
+ $uuids = collect($body['data'])->pluck('uuid')->all();
+ $names = collect($body['data'])->pluck('name')->all();
+ expect($uuids)->toContain($project->uuid);
+ expect($names)->not->toContain('Theirs');
+ expect($body['data'][0])->toHaveKeys(['uuid', 'name', 'description']);
+});
+
+test('list_projects paginates with per_page cap at 100', function () {
+ for ($i = 0; $i < 3; $i++) {
+ Project::create(['name' => "P{$i}", 'team_id' => $this->team->id]);
+ }
+ $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
+
+ $response = mcpCallTool($token, 'list_projects', ['per_page' => 2, 'page' => 1]);
+ $body = mcpToolJson($response);
+
+ expect($body['_pagination']['total'])->toBe(3);
+ expect($body['_pagination']['total_pages'])->toBe(2);
+ expect($body['_pagination']['next']['args'])->toMatchArray(['page' => 2, 'per_page' => 2]);
+ expect($body['data'])->toHaveCount(2);
+
+ // Verify max cap
+ $capped = mcpCallTool($token, 'list_projects', ['per_page' => 500]);
+ $cappedBody = mcpToolJson($capped);
+ expect($cappedBody['_pagination']['per_page'])->toBe(100);
+});
+
+test('get_infrastructure_overview returns counts', function () {
+ Project::create(['name' => 'One', 'team_id' => $this->team->id]);
+ Project::create(['name' => 'Two', 'team_id' => $this->team->id]);
+
+ $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
+
+ $response = mcpCallTool($token, 'get_infrastructure_overview');
+ $response->assertOk();
+
+ $body = mcpToolJson($response);
+ expect($body)->toHaveKey('data');
+ expect($body['data'])->toHaveKeys(['coolify_version', 'servers', 'projects', 'counts']);
+ expect($body['data']['counts']['projects'])->toBe(2);
+ expect($body['data']['projects'])->toHaveCount(2);
+ expect($body['data']['projects'][0])->toHaveKey('counts');
+});
+
+test('get_server scrubs sensitive nested data and exposes connection_timeout', function () {
+ $server = Server::factory()->create(['team_id' => $this->team->id]);
+ // creating hook auto-generates a sentinel_token; bump connection_timeout
+ // via saveQuietly to avoid triggering restartSentinel.
+ $server->settings->forceFill(['connection_timeout' => 42])->saveQuietly();
+
+ $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
+
+ $response = mcpCallTool($token, 'get_server', ['uuid' => $server->uuid]);
+ $response->assertOk();
+
+ $body = mcpToolJson($response);
+ $raw = json_encode($body);
+
+ expect($raw)->not->toContain('sentinel_token');
+ expect($raw)->not->toContain('"team_id"');
+ expect($raw)->not->toContain('"private_key_id"');
+ expect($body['data']['connection_timeout'])->toBe(42);
+ expect($body['data']['uuid'])->toBe($server->uuid);
+});
+
+test('tool calls fail when the token lacks the read ability', function () {
+ $token = $this->user->createToken('mcp-no-abilities', [])->plainTextToken;
+
+ $response = mcpCallTool($token, 'list_projects');
+ $response->assertOk();
+
+ expect($response->json('result.isError'))->toBeTrue();
+ expect($response->json('result.content.0.text'))->toContain('Missing required permissions');
+});
diff --git a/tests/Feature/Mcp/McpToggleApiTest.php b/tests/Feature/Mcp/McpToggleApiTest.php
new file mode 100644
index 000000000..68d5d335a
--- /dev/null
+++ b/tests/Feature/Mcp/McpToggleApiTest.php
@@ -0,0 +1,107 @@
+delete();
+ $settings = new InstanceSettings([
+ 'is_mcp_server_enabled' => false,
+ 'is_api_enabled' => true,
+ ]);
+ $settings->id = 0;
+ $settings->save();
+
+ $this->team = Team::factory()->create();
+ $this->user = User::factory()->create();
+ $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+ session(['currentTeam' => $this->team]);
+});
+
+function makeRootMcpToken(User $user): string
+{
+ $token = $user->createToken('mcp-root', ['root']);
+ DB::table('personal_access_tokens')
+ ->where('id', $token->accessToken->id)
+ ->update(['team_id' => '0']);
+
+ return $token->plainTextToken;
+}
+
+function makeNonRootMcpToken(User $user, Team $team, array $abilities = ['write']): string
+{
+ $token = $user->createToken('mcp-write', $abilities);
+ DB::table('personal_access_tokens')
+ ->where('id', $token->accessToken->id)
+ ->update(['team_id' => (string) $team->id]);
+
+ return $token->plainTextToken;
+}
+
+test('POST /api/v1/mcp/enable enables MCP server with root token', function () {
+ $token = makeRootMcpToken($this->user);
+
+ $response = test()->withHeaders([
+ 'Authorization' => 'Bearer '.$token,
+ ])->postJson('/api/v1/mcp/enable');
+
+ $response->assertOk();
+ $response->assertJson(['message' => 'MCP server enabled.']);
+ expect(InstanceSettings::find(0)->is_mcp_server_enabled)->toBeTrue();
+});
+
+test('POST /api/v1/mcp/disable disables MCP server with root token', function () {
+ InstanceSettings::query()->where('id', 0)->update(['is_mcp_server_enabled' => true]);
+ $token = makeRootMcpToken($this->user);
+
+ $response = test()->withHeaders([
+ 'Authorization' => 'Bearer '.$token,
+ ])->postJson('/api/v1/mcp/disable');
+
+ $response->assertOk();
+ $response->assertJson(['message' => 'MCP server disabled.']);
+ expect(InstanceSettings::find(0)->is_mcp_server_enabled)->toBeFalse();
+});
+
+test('non-root token cannot enable MCP server', function () {
+ $token = makeNonRootMcpToken($this->user, $this->team);
+
+ $response = test()->withHeaders([
+ 'Authorization' => 'Bearer '.$token,
+ ])->postJson('/api/v1/mcp/enable');
+
+ $response->assertStatus(403);
+ expect(InstanceSettings::find(0)->is_mcp_server_enabled)->toBeFalse();
+});
+
+test('non-root token cannot disable MCP server', function () {
+ InstanceSettings::query()->where('id', 0)->update(['is_mcp_server_enabled' => true]);
+ $token = makeNonRootMcpToken($this->user, $this->team);
+
+ $response = test()->withHeaders([
+ 'Authorization' => 'Bearer '.$token,
+ ])->postJson('/api/v1/mcp/disable');
+
+ $response->assertStatus(403);
+ expect(InstanceSettings::find(0)->is_mcp_server_enabled)->toBeTrue();
+});
+
+test('unauthenticated request to /api/v1/mcp/enable returns 401', function () {
+ $response = test()->postJson('/api/v1/mcp/enable');
+ $response->assertStatus(401);
+});
+
+test('read-only token cannot toggle MCP server (lacks write ability)', function () {
+ $token = makeNonRootMcpToken($this->user, $this->team, ['read']);
+
+ $response = test()->withHeaders([
+ 'Authorization' => 'Bearer '.$token,
+ ])->postJson('/api/v1/mcp/enable');
+
+ $response->assertStatus(403);
+});
diff --git a/tests/Feature/ModelFillableCreationTest.php b/tests/Feature/ModelFillableCreationTest.php
index b72e7381e..e6d340a4f 100644
--- a/tests/Feature/ModelFillableCreationTest.php
+++ b/tests/Feature/ModelFillableCreationTest.php
@@ -299,6 +299,7 @@
'inject_build_args_to_dockerfile' => true,
'include_source_commit_in_build' => true,
'docker_images_to_keep' => 5,
+ 'stop_grace_period' => 300,
]);
expect($setting->exists)->toBeTrue();
@@ -309,6 +310,7 @@
expect($setting->custom_internal_name)->toBe('my-custom-app');
expect($setting->is_spa)->toBeTrue();
expect($setting->docker_images_to_keep)->toBe(5);
+ expect($setting->stop_grace_period)->toBe(300);
});
it('creates ServerSetting with all fillable attributes', function () {
diff --git a/tests/Feature/NewApplicationBuildpackDefaultsTest.php b/tests/Feature/NewApplicationBuildpackDefaultsTest.php
new file mode 100644
index 000000000..24c2a8fcf
--- /dev/null
+++ b/tests/Feature/NewApplicationBuildpackDefaultsTest.php
@@ -0,0 +1,49 @@
+team = Team::factory()->create();
+ $this->user = User::factory()->create();
+ $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+ $this->actingAs($this->user);
+ session(['currentTeam' => $this->team]);
+});
+
+describe('new application buildpack defaults', function () {
+ test('github app repository flow defaults to nixpacks', function () {
+ Livewire::test(GithubPrivateRepository::class, ['type' => 'private-gh-app'])
+ ->assertSet('build_pack', 'nixpacks');
+ });
+
+ test('deploy key repository flow defaults to nixpacks', function () {
+ Livewire::test(GithubPrivateRepositoryDeployKey::class, ['type' => 'private-deploy-key'])
+ ->assertSet('build_pack', 'nixpacks');
+ });
+
+ test('public repository flow defaults to nixpacks and lists railpack second', function () {
+ Livewire::test(PublicGitRepository::class, ['type' => 'public'])
+ ->assertSet('build_pack', 'nixpacks');
+ });
+
+ test('public repository flow keeps railpack available after branch lookup', function () {
+ Livewire::test(PublicGitRepository::class, ['type' => 'public'])
+ ->set('branchFound', true)
+ ->assertSeeInOrder(['Nixpacks', 'Railpack (Beta)']);
+ });
+
+ test('deploy key repository flow shows railpack beta label in build pack selector without beta badge', function () {
+ Livewire::test(GithubPrivateRepositoryDeployKey::class, ['type' => 'private-deploy-key'])
+ ->set('current_step', 'repository')
+ ->assertSee('Railpack (Beta)');
+ });
+});
diff --git a/tests/Feature/OauthControllerTest.php b/tests/Feature/OauthControllerTest.php
new file mode 100644
index 000000000..af5fb0658
--- /dev/null
+++ b/tests/Feature/OauthControllerTest.php
@@ -0,0 +1,79 @@
+ 0,
+ 'is_registration_enabled' => false,
+ ]);
+
+ OauthSetting::create([
+ 'provider' => 'google',
+ 'client_id' => 'client-id',
+ 'client_secret' => 'client-secret',
+ 'redirect_uri' => 'https://coolify.example.com/auth/google/callback',
+ 'tenant' => 'example.com',
+ ]);
+});
+
+it('logs in an existing user when the oauth provider returns a mixed-case email', function () {
+ config()->set('app.maintenance.driver', 'file');
+
+ $user = User::factory()->create([
+ 'email' => 'username@example.edu',
+ ]);
+
+ $provider = \Mockery::mock();
+ $provider->shouldReceive('setConfig')->once()->andReturnSelf();
+ $provider->shouldReceive('with')->once()->with(['hd' => 'example.com'])->andReturnSelf();
+ $provider->shouldReceive('user')->once()->andReturn((object) [
+ 'email' => 'UserName@example.edu',
+ 'name' => 'Example User',
+ 'id' => 'google-user-id',
+ ]);
+
+ Socialite::shouldReceive('driver')->once()->with('google')->andReturn($provider);
+
+ $response = $this->get(route('auth.callback', 'google'));
+
+ $response->assertRedirect('/');
+ $this->assertAuthenticatedAs($user);
+ expect(User::count())->toBe(1);
+});
+
+it('rejects oauth logins when the provider does not return an email address', function (?string $providerEmail) {
+ config()->set('app.maintenance.driver', 'file');
+ InstanceSettings::firstOrCreate([
+ 'id' => 0,
+ ], [
+ 'is_registration_enabled' => false,
+ ])->update([
+ 'is_registration_enabled' => true,
+ ]);
+
+ $provider = \Mockery::mock();
+ $provider->shouldReceive('setConfig')->once()->andReturnSelf();
+ $provider->shouldReceive('with')->once()->with(['hd' => 'example.com'])->andReturnSelf();
+ $provider->shouldReceive('user')->once()->andReturn((object) [
+ 'email' => $providerEmail,
+ 'name' => 'Example User',
+ 'id' => 'google-user-id',
+ ]);
+
+ Socialite::shouldReceive('driver')->once()->with('google')->andReturn($provider);
+
+ $response = $this->from('/login')->get(route('auth.callback', 'google'));
+
+ $response->assertRedirect('/login');
+ expect(User::count())->toBe(0);
+})->with([
+ 'null email' => [null],
+ 'blank email' => [' '],
+]);
diff --git a/tests/Feature/QueryDatabaseByUuidWithinTeamTest.php b/tests/Feature/QueryDatabaseByUuidWithinTeamTest.php
new file mode 100644
index 000000000..db7eb16b2
--- /dev/null
+++ b/tests/Feature/QueryDatabaseByUuidWithinTeamTest.php
@@ -0,0 +1,70 @@
+teamA = Team::factory()->create();
+ $this->teamB = Team::factory()->create();
+
+ $this->serverA = Server::factory()->create(['team_id' => $this->teamA->id]);
+ $this->destinationA = StandaloneDocker::where('server_id', $this->serverA->id)->first();
+ $this->projectA = Project::factory()->create(['team_id' => $this->teamA->id]);
+ $this->envA = Environment::factory()->create(['project_id' => $this->projectA->id]);
+});
+
+test('queryDatabaseByUuidWithinTeam returns database when team owns it', function () {
+ $database = StandalonePostgresql::create([
+ 'name' => 'pg-team-a',
+ 'image' => 'postgres:15-alpine',
+ 'postgres_user' => 'postgres',
+ 'postgres_password' => 'password',
+ 'postgres_db' => 'postgres',
+ 'environment_id' => $this->envA->id,
+ 'destination_id' => $this->destinationA->id,
+ 'destination_type' => $this->destinationA->getMorphClass(),
+ ]);
+
+ $found = queryDatabaseByUuidWithinTeam($database->uuid, (string) $this->teamA->id);
+
+ expect($found)->not->toBeNull();
+ expect($found->uuid)->toBe($database->uuid);
+ expect($found)->toBeInstanceOf(StandalonePostgresql::class);
+});
+
+test('queryDatabaseByUuidWithinTeam returns null when team does not own the database', function () {
+ $database = StandalonePostgresql::create([
+ 'name' => 'pg-team-a',
+ 'image' => 'postgres:15-alpine',
+ 'postgres_user' => 'postgres',
+ 'postgres_password' => 'password',
+ 'postgres_db' => 'postgres',
+ 'environment_id' => $this->envA->id,
+ 'destination_id' => $this->destinationA->id,
+ 'destination_type' => $this->destinationA->getMorphClass(),
+ ]);
+
+ $found = queryDatabaseByUuidWithinTeam($database->uuid, (string) $this->teamB->id);
+
+ expect($found)->toBeNull();
+});
+
+test('queryDatabaseByUuidWithinTeam returns null for unknown uuid', function () {
+ $found = queryDatabaseByUuidWithinTeam('does-not-exist', (string) $this->teamA->id);
+
+ expect($found)->toBeNull();
+});
+
+test('queryDatabaseByUuidWithinTeam can query every registered standalone database type without error', function () {
+ foreach (STANDALONE_DATABASE_MODELS as $slug => $modelClass) {
+ $count = $modelClass::query()->whereUuid('non-existent-uuid')->count();
+ expect($count)->toBe(0, "{$modelClass} ({$slug}) failed whereUuid() smoke query");
+ }
+});
diff --git a/tests/Feature/QueueApplicationDeploymentCommitTest.php b/tests/Feature/QueueApplicationDeploymentCommitTest.php
new file mode 100644
index 000000000..ac6be5c9e
--- /dev/null
+++ b/tests/Feature/QueueApplicationDeploymentCommitTest.php
@@ -0,0 +1,107 @@
+team = Team::factory()->create();
+ $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+ $this->destination = StandaloneDocker::factory()->create([
+ 'server_id' => $this->server->id,
+ 'network' => 'test-network-'.fake()->unique()->word(),
+ ]);
+ $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+ $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+});
+
+function makeApplication(int $environmentId, int $destinationId, ?string $gitCommitSha): Application
+{
+ $attributes = [
+ 'environment_id' => $environmentId,
+ 'destination_id' => $destinationId,
+ 'destination_type' => StandaloneDocker::class,
+ ];
+
+ if ($gitCommitSha !== null) {
+ $attributes['git_commit_sha'] = $gitCommitSha;
+ }
+
+ return Application::factory()->create($attributes);
+}
+
+describe('queue_application_deployment commit resolution', function () {
+ test('uses application git_commit_sha when commit parameter omitted', function () {
+ $pinnedSha = 'abc123def456abc123def456abc123def456abc1';
+ $application = makeApplication($this->environment->id, $this->destination->id, $pinnedSha);
+
+ $result = queue_application_deployment(
+ application: $application,
+ deployment_uuid: 'test-deploy-uuid-1',
+ );
+
+ expect($result['status'])->toBe('queued');
+
+ $deployment = ApplicationDeploymentQueue::where('deployment_uuid', 'test-deploy-uuid-1')->first();
+ expect($deployment)->not->toBeNull();
+ expect($deployment->commit)->toBe($pinnedSha);
+ });
+
+ test('falls back to HEAD when both commit parameter and git_commit_sha are unset', function () {
+ $application = makeApplication($this->environment->id, $this->destination->id, 'HEAD');
+
+ $result = queue_application_deployment(
+ application: $application,
+ deployment_uuid: 'test-deploy-uuid-2',
+ );
+
+ expect($result['status'])->toBe('queued');
+
+ $deployment = ApplicationDeploymentQueue::where('deployment_uuid', 'test-deploy-uuid-2')->first();
+ expect($deployment->commit)->toBe('HEAD');
+ });
+
+ test('explicit commit parameter overrides application git_commit_sha', function () {
+ $pinnedSha = 'abc123def456abc123def456abc123def456abc1';
+ $webhookSha = '111222333444555666777888999000aaabbbccc1';
+ $application = makeApplication($this->environment->id, $this->destination->id, $pinnedSha);
+
+ $result = queue_application_deployment(
+ application: $application,
+ deployment_uuid: 'test-deploy-uuid-3',
+ commit: $webhookSha,
+ );
+
+ expect($result['status'])->toBe('queued');
+
+ $deployment = ApplicationDeploymentQueue::where('deployment_uuid', 'test-deploy-uuid-3')->first();
+ expect($deployment->commit)->toBe($webhookSha);
+ });
+
+ test('treats empty string commit parameter as unset and uses git_commit_sha', function () {
+ $pinnedSha = 'abc123def456abc123def456abc123def456abc1';
+ $application = makeApplication($this->environment->id, $this->destination->id, $pinnedSha);
+
+ $result = queue_application_deployment(
+ application: $application,
+ deployment_uuid: 'test-deploy-uuid-4',
+ commit: '',
+ );
+
+ expect($result['status'])->toBe('queued');
+
+ $deployment = ApplicationDeploymentQueue::where('deployment_uuid', 'test-deploy-uuid-4')->first();
+ expect($deployment->commit)->toBe($pinnedSha);
+ });
+});
diff --git a/tests/Feature/RealtimeTerminalPackagingTest.php b/tests/Feature/RealtimeTerminalPackagingTest.php
index e8fa5ff76..ba01deca5 100644
--- a/tests/Feature/RealtimeTerminalPackagingTest.php
+++ b/tests/Feature/RealtimeTerminalPackagingTest.php
@@ -32,3 +32,75 @@
->toContain('if (!terminalDebugEnabled) {')
->not->toContain("console.log('Coolify realtime terminal server listening on port 6002. Let the hacking begin!');");
});
+
+it('configures a server-initiated WebSocket heartbeat to survive proxy idle timeouts', function () {
+ $terminalServer = file_get_contents(base_path('docker/coolify-realtime/terminal-server.js'));
+
+ expect($terminalServer)
+ ->toContain('ws.isAlive = true;')
+ ->toContain("ws.on('pong'")
+ ->toContain('ws.ping();')
+ ->toContain('ws.terminate();')
+ ->toContain('HEARTBEAT_INTERVAL_MS');
+});
+
+it('removes the keepalive short-circuit that fired when the tab was hidden', function () {
+ $terminalClient = file_get_contents(base_path('resources/js/terminal.js'));
+
+ expect($terminalClient)
+ ->not->toContain('// Skip keepalive when document is hidden to prevent unnecessary disconnects');
+});
+
+it('uses a fast probe timeout when the tab regains visibility', function () {
+ $terminalClient = file_get_contents(base_path('resources/js/terminal.js'));
+
+ expect($terminalClient)
+ ->toContain("'Visibility-resume timeout'");
+});
+
+it('closes idle terminal sessions after 30 minutes on the server', function () {
+ $terminalServer = file_get_contents(base_path('docker/coolify-realtime/terminal-server.js'));
+
+ expect($terminalServer)
+ ->toContain('IDLE_TIMEOUT_MS = 30 * 60 * 1000')
+ ->toContain('lastActivityAt')
+ ->toContain("ws.send('idle-timeout');")
+ ->toContain("ws.close(1000, 'Idle timeout');");
+});
+
+it('reacts to idle-timeout sentinel on the client and shows a user-facing error', function () {
+ $terminalClient = file_get_contents(base_path('resources/js/terminal.js'));
+
+ expect($terminalClient)
+ ->toContain("event.data === 'idle-timeout'")
+ ->toContain('Terminal closed after 30 minutes of inactivity.');
+});
+
+it('replays the last command on reconnect so the PTY respawns automatically', function () {
+ $terminalClient = file_get_contents(base_path('resources/js/terminal.js'));
+
+ expect($terminalClient)
+ ->toContain('lastSentCommand')
+ ->toContain('Replaying last command after reconnect.')
+ ->toContain('this.lastSentCommand = null;');
+});
+
+it('buffers messages received before the realtime server finishes auth so the replay is not lost', function () {
+ $terminalServer = file_get_contents(base_path('docker/coolify-realtime/terminal-server.js'));
+
+ expect($terminalServer)
+ ->toContain('authReady: false')
+ ->toContain('pendingMessages: []')
+ ->toContain('userSession.pendingMessages.push(message)')
+ ->toContain('userSession.authReady = true');
+});
+
+it('preserves terminal scrollback across transient reconnects', function () {
+ $terminalClient = file_get_contents(base_path('resources/js/terminal.js'));
+
+ expect($terminalClient)
+ ->toContain('── Connection lost at')
+ ->toContain('── Reconnected at')
+ // resetTerminal must NOT call term.reset()/term.clear() any more — those wipe scrollback.
+ ->not->toContain("this.term.reset();\n this.term.clear();");
+});
diff --git a/tests/Feature/ScheduledTaskServerTest.php b/tests/Feature/ScheduledTaskServerTest.php
new file mode 100644
index 000000000..68a9020d0
--- /dev/null
+++ b/tests/Feature/ScheduledTaskServerTest.php
@@ -0,0 +1,66 @@
+team = Team::factory()->create();
+ $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+ $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+ $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+ $this->environment = $this->project->environments()->first();
+});
+
+it('returns null when neither application nor service is set', function () {
+ $task = ScheduledTask::factory()->create([
+ 'team_id' => $this->team->id,
+ ]);
+
+ expect($task->server())->toBeNull();
+});
+
+it('does not throw when accessing dynamic properties on a parentless task', function () {
+ $task = ScheduledTask::factory()->create([
+ 'team_id' => $this->team->id,
+ ]);
+
+ expect(fn () => $task->server())->not->toThrow(Exception::class);
+});
+
+it('resolves server via application destination', function () {
+ $application = Application::factory()->create([
+ 'environment_id' => $this->environment->id,
+ 'destination_id' => $this->destination->id,
+ 'destination_type' => $this->destination->getMorphClass(),
+ ]);
+
+ $task = ScheduledTask::factory()->create([
+ 'application_id' => $application->id,
+ 'team_id' => $this->team->id,
+ ]);
+
+ expect($task->server()?->id)->toBe($this->server->id);
+});
+
+it('resolves server via service destination', function () {
+ $service = Service::factory()->create([
+ 'environment_id' => $this->environment->id,
+ 'destination_id' => $this->destination->id,
+ 'destination_type' => $this->destination->getMorphClass(),
+ ]);
+
+ $task = ScheduledTask::factory()->create([
+ 'service_id' => $service->id,
+ 'team_id' => $this->team->id,
+ ]);
+
+ expect($task->server()?->id)->toBe($this->server->id);
+});
diff --git a/tests/Feature/Security/AuditLogTest.php b/tests/Feature/Security/AuditLogTest.php
new file mode 100644
index 000000000..34e9168ec
--- /dev/null
+++ b/tests/Feature/Security/AuditLogTest.php
@@ -0,0 +1,445 @@
+create();
+ $user = User::factory()->create();
+ $team->members()->attach($user->id, ['role' => 'owner']);
+ session(['currentTeam' => $team]);
+ test()->actingAs($user);
+
+ return [$team, $user];
+}
+
+function makeAuditApiToken(User $user, Team $team, array $abilities = ['root']): string
+{
+ $token = $user->createToken('audit-test', $abilities);
+ DB::table('personal_access_tokens')->where('id', $token->accessToken->id)->update([
+ 'team_id' => $team->id,
+ ]);
+
+ return $token->plainTextToken;
+}
+
+function makeAuditApplication(string $repo = 'test-org/test-repo'): Application
+{
+ $team = Team::factory()->create();
+ $project = Project::factory()->create(['team_id' => $team->id]);
+ $environment = Environment::factory()->create(['project_id' => $project->id]);
+ $server = Server::factory()->create(['team_id' => $team->id]);
+ $destination = $server->standaloneDockers()->firstOrFail();
+
+ return Application::create([
+ 'name' => 'audit-test-app',
+ 'git_repository' => "https://github.com/{$repo}",
+ 'git_branch' => 'main',
+ 'build_pack' => 'nixpacks',
+ 'ports_exposes' => '3000',
+ 'environment_id' => $environment->id,
+ 'destination_id' => $destination->id,
+ 'destination_type' => $destination->getMorphClass(),
+ ]);
+}
+
+describe('audit channel helper', function () {
+ test('auditLog writes structured payload to audit channel', function () {
+ $auditChannel = Mockery::mock();
+ $auditChannel->shouldReceive('info')
+ ->once()
+ ->with('test.event', Mockery::on(function ($context) {
+ return $context['event'] === 'test.event'
+ && $context['custom_field'] === 'value'
+ && array_key_exists('ip', $context)
+ && array_key_exists('user_id', $context);
+ }));
+
+ Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+
+ auditLog('test.event', ['custom_field' => 'value']);
+ });
+
+ test('auditLog warning level routes correctly', function () {
+ $auditChannel = Mockery::mock();
+ $auditChannel->shouldReceive('warning')->once()->with('test.failed', Mockery::any());
+
+ Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+
+ auditLog('test.failed', [], 'warning');
+ });
+
+ test('auditLogWebhookFailure logs warning with provider tag', function () {
+ $auditChannel = Mockery::mock();
+ $auditChannel->shouldReceive('warning')
+ ->once()
+ ->with('webhook.github.signature_failed', Mockery::on(function ($context) {
+ return $context['reason'] === 'invalid_signature'
+ && $context['event'] === 'webhook.github.signature_failed'
+ && array_key_exists('ip', $context);
+ }));
+
+ Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+
+ auditLogWebhookFailure('github', 'invalid_signature', ['extra' => 'context']);
+ });
+
+ test('auditLog never includes raw secret keys in context', function () {
+ $captured = null;
+ $auditChannel = Mockery::mock();
+ $auditChannel->shouldReceive('info')
+ ->once()
+ ->with(Mockery::any(), Mockery::on(function ($context) use (&$captured) {
+ $captured = $context;
+
+ return true;
+ }));
+
+ Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+
+ auditLog('test.private_key.created', [
+ 'team_id' => '1',
+ 'private_key_uuid' => 'abc',
+ 'fingerprint' => 'SHA256:xyz',
+ ]);
+
+ expect($captured)->toBeArray();
+ // Helper itself never injects secret-bearing keys.
+ $disallowed = ['private_key', 'password', 'token', 'webhook_secret', 'signature', 'client_secret'];
+ foreach (array_keys($captured) as $key) {
+ expect(in_array(strtolower($key), $disallowed, true))->toBeFalse();
+ }
+ });
+});
+
+describe('webhook signature failure logging', function () {
+ test('GitHub manual webhook with bad signature logs to audit channel', function () {
+ $app = makeAuditApplication();
+
+ $auditChannel = Mockery::mock();
+ $auditChannel->shouldReceive('warning')
+ ->atLeast()
+ ->once()
+ ->with('webhook.github.signature_failed', Mockery::any());
+
+ Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+ Log::shouldReceive('warning')->andReturnNull();
+ Log::shouldReceive('info')->andReturnNull();
+ Log::shouldReceive('error')->andReturnNull();
+
+ $payload = json_encode([
+ 'ref' => 'refs/heads/main',
+ 'repository' => ['full_name' => 'test-org/test-repo'],
+ 'after' => 'abc123',
+ 'commits' => [],
+ ]);
+
+ $response = $this->call('POST', '/webhooks/source/github/events/manual', [], [], [], [
+ 'HTTP_X-GitHub-Event' => 'push',
+ 'HTTP_X-Hub-Signature-256' => 'sha256=forgedhashvalue',
+ 'CONTENT_TYPE' => 'application/json',
+ ], $payload);
+
+ $response->assertOk();
+ expect($response->getContent())->toContain('Invalid signature');
+ });
+
+ test('GitLab manual webhook with bad token logs to audit channel', function () {
+ $app = makeAuditApplication();
+
+ $auditChannel = Mockery::mock();
+ $auditChannel->shouldReceive('warning')
+ ->atLeast()
+ ->once()
+ ->with('webhook.gitlab.signature_failed', Mockery::any());
+
+ Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+ Log::shouldReceive('warning')->andReturnNull();
+ Log::shouldReceive('info')->andReturnNull();
+ Log::shouldReceive('error')->andReturnNull();
+
+ $response = $this->postJson('/webhooks/source/gitlab/events/manual', [
+ 'object_kind' => 'push',
+ 'ref' => 'refs/heads/main',
+ 'project' => ['path_with_namespace' => 'test-org/test-repo'],
+ 'after' => 'abc123',
+ 'commits' => [],
+ ], [
+ 'X-Gitlab-Token' => 'wrong-token',
+ ]);
+
+ $response->assertOk();
+ expect($response->getContent())->toContain('Invalid signature');
+ });
+
+ test('Bitbucket manual webhook with malformed signature logs to audit channel', function () {
+ $app = makeAuditApplication();
+
+ $auditChannel = Mockery::mock();
+ $auditChannel->shouldReceive('warning')
+ ->atLeast()
+ ->once()
+ ->with('webhook.bitbucket.signature_failed', Mockery::any());
+
+ Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+ Log::shouldReceive('warning')->andReturnNull();
+ Log::shouldReceive('info')->andReturnNull();
+ Log::shouldReceive('error')->andReturnNull();
+
+ $payload = json_encode([
+ 'push' => ['changes' => [['new' => ['name' => 'main', 'target' => ['hash' => 'abc123']]]]],
+ 'repository' => ['full_name' => 'test-org/test-repo'],
+ ]);
+
+ $response = $this->call('POST', '/webhooks/source/bitbucket/events/manual', [], [], [], [
+ 'HTTP_X-Event-Key' => 'repo:push',
+ 'HTTP_X-Hub-Signature' => 'sha1=anyvalue',
+ 'CONTENT_TYPE' => 'application/json',
+ ], $payload);
+
+ $response->assertOk();
+ expect($response->getContent())->toContain('Invalid signature');
+ });
+
+ test('Gitea manual webhook with bad signature logs to audit channel', function () {
+ $app = makeAuditApplication();
+
+ $auditChannel = Mockery::mock();
+ $auditChannel->shouldReceive('warning')
+ ->atLeast()
+ ->once()
+ ->with('webhook.gitea.signature_failed', Mockery::any());
+
+ Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+ Log::shouldReceive('warning')->andReturnNull();
+ Log::shouldReceive('info')->andReturnNull();
+ Log::shouldReceive('error')->andReturnNull();
+
+ $payload = json_encode([
+ 'ref' => 'refs/heads/main',
+ 'repository' => ['full_name' => 'test-org/test-repo'],
+ 'after' => 'abc123',
+ 'commits' => [],
+ ]);
+
+ $response = $this->call('POST', '/webhooks/source/gitea/events/manual', [], [], [], [
+ 'HTTP_X-Gitea-Event' => 'push',
+ 'HTTP_X-Hub-Signature-256' => 'sha256=forgedhashvalue',
+ 'CONTENT_TYPE' => 'application/json',
+ ], $payload);
+
+ $response->assertOk();
+ expect($response->getContent())->toContain('Invalid signature');
+ });
+});
+
+describe('API mutation audit logging', function () {
+ test('private key creation emits api.private_key.created audit event', function () {
+ [$team, $user] = makeAuditTeamUser();
+ $token = makeAuditApiToken($user, $team);
+
+ $auditChannel = Mockery::mock();
+ $auditChannel->shouldReceive('info')
+ ->atLeast()
+ ->once()
+ ->with('api.private_key.created', Mockery::on(function ($context) {
+ return $context['event'] === 'api.private_key.created'
+ && ! array_key_exists('private_key', $context);
+ }));
+
+ Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+ Log::shouldReceive('warning')->andReturnNull();
+ Log::shouldReceive('info')->andReturnNull();
+ Log::shouldReceive('error')->andReturnNull();
+
+ // Generate a valid OpenSSH-format private key for the test.
+ $opensshKey = "-----BEGIN OPENSSH PRIVATE KEY-----\n".
+ base64_encode(str_repeat('a', 256)).
+ "\n-----END OPENSSH PRIVATE KEY-----";
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$token,
+ 'Content-Type' => 'application/json',
+ ])->postJson('/api/v1/security/keys', [
+ 'name' => 'test-key',
+ 'description' => 'audit test',
+ 'private_key' => $opensshKey,
+ ]);
+
+ // Either 201 or 422 acceptable depending on validation; the assertion above verifies log if 201.
+ expect($response->status())->toBeIn([201, 422]);
+ });
+
+ test('enable_api denial for non-root team emits warning audit event', function () {
+ [$team, $user] = makeAuditTeamUser();
+ $token = makeAuditApiToken($user, $team);
+
+ $auditChannel = Mockery::mock();
+ $auditChannel->shouldReceive('warning')
+ ->atLeast()
+ ->once()
+ ->with('api.instance.enable_denied', Mockery::any());
+
+ Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+ Log::shouldReceive('warning')->andReturnNull();
+ Log::shouldReceive('info')->andReturnNull();
+ Log::shouldReceive('error')->andReturnNull();
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$token,
+ ])->getJson('/api/v1/enable');
+
+ $response->assertStatus(403);
+ });
+
+ test('project creation emits api.project.created audit event', function () {
+ [$team, $user] = makeAuditTeamUser();
+ $token = makeAuditApiToken($user, $team);
+
+ $auditChannel = Mockery::mock();
+ $auditChannel->shouldReceive('info')
+ ->atLeast()
+ ->once()
+ ->with('api.project.created', Mockery::on(function ($context) {
+ return $context['event'] === 'api.project.created'
+ && ! empty($context['project_uuid'])
+ && $context['project_name'] === 'audit-project';
+ }));
+
+ Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+ Log::shouldReceive('warning')->andReturnNull();
+ Log::shouldReceive('info')->andReturnNull();
+ Log::shouldReceive('error')->andReturnNull();
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$token,
+ 'Content-Type' => 'application/json',
+ ])->postJson('/api/v1/projects', [
+ 'name' => 'audit-project',
+ 'description' => 'audit',
+ ]);
+
+ $response->assertStatus(201);
+ });
+});
+
+describe('threat-detection audit logging (Phase 2)', function () {
+ test('missing bearer token logs api.auth.unauthenticated', function () {
+ $auditChannel = Mockery::mock();
+ $auditChannel->shouldReceive('warning')
+ ->atLeast()
+ ->once()
+ ->with('api.auth.unauthenticated', Mockery::any());
+
+ Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+ Log::shouldReceive('warning')->andReturnNull();
+ Log::shouldReceive('info')->andReturnNull();
+ Log::shouldReceive('error')->andReturnNull();
+
+ $response = $this->getJson('/api/v1/projects');
+
+ $response->assertStatus(401);
+ });
+
+ test('expired bearer token logs api.auth.unauthenticated', function () {
+ [$team, $user] = makeAuditTeamUser();
+ $token = $user->createToken('expired-audit', ['read'], now()->subDay());
+ DB::table('personal_access_tokens')->where('id', $token->accessToken->id)->update([
+ 'team_id' => $team->id,
+ ]);
+
+ $auditChannel = Mockery::mock();
+ $auditChannel->shouldReceive('warning')
+ ->atLeast()
+ ->once()
+ ->with('api.auth.unauthenticated', Mockery::any());
+
+ Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+ Log::shouldReceive('warning')->andReturnNull();
+ Log::shouldReceive('info')->andReturnNull();
+ Log::shouldReceive('error')->andReturnNull();
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$token->plainTextToken,
+ ])->getJson('/api/v1/projects');
+
+ $response->assertStatus(401);
+ });
+
+ test('read-only token hitting write endpoint logs api.auth.ability_denied', function () {
+ [$team, $user] = makeAuditTeamUser();
+ $readToken = makeAuditApiToken($user, $team, ['read']);
+
+ $auditChannel = Mockery::mock();
+ $auditChannel->shouldReceive('warning')
+ ->atLeast()
+ ->once()
+ ->with('api.auth.ability_denied', Mockery::on(function ($ctx) {
+ return in_array('write', $ctx['required_abilities'] ?? [], true);
+ }));
+
+ Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+ Log::shouldReceive('warning')->andReturnNull();
+ Log::shouldReceive('info')->andReturnNull();
+ Log::shouldReceive('error')->andReturnNull();
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$readToken,
+ 'Content-Type' => 'application/json',
+ ])->postJson('/api/v1/projects', [
+ 'name' => 'should-fail',
+ ]);
+
+ $response->assertStatus(403);
+ });
+
+ test('sentinel push without Authorization logs token_missing', function () {
+ $auditChannel = Mockery::mock();
+ $auditChannel->shouldReceive('warning')
+ ->atLeast()
+ ->once()
+ ->with('webhook.sentinel.signature_failed', Mockery::on(function ($ctx) {
+ return $ctx['reason'] === 'token_missing';
+ }));
+
+ Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+ Log::shouldReceive('warning')->andReturnNull();
+ Log::shouldReceive('info')->andReturnNull();
+ Log::shouldReceive('error')->andReturnNull();
+
+ $response = $this->postJson('/api/v1/sentinel/push', []);
+
+ $response->assertStatus(401);
+ });
+
+ test('sentinel push with un-decryptable bearer logs decrypt_failed', function () {
+ $auditChannel = Mockery::mock();
+ $auditChannel->shouldReceive('warning')
+ ->atLeast()
+ ->once()
+ ->with('webhook.sentinel.signature_failed', Mockery::on(function ($ctx) {
+ return $ctx['reason'] === 'decrypt_failed';
+ }));
+
+ Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+ Log::shouldReceive('warning')->andReturnNull();
+ Log::shouldReceive('info')->andReturnNull();
+ Log::shouldReceive('error')->andReturnNull();
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer not-a-valid-encrypted-payload',
+ ])->postJson('/api/v1/sentinel/push', []);
+
+ $response->assertStatus(401);
+ });
+});
diff --git a/tests/Feature/SentinelTokenValidationTest.php b/tests/Feature/SentinelTokenValidationTest.php
index 43048fcaa..14f24d03a 100644
--- a/tests/Feature/SentinelTokenValidationTest.php
+++ b/tests/Feature/SentinelTokenValidationTest.php
@@ -4,6 +4,7 @@
use App\Models\ServerSetting;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
uses(RefreshDatabase::class);
@@ -78,11 +79,73 @@
expect(ServerSetting::isValidSentinelToken(''))->toBeFalse();
});
+ it('returns false for null sentinel token', function () {
+ expect(ServerSetting::isValidSentinelToken(null))->toBeFalse();
+ });
+
it('rejects the reported PoC payload', function () {
expect(ServerSetting::isValidSentinelToken('abc" ; id >/tmp/coolify_poc_sentinel ; echo "'))->toBeFalse();
});
});
+describe('ServerSetting::ensureValidSentinelToken', function () {
+ it('regenerates empty sentinel token via ensureValidSentinelToken', function () {
+ $settings = $this->server->settings;
+ DB::table('server_settings')->where('id', $settings->id)->update(['sentinel_token' => '']);
+
+ $settings->refresh();
+ $token = $settings->ensureValidSentinelToken();
+
+ expect($token)->not->toBeEmpty();
+ expect(ServerSetting::isValidSentinelToken($token))->toBeTrue();
+ expect($settings->fresh()->sentinel_token)->toBe($token);
+ });
+
+ it('regenerates token when stored value cannot be decrypted', function () {
+ $settings = $this->server->settings;
+ DB::table('server_settings')->where('id', $settings->id)->update(['sentinel_token' => 'not-encrypted-junk']);
+
+ $settings->refresh();
+ $token = $settings->ensureValidSentinelToken();
+
+ expect(ServerSetting::isValidSentinelToken($token))->toBeTrue();
+ expect($settings->fresh()->sentinel_token)->toBe($token);
+ });
+
+ it('returns existing valid token without regenerating', function () {
+ $settings = $this->server->settings;
+ $original = $settings->sentinel_token;
+
+ $token = $settings->ensureValidSentinelToken();
+
+ expect($token)->toBe($original);
+ });
+
+ it('throws RuntimeException only when regeneration also fails', function () {
+ $settings = $this->server->settings;
+ DB::table('server_settings')->where('id', $settings->id)->update(['sentinel_token' => '']);
+
+ $stub = new class extends ServerSetting
+ {
+ protected $table = 'server_settings';
+
+ public function generateSentinelToken(bool $save = true, bool $ignoreEvent = false): string
+ {
+ DB::table('server_settings')->where('id', $this->id)->update([
+ 'sentinel_token' => encrypt('invalid token with spaces!'),
+ ]);
+
+ return '';
+ }
+ };
+ $stub->setRawAttributes($settings->fresh()->getAttributes(), true);
+ $stub->exists = true;
+
+ expect(fn () => $stub->ensureValidSentinelToken())
+ ->toThrow(RuntimeException::class, 'Sentinel token invalid after regeneration');
+ });
+});
+
describe('generated sentinel tokens are valid', function () {
it('generates tokens that pass format validation', function () {
$settings = $this->server->settings;
@@ -92,4 +155,11 @@
expect($token)->not->toBeEmpty();
expect(ServerSetting::isValidSentinelToken($token))->toBeTrue();
});
+
+ it('returns the same value the cast reads back', function () {
+ $settings = $this->server->settings;
+ $returned = $settings->generateSentinelToken(save: true, ignoreEvent: true);
+
+ expect($settings->fresh()->sentinel_token)->toBe($returned);
+ });
});
diff --git a/tests/Feature/ServerConnectionTimeoutApiTest.php b/tests/Feature/ServerConnectionTimeoutApiTest.php
new file mode 100644
index 000000000..287122523
--- /dev/null
+++ b/tests/Feature/ServerConnectionTimeoutApiTest.php
@@ -0,0 +1,74 @@
+ 0, 'is_api_enabled' => true]);
+
+ $this->team = Team::factory()->create();
+ $this->user = User::factory()->create();
+ $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+ session(['currentTeam' => $this->team]);
+
+ $this->server = Server::factory()->create([
+ 'team_id' => $this->team->id,
+ ]);
+
+ $newToken = $this->user->createToken('write-token', ['write']);
+ $newToken->accessToken->forceFill(['team_id' => $this->team->id])->save();
+ $this->token = $newToken->plainTextToken;
+});
+
+it('PATCH updates connection_timeout via API', function () {
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$this->token,
+ 'Content-Type' => 'application/json',
+ ])->patchJson('/api/v1/servers/'.$this->server->uuid, [
+ 'connection_timeout' => 45,
+ ]);
+
+ $response->assertStatus(201);
+ expect($this->server->settings->fresh()->connection_timeout)->toBe(45);
+});
+
+it('PATCH rejects connection_timeout out of range', function () {
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$this->token,
+ 'Content-Type' => 'application/json',
+ ])->patchJson('/api/v1/servers/'.$this->server->uuid, [
+ 'connection_timeout' => 0,
+ ]);
+
+ $response->assertStatus(422);
+ $response->assertJsonStructure(['errors' => ['connection_timeout']]);
+});
+
+it('PATCH rejects connection_timeout above max', function () {
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$this->token,
+ 'Content-Type' => 'application/json',
+ ])->patchJson('/api/v1/servers/'.$this->server->uuid, [
+ 'connection_timeout' => 999,
+ ]);
+
+ $response->assertStatus(422);
+ $response->assertJsonStructure(['errors' => ['connection_timeout']]);
+});
+
+it('PATCH rejects non-integer connection_timeout', function () {
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$this->token,
+ 'Content-Type' => 'application/json',
+ ])->patchJson('/api/v1/servers/'.$this->server->uuid, [
+ 'connection_timeout' => 'fast',
+ ]);
+
+ $response->assertStatus(422);
+ $response->assertJsonStructure(['errors' => ['connection_timeout']]);
+});
diff --git a/tests/Feature/ServerConnectionTimeoutTest.php b/tests/Feature/ServerConnectionTimeoutTest.php
new file mode 100644
index 000000000..b457f3f01
--- /dev/null
+++ b/tests/Feature/ServerConnectionTimeoutTest.php
@@ -0,0 +1,43 @@
+create();
+ $this->team = $user->teams()->first();
+ $this->server = Server::factory()->create([
+ 'team_id' => $this->team->id,
+ ]);
+});
+
+it('defaults connection_timeout to 10 seconds for new servers', function () {
+ expect($this->server->settings->connection_timeout)->toBe(10);
+});
+
+it('persists a custom connection_timeout value', function () {
+ $this->server->settings->connection_timeout = 30;
+ $this->server->settings->save();
+
+ expect($this->server->settings->fresh()->connection_timeout)->toBe(30);
+});
+
+it('returns the per-server connection_timeout from getConnectionTimeout', function () {
+ $this->server->settings->connection_timeout = 45;
+ $this->server->settings->save();
+
+ expect(SshMultiplexingHelper::getConnectionTimeout($this->server->fresh()))->toBe(45);
+});
+
+it('falls back to config default when connection_timeout is invalid', function () {
+ $this->server->settings->connection_timeout = 0;
+ $this->server->settings->saveQuietly();
+
+ $expected = (int) config('constants.ssh.connection_timeout');
+
+ expect(SshMultiplexingHelper::getConnectionTimeout($this->server->fresh()))->toBe($expected);
+});
diff --git a/tests/Feature/ServerReachabilityNotificationTest.php b/tests/Feature/ServerReachabilityNotificationTest.php
new file mode 100644
index 000000000..e996ba028
--- /dev/null
+++ b/tests/Feature/ServerReachabilityNotificationTest.php
@@ -0,0 +1,105 @@
+team = Team::factory()->create();
+ $this->team->emailNotificationSettings()->update([
+ 'use_instance_email_settings' => true,
+ 'server_unreachable_email_notifications' => true,
+ 'server_reachable_email_notifications' => true,
+ ]);
+
+ $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+
+ Notification::fake();
+});
+
+it('sends Unreachable notification when threshold reached and not yet notified', function () {
+ $this->server->settings()->update(['is_reachable' => false]);
+ $this->server->forceFill([
+ 'unreachable_count' => 2,
+ 'unreachable_notification_sent' => false,
+ ])->save();
+
+ ServerReachabilityChanged::dispatch($this->server->fresh());
+
+ Notification::assertSentTo($this->team, Unreachable::class);
+ expect($this->server->fresh()->unreachable_notification_sent)->toBeTrue();
+});
+
+it('does not send Unreachable on first transient failure (count=1)', function () {
+ $this->server->settings()->update(['is_reachable' => false]);
+ $this->server->forceFill([
+ 'unreachable_count' => 1,
+ 'unreachable_notification_sent' => false,
+ ])->save();
+
+ ServerReachabilityChanged::dispatch($this->server->fresh());
+
+ Notification::assertNothingSent();
+});
+
+it('does not send Unreachable when already notified', function () {
+ $this->server->settings()->update(['is_reachable' => false]);
+ $this->server->forceFill([
+ 'unreachable_count' => 5,
+ 'unreachable_notification_sent' => true,
+ ])->save();
+
+ ServerReachabilityChanged::dispatch($this->server->fresh());
+
+ Notification::assertNothingSent();
+});
+
+it('sends Reachable notification on recovery when previously notified', function () {
+ $this->server->settings()->update(['is_reachable' => true]);
+ $this->server->forceFill([
+ 'unreachable_count' => 0,
+ 'unreachable_notification_sent' => true,
+ ])->save();
+
+ $fresh = $this->server->fresh();
+ expect($fresh->unreachable_notification_sent)->toBeTrue();
+ expect((bool) $fresh->settings->is_reachable)->toBeTrue();
+
+ ServerReachabilityChanged::dispatch($fresh);
+
+ Notification::assertSentTo($this->team, Reachable::class);
+ expect($this->server->fresh()->unreachable_notification_sent)->toBeFalse();
+});
+
+it('does not send Reachable when never notified', function () {
+ $this->server->settings()->update(['is_reachable' => true]);
+ $this->server->forceFill([
+ 'unreachable_count' => 0,
+ 'unreachable_notification_sent' => false,
+ ])->save();
+
+ ServerReachabilityChanged::dispatch($this->server->fresh());
+
+ Notification::assertNothingSent();
+});
+
+it('routes Unreachable notification through EmailChannel when email toggle is on', function () {
+ $this->server->settings()->update(['is_reachable' => false]);
+ $this->server->forceFill([
+ 'unreachable_count' => 2,
+ 'unreachable_notification_sent' => false,
+ ])->save();
+
+ ServerReachabilityChanged::dispatch($this->server->fresh());
+
+ Notification::assertSentTo($this->team, Unreachable::class, function ($notification, $channels) {
+ return in_array(EmailChannel::class, $channels);
+ });
+});
diff --git a/tests/Feature/StandaloneDockerDatabasesTest.php b/tests/Feature/StandaloneDockerDatabasesTest.php
new file mode 100644
index 000000000..8d7889149
--- /dev/null
+++ b/tests/Feature/StandaloneDockerDatabasesTest.php
@@ -0,0 +1,71 @@
+team = Team::factory()->create();
+ $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+ $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+ $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+ $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+});
+
+function attachDb(string $modelClass, array $extra, $destination, $environment)
+{
+ return $modelClass::create(array_merge([
+ 'name' => 'test-'.strtolower(class_basename($modelClass)),
+ 'environment_id' => $environment->id,
+ 'destination_id' => $destination->id,
+ 'destination_type' => $destination->getMorphClass(),
+ ], $extra));
+}
+
+test('StandaloneDocker::databases() includes attached keydb', function () {
+ attachDb(StandaloneKeydb::class, ['keydb_password' => 'pw'], $this->destination, $this->environment);
+
+ expect($this->destination->databases()->count())->toBe(1);
+ expect($this->destination->attachedTo())->toBeTrue();
+});
+
+test('StandaloneDocker::databases() includes attached dragonfly', function () {
+ attachDb(StandaloneDragonfly::class, ['dragonfly_password' => 'pw'], $this->destination, $this->environment);
+
+ expect($this->destination->databases()->count())->toBe(1);
+ expect($this->destination->attachedTo())->toBeTrue();
+});
+
+test('StandaloneDocker::databases() includes attached clickhouse', function () {
+ attachDb(StandaloneClickhouse::class, ['clickhouse_admin_password' => 'pw'], $this->destination, $this->environment);
+
+ expect($this->destination->databases()->count())->toBe(1);
+ expect($this->destination->attachedTo())->toBeTrue();
+});
+
+test('StandaloneDocker::databases() includes all 8 standalone database types', function () {
+ attachDb(StandalonePostgresql::class, ['postgres_password' => 'pw'], $this->destination, $this->environment);
+ attachDb(StandaloneRedis::class, ['redis_password' => 'pw'], $this->destination, $this->environment);
+ attachDb(StandaloneMongodb::class, ['mongo_initdb_root_password' => 'pw'], $this->destination, $this->environment);
+ attachDb(StandaloneMysql::class, ['mysql_root_password' => 'pw', 'mysql_password' => 'pw'], $this->destination, $this->environment);
+ attachDb(StandaloneMariadb::class, ['mariadb_root_password' => 'pw', 'mariadb_password' => 'pw'], $this->destination, $this->environment);
+ attachDb(StandaloneKeydb::class, ['keydb_password' => 'pw'], $this->destination, $this->environment);
+ attachDb(StandaloneDragonfly::class, ['dragonfly_password' => 'pw'], $this->destination, $this->environment);
+ attachDb(StandaloneClickhouse::class, ['clickhouse_admin_password' => 'pw'], $this->destination, $this->environment);
+
+ expect($this->destination->databases()->count())->toBe(8);
+ expect($this->destination->attachedTo())->toBeTrue();
+});
diff --git a/tests/Feature/Subscription/StripeProcessJobTest.php b/tests/Feature/Subscription/StripeProcessJobTest.php
index 0a93f858c..a95e08338 100644
--- a/tests/Feature/Subscription/StripeProcessJobTest.php
+++ b/tests/Feature/Subscription/StripeProcessJobTest.php
@@ -2,10 +2,14 @@
use App\Jobs\ServerLimitCheckJob;
use App\Jobs\StripeProcessJob;
+use App\Jobs\SubscriptionInvoiceFailedJob;
+use App\Jobs\VerifyStripeSubscriptionStatusJob;
use App\Models\Subscription;
use App\Models\Team;
use App\Models\User;
+use App\Notifications\Internal\GeneralNotification;
use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Notification;
use Illuminate\Support\Facades\Queue;
uses(RefreshDatabase::class);
@@ -228,3 +232,65 @@
Queue::assertNotPushed(ServerLimitCheckJob::class);
});
});
+
+describe('missing subscription Stripe webhooks are ignored', function () {
+ test('does not send internal notifications or queue follow-up jobs', function (array $event) {
+ Queue::fake();
+
+ $rootTeam = Team::factory()->create(['id' => 0]);
+ $rootTeam->discordNotificationSettings()->update(['discord_enabled' => true]);
+
+ Notification::fake();
+
+ $job = new StripeProcessJob($event);
+ $job->handle();
+
+ Notification::assertNothingSent();
+ Notification::assertNotSentTo($rootTeam, GeneralNotification::class);
+ Queue::assertNotPushed(SubscriptionInvoiceFailedJob::class);
+ Queue::assertNotPushed(VerifyStripeSubscriptionStatusJob::class);
+ })->with([
+ 'invoice paid' => [[
+ 'type' => 'invoice.paid',
+ 'data' => [
+ 'object' => [
+ 'customer' => 'cus_missing_invoice_paid',
+ 'amount_paid' => 1000,
+ 'subscription' => 'sub_missing_invoice_paid',
+ 'lines' => [
+ 'data' => [[
+ 'plan' => ['id' => 'price_dynamic_monthly'],
+ ]],
+ ],
+ ],
+ ],
+ ]],
+ 'invoice payment failed' => [[
+ 'type' => 'invoice.payment_failed',
+ 'data' => [
+ 'object' => [
+ 'customer' => 'cus_missing_invoice_payment_failed',
+ 'id' => 'in_missing_invoice_payment_failed',
+ 'payment_intent' => null,
+ ],
+ ],
+ ]],
+ 'payment intent payment failed' => [[
+ 'type' => 'payment_intent.payment_failed',
+ 'data' => [
+ 'object' => [
+ 'customer' => 'cus_missing_payment_intent_failed',
+ ],
+ ],
+ ]],
+ 'customer subscription deleted' => [[
+ 'type' => 'customer.subscription.deleted',
+ 'data' => [
+ 'object' => [
+ 'customer' => 'cus_missing_subscription_deleted',
+ 'id' => 'sub_missing_subscription_deleted',
+ ],
+ ],
+ ]],
+ ]);
+});
diff --git a/tests/Feature/SuppressHorizonJobFailuresTest.php b/tests/Feature/SuppressHorizonJobFailuresTest.php
new file mode 100644
index 000000000..ead342c31
--- /dev/null
+++ b/tests/Feature/SuppressHorizonJobFailuresTest.php
@@ -0,0 +1,65 @@
+shouldIgnoreMissing();
+ $job->shouldReceive('uuid')->andReturn($uuid);
+ $job->shouldReceive('getJobId')->andReturn($uuid);
+
+ return $job;
+}
+
+function fireJobFailed(Job $job, Throwable $exception): void
+{
+ event(new JobFailed('redis', $job, $exception));
+}
+
+beforeEach(function () {
+ config(['constants.coolify.self_hosted' => false]);
+});
+
+test('scrubs Horizon failed entry for DeploymentException on cloud', function () {
+ $uuid = 'uuid-deployment-1';
+
+ $this->mock(JobRepository::class, function (MockInterface $mock) use ($uuid) {
+ $mock->shouldReceive('deleteFailed')->once()->with($uuid);
+ });
+
+ fireJobFailed(fakeJob($uuid), new DeploymentException('build failed'));
+});
+
+test('scrubs Horizon failed entry for TimeoutExceededException on cloud', function () {
+ $uuid = 'uuid-timeout-1';
+
+ $this->mock(JobRepository::class, function (MockInterface $mock) use ($uuid) {
+ $mock->shouldReceive('deleteFailed')->once()->with($uuid);
+ });
+
+ fireJobFailed(fakeJob($uuid), new TimeoutExceededException('worker timeout'));
+});
+
+test('does not scrub generic exceptions on cloud', function () {
+ $this->mock(JobRepository::class, function (MockInterface $mock) {
+ $mock->shouldNotReceive('deleteFailed');
+ });
+
+ fireJobFailed(fakeJob('uuid-generic-1'), new RuntimeException('boom'));
+});
+
+test('does not scrub when self-hosted even for filtered exceptions', function () {
+ config(['constants.coolify.self_hosted' => true]);
+
+ $this->mock(JobRepository::class, function (MockInterface $mock) {
+ $mock->shouldNotReceive('deleteFailed');
+ });
+
+ fireJobFailed(fakeJob('uuid-deployment-2'), new DeploymentException('build failed'));
+ fireJobFailed(fakeJob('uuid-timeout-2'), new TimeoutExceededException('worker timeout'));
+});
diff --git a/tests/Unit/ApplicationDeploymentRailpackConfigTest.php b/tests/Unit/ApplicationDeploymentRailpackConfigTest.php
new file mode 100644
index 000000000..e1449a59e
--- /dev/null
+++ b/tests/Unit/ApplicationDeploymentRailpackConfigTest.php
@@ -0,0 +1,249 @@
+recordedCommands[] = $commands;
+ }
+}
+
+function makeRailpackDeploymentJob(array $applicationAttributes = [], array $savedOutputs = []): array
+{
+ $job = new TestableRailpackDeploymentJob;
+ $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+
+ $application = new Application($applicationAttributes);
+
+ foreach ([
+ 'application' => $application,
+ 'workdir' => '/artifacts/test-app',
+ 'deployment_uuid' => 'deployment-uuid',
+ 'saved_outputs' => new Collection($savedOutputs),
+ 'env_railpack_args' => "--env 'RAILPACK_NODE_VERSION=22'",
+ 'force_rebuild' => false,
+ 'addHosts' => '',
+ 'secrets_hash_key' => 'testing-app-key',
+ ] as $property => $value) {
+ $reflectionProperty = $reflection->getProperty($property);
+ $reflectionProperty->setAccessible(true);
+ $reflectionProperty->setValue($job, $value);
+ }
+
+ return [$job, $reflection];
+}
+
+function invokeRailpackMethod(object $job, ReflectionClass $reflection, string $method, array $arguments = []): mixed
+{
+ $reflectionMethod = $reflection->getMethod($method);
+ $reflectionMethod->setAccessible(true);
+
+ return $reflectionMethod->invokeArgs($job, $arguments);
+}
+
+it('deep merges repository railpack config with coolify overrides', function () {
+ $repositoryConfigJson = json_encode([
+ '$schema' => 'https://schema.railpack.com',
+ 'packages' => [
+ 'node' => '20',
+ ],
+ 'steps' => [
+ 'build' => [
+ 'inputs' => [['step' => 'install']],
+ 'commands' => ['npm run build'],
+ ],
+ ],
+ 'deploy' => [
+ 'variables' => [
+ 'NODE_ENV' => 'production',
+ ],
+ 'startCommand' => 'node index.js',
+ ],
+ ], JSON_THROW_ON_ERROR);
+
+ [$job, $reflection] = makeRailpackDeploymentJob(
+ [
+ 'install_command' => 'npm ci',
+ 'build_command' => 'npm run build:prod',
+ 'start_command' => 'node server.js',
+ ],
+ [
+ 'railpack_config_exists' => 'exists',
+ 'railpack_repository_config' => $repositoryConfigJson,
+ ],
+ );
+
+ $repositoryConfig = invokeRailpackMethod(
+ $job,
+ $reflection,
+ 'decode_railpack_config',
+ [$repositoryConfigJson, 'repository railpack.json'],
+ );
+ $overrides = [
+ 'deploy' => [
+ 'variables' => [
+ 'APP_ENV' => 'production',
+ ],
+ ],
+ 'packages' => [
+ 'python' => '3.13',
+ ],
+ ];
+ $generatedConfig = invokeRailpackMethod($job, $reflection, 'merge_railpack_config', [$repositoryConfig, $overrides]);
+
+ expect($generatedConfig)->toMatchArray([
+ '$schema' => 'https://schema.railpack.com',
+ 'packages' => [
+ 'node' => '20',
+ 'python' => '3.13',
+ ],
+ 'steps' => [
+ 'build' => [
+ 'inputs' => [['step' => 'install']],
+ 'commands' => ['npm run build'],
+ ],
+ ],
+ 'deploy' => [
+ 'variables' => [
+ 'NODE_ENV' => 'production',
+ 'APP_ENV' => 'production',
+ ],
+ 'startCommand' => 'node index.js',
+ ],
+ ]);
+});
+
+it('writes a generated railpack config file when repository config exists', function () {
+ [$job, $reflection] = makeRailpackDeploymentJob(
+ ['build_command' => 'npm run build'],
+ [
+ 'railpack_config_exists' => 'exists',
+ 'railpack_repository_config' => json_encode([
+ '$schema' => 'https://schema.railpack.com',
+ 'steps' => [
+ 'build' => [
+ 'commands' => ['npm run build'],
+ ],
+ ],
+ ], JSON_THROW_ON_ERROR),
+ ],
+ );
+
+ $configPath = invokeRailpackMethod($job, $reflection, 'generate_railpack_config_file');
+
+ expect($configPath)->toBe('.coolify/railpack.generated.json');
+ expect($job->recordedCommands)->toHaveCount(3);
+});
+
+it('does not generate a railpack config file for command overrides alone', function () {
+ [$job, $reflection] = makeRailpackDeploymentJob([
+ 'install_command' => 'npm ci',
+ 'build_command' => 'npm run build',
+ 'start_command' => 'node server.js',
+ ]);
+
+ $configPath = invokeRailpackMethod($job, $reflection, 'generate_railpack_config_file');
+
+ expect($configPath)->toBeNull();
+ expect($job->recordedCommands)->toHaveCount(1);
+});
+
+it('fails fast when repository railpack config is invalid json', function () {
+ [$job, $reflection] = makeRailpackDeploymentJob(
+ ['build_command' => 'npm run build'],
+ [
+ 'railpack_config_exists' => 'exists',
+ 'railpack_repository_config' => '{"steps":{"build":',
+ ],
+ );
+
+ expect(fn () => invokeRailpackMethod($job, $reflection, 'generate_railpack_config_file'))
+ ->toThrow(DeploymentException::class, 'Invalid repository railpack.json');
+});
+
+it('builds railpack prepare command using railpack env for install and cli flags for build/start overrides', function () {
+ [$job, $reflection] = makeRailpackDeploymentJob(
+ [
+ 'install_command' => 'npm ci',
+ 'build_command' => 'npm run build',
+ 'start_command' => 'node server.js',
+ ],
+ );
+ $envRailpackArgsProperty = $reflection->getProperty('env_railpack_args');
+ $envRailpackArgsProperty->setAccessible(true);
+ $envRailpackArgsProperty->setValue($job, "--env 'RAILPACK_NODE_VERSION=22' --env 'RAILPACK_INSTALL_CMD=npm ci'");
+
+ $command = invokeRailpackMethod(
+ $job,
+ $reflection,
+ 'railpack_prepare_command',
+ ['.coolify/railpack.generated.json'],
+ );
+
+ expect($command)->toContain('railpack prepare');
+ expect($command)->toContain("--env 'RAILPACK_NODE_VERSION=22'");
+ expect($command)->toContain("--env 'RAILPACK_INSTALL_CMD=npm ci'");
+ expect($command)->toContain('--build-cmd '.escapeshellarg('npm run build'));
+ expect($command)->toContain('--start-cmd '.escapeshellarg('node server.js'));
+ expect($command)->toContain('--config-file '.escapeshellarg('.coolify/railpack.generated.json'));
+ expect($command)->toContain('--plan-out /artifacts/railpack-plan.json /artifacts/test-app');
+ expect($command)->not->toContain("--env 'RAILPACK_BUILD_CMD=");
+ expect($command)->not->toContain("--env 'RAILPACK_START_CMD=");
+ expect($command)->not->toContain('RAILPACK_BUILD_CMD=');
+ expect($command)->not->toContain('RAILPACK_START_CMD=');
+});
+
+it('fails fast when docker buildx is unavailable for railpack builds', function () {
+ [$job, $reflection] = makeRailpackDeploymentJob();
+
+ $dockerBuildxAvailableProperty = $reflection->getProperty('dockerBuildxAvailable');
+ $dockerBuildxAvailableProperty->setAccessible(true);
+ $dockerBuildxAvailableProperty->setValue($job, false);
+
+ expect(fn () => invokeRailpackMethod($job, $reflection, 'ensure_docker_buildx_available_for_railpack'))
+ ->toThrow(DeploymentException::class, 'Railpack deployments require the Docker buildx CLI plugin');
+});
+
+it('builds railpack docker command with matching env and secret flags for all railpack variables', function () {
+ [$job, $reflection] = makeRailpackDeploymentJob([
+ 'uuid' => 'application-uuid',
+ ]);
+
+ $command = invokeRailpackMethod(
+ $job,
+ $reflection,
+ 'railpack_build_command',
+ [
+ 'coollabsio/coolify:test',
+ collect([
+ 'RAILPACK_NODE_VERSION' => '22',
+ 'RAILPACK_INSTALL_CMD' => 'npm ci && npm run postinstall',
+ 'RAILPACK_DEPLOY_APT_PACKAGES' => 'curl wget',
+ 'SECRET_JSON' => '{"token":"abc"}',
+ ]),
+ ],
+ );
+
+ expect($command)->toContain("env 'RAILPACK_NODE_VERSION=22'");
+ expect($command)->toContain("'RAILPACK_INSTALL_CMD=npm ci && npm run postinstall'");
+ expect($command)->toContain("'RAILPACK_DEPLOY_APT_PACKAGES=curl wget'");
+ expect($command)->toContain("'SECRET_JSON={\"token\":\"abc\"}'");
+ expect($command)->toContain("--secret 'id=RAILPACK_NODE_VERSION,env=RAILPACK_NODE_VERSION'");
+ expect($command)->toContain("--secret 'id=RAILPACK_INSTALL_CMD,env=RAILPACK_INSTALL_CMD'");
+ expect($command)->toContain("--secret 'id=RAILPACK_DEPLOY_APT_PACKAGES,env=RAILPACK_DEPLOY_APT_PACKAGES'");
+ expect($command)->toContain("--secret 'id=SECRET_JSON,env=SECRET_JSON'");
+ expect($command)->toContain(' --build-arg secrets-hash=');
+ expect($command)->toContain('--build-arg BUILDKIT_SYNTAX="ghcr.io/railwayapp/railpack-frontend:v'.config('constants.coolify.railpack_version').'"');
+});
diff --git a/tests/Unit/ApplicationDeploymentRailpackEnvParityTest.php b/tests/Unit/ApplicationDeploymentRailpackEnvParityTest.php
new file mode 100644
index 000000000..1dda8b8c3
--- /dev/null
+++ b/tests/Unit/ApplicationDeploymentRailpackEnvParityTest.php
@@ -0,0 +1,267 @@
+shouldReceive('getAttribute')->with('install_command')->andReturn('npm ci && npm run postinstall');
+
+ $nodeVersion = Mockery::mock(EnvironmentVariable::class)->makePartial();
+ $nodeVersion->forceFill([
+ 'key' => 'RAILPACK_NODE_VERSION',
+ 'is_literal' => false,
+ 'is_multiline' => false,
+ ]);
+ $nodeVersion->shouldReceive('getResolvedValueWithServer')->once()->with(Mockery::type(Server::class))->andReturn('22');
+
+ $literalValue = Mockery::mock(EnvironmentVariable::class)->makePartial();
+ $literalValue->forceFill([
+ 'key' => 'RAILPACK_CUSTOM_FLAG',
+ 'is_literal' => true,
+ 'is_multiline' => false,
+ ]);
+ $literalValue->shouldReceive('getResolvedValueWithServer')->once()->with(Mockery::type(Server::class))->andReturn("'hello world'");
+
+ $jsonValue = Mockery::mock(EnvironmentVariable::class)->makePartial();
+ $jsonValue->forceFill([
+ 'key' => 'RAILPACK_JSON',
+ 'is_literal' => false,
+ 'is_multiline' => false,
+ ]);
+ $jsonValue->shouldReceive('getResolvedValueWithServer')->once()->with(Mockery::type(Server::class))->andReturn('{"token":"abc"}');
+
+ $nullValue = Mockery::mock(EnvironmentVariable::class)->makePartial();
+ $nullValue->forceFill([
+ 'key' => 'RAILPACK_NULL',
+ 'is_literal' => false,
+ 'is_multiline' => false,
+ ]);
+ $nullValue->shouldReceive('getResolvedValueWithServer')->once()->with(Mockery::type(Server::class))->andReturn(null);
+
+ $envQuery = Mockery::mock();
+ $envQuery->shouldReceive('withoutBuildpackControlVariables')->once()->andReturnSelf();
+ $envQuery->shouldReceive('where')->with('is_buildtime', true)->once()->andReturnSelf();
+ $envQuery->shouldReceive('get')->once()->andReturn(collect([]));
+ $application->shouldReceive('environment_variables')->once()->andReturn($envQuery);
+
+ $railpackQuery = Mockery::mock();
+ $railpackQuery->shouldReceive('get')->once()->andReturn(collect([$nodeVersion, $literalValue, $jsonValue, $nullValue]));
+ $application->shouldReceive('railpack_environment_variables')->once()->andReturn($railpackQuery);
+
+ $job = Mockery::mock(ApplicationDeploymentJob::class)->makePartial();
+ $job->shouldAllowMockingProtectedMethods();
+ $job->shouldReceive('generate_coolify_env_variables')->andReturn(collect([]));
+
+ $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+ $applicationProperty = $reflection->getProperty('application');
+ $applicationProperty->setAccessible(true);
+ $applicationProperty->setValue($job, $application);
+
+ $pullRequestProperty = $reflection->getProperty('pull_request_id');
+ $pullRequestProperty->setAccessible(true);
+ $pullRequestProperty->setValue($job, 0);
+
+ $mainServerProperty = $reflection->getProperty('mainServer');
+ $mainServerProperty->setAccessible(true);
+ $mainServerProperty->setValue($job, Mockery::mock(Server::class));
+
+ $method = $reflection->getMethod('generate_railpack_env_variables');
+ $method->setAccessible(true);
+ $variables = $method->invoke($job);
+
+ $envArgsProperty = $reflection->getProperty('env_railpack_args');
+ $envArgsProperty->setAccessible(true);
+ $envArgs = $envArgsProperty->getValue($job);
+
+ expect($variables->all())->toBe([
+ 'RAILPACK_NODE_VERSION' => '22',
+ 'RAILPACK_CUSTOM_FLAG' => 'hello world',
+ 'RAILPACK_JSON' => '{"token":"abc"}',
+ 'RAILPACK_INSTALL_CMD' => 'npm ci && npm run postinstall',
+ 'RAILPACK_DEPLOY_APT_PACKAGES' => 'curl wget',
+ ]);
+ expect($envArgs)->toContain("--env 'RAILPACK_NODE_VERSION=22'");
+ expect($envArgs)->toContain("--env 'RAILPACK_CUSTOM_FLAG=hello world'");
+ expect($envArgs)->toContain("--env 'RAILPACK_JSON={\"token\":\"abc\"}'");
+ expect($envArgs)->toContain("--env 'RAILPACK_INSTALL_CMD=npm ci && npm run postinstall'");
+ expect($envArgs)->toContain("--env 'RAILPACK_DEPLOY_APT_PACKAGES=curl wget'");
+ expect($envArgs)->not->toContain('RAILPACK_NULL');
+});
+
+it('uses preview railpack environment variables for preview deployments', function () {
+ $application = Mockery::mock(Application::class);
+ $application->shouldReceive('getAttribute')->with('install_command')->andReturn(null);
+
+ $previewValue = Mockery::mock(EnvironmentVariable::class)->makePartial();
+ $previewValue->forceFill([
+ 'key' => 'RAILPACK_PREVIEW_ONLY',
+ 'is_literal' => false,
+ 'is_multiline' => false,
+ ]);
+ $previewValue->shouldReceive('getResolvedValueWithServer')->once()->with(Mockery::type(Server::class))->andReturn('preview-value');
+
+ $previewQuery = Mockery::mock();
+ $previewQuery->shouldReceive('withoutBuildpackControlVariables')->once()->andReturnSelf();
+ $previewQuery->shouldReceive('where')->with('is_buildtime', true)->once()->andReturnSelf();
+ $previewQuery->shouldReceive('get')->once()->andReturn(collect([]));
+ $application->shouldReceive('environment_variables_preview')->once()->andReturn($previewQuery);
+
+ $railpackPreviewQuery = Mockery::mock();
+ $railpackPreviewQuery->shouldReceive('get')->once()->andReturn(collect([$previewValue]));
+ $application->shouldReceive('railpack_environment_variables_preview')->once()->andReturn($railpackPreviewQuery);
+
+ $job = Mockery::mock(ApplicationDeploymentJob::class)->makePartial();
+ $job->shouldAllowMockingProtectedMethods();
+ $job->shouldReceive('generate_coolify_env_variables')->andReturn(collect([]));
+
+ $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+ $applicationProperty = $reflection->getProperty('application');
+ $applicationProperty->setAccessible(true);
+ $applicationProperty->setValue($job, $application);
+
+ $pullRequestProperty = $reflection->getProperty('pull_request_id');
+ $pullRequestProperty->setAccessible(true);
+ $pullRequestProperty->setValue($job, 42);
+
+ $mainServerProperty = $reflection->getProperty('mainServer');
+ $mainServerProperty->setAccessible(true);
+ $mainServerProperty->setValue($job, Mockery::mock(Server::class));
+
+ $method = $reflection->getMethod('generate_railpack_env_variables');
+ $method->setAccessible(true);
+ $variables = $method->invoke($job);
+
+ expect($variables->all())->toBe([
+ 'RAILPACK_PREVIEW_ONLY' => 'preview-value',
+ 'RAILPACK_DEPLOY_APT_PACKAGES' => 'curl wget',
+ ]);
+});
+
+it('merges coolify env variables into railpack build variables', function () {
+ $application = Mockery::mock(Application::class);
+ $application->shouldReceive('getAttribute')->with('install_command')->andReturn(null);
+
+ $userVar = Mockery::mock(EnvironmentVariable::class)->makePartial();
+ $userVar->forceFill([
+ 'key' => 'MY_BUILD_VAR',
+ 'is_literal' => false,
+ 'is_multiline' => false,
+ ]);
+ $userVar->shouldReceive('getResolvedValueWithServer')->once()->with(Mockery::type(Server::class))->andReturn('hello');
+
+ $envQuery = Mockery::mock();
+ $envQuery->shouldReceive('withoutBuildpackControlVariables')->once()->andReturnSelf();
+ $envQuery->shouldReceive('where')->with('is_buildtime', true)->once()->andReturnSelf();
+ $envQuery->shouldReceive('get')->once()->andReturn(collect([$userVar]));
+ $application->shouldReceive('environment_variables')->once()->andReturn($envQuery);
+
+ $railpackQuery = Mockery::mock();
+ $railpackQuery->shouldReceive('get')->once()->andReturn(collect([]));
+ $application->shouldReceive('railpack_environment_variables')->once()->andReturn($railpackQuery);
+
+ $job = Mockery::mock(ApplicationDeploymentJob::class)->makePartial();
+ $job->shouldAllowMockingProtectedMethods();
+ $job->shouldReceive('generate_coolify_env_variables')
+ ->with(true)
+ ->andReturn(collect([
+ 'COOLIFY_URL' => 'https://app.example.com',
+ 'COOLIFY_FQDN' => 'app.example.com',
+ 'COOLIFY_BRANCH' => 'main',
+ 'COOLIFY_RESOURCE_UUID' => 'app-uuid',
+ 'SOURCE_COMMIT' => 'abc123',
+ 'EMPTY_VAR' => '',
+ 'NULL_VAR' => null,
+ ]));
+
+ $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+ $applicationProperty = $reflection->getProperty('application');
+ $applicationProperty->setAccessible(true);
+ $applicationProperty->setValue($job, $application);
+
+ $pullRequestProperty = $reflection->getProperty('pull_request_id');
+ $pullRequestProperty->setAccessible(true);
+ $pullRequestProperty->setValue($job, 0);
+
+ $mainServerProperty = $reflection->getProperty('mainServer');
+ $mainServerProperty->setAccessible(true);
+ $mainServerProperty->setValue($job, Mockery::mock(Server::class));
+
+ $method = $reflection->getMethod('generate_railpack_env_variables');
+ $method->setAccessible(true);
+ $variables = $method->invoke($job);
+
+ expect($variables->all())->toBe([
+ 'MY_BUILD_VAR' => 'hello',
+ 'RAILPACK_DEPLOY_APT_PACKAGES' => 'curl wget',
+ 'COOLIFY_URL' => 'https://app.example.com',
+ 'COOLIFY_FQDN' => 'app.example.com',
+ 'COOLIFY_BRANCH' => 'main',
+ 'COOLIFY_RESOURCE_UUID' => 'app-uuid',
+ 'SOURCE_COMMIT' => 'abc123',
+ ]);
+
+ $envArgsProperty = $reflection->getProperty('env_railpack_args');
+ $envArgsProperty->setAccessible(true);
+ $envArgs = $envArgsProperty->getValue($job);
+
+ expect($envArgs)->toContain("--env 'COOLIFY_URL=https://app.example.com'");
+ expect($envArgs)->toContain("--env 'SOURCE_COMMIT=abc123'");
+ expect($envArgs)->toContain("--env 'RAILPACK_DEPLOY_APT_PACKAGES=curl wget'");
+ expect($envArgs)->not->toContain('EMPTY_VAR');
+ expect($envArgs)->not->toContain('NULL_VAR');
+});
+
+it('preserves user railpack deploy apt packages while adding healthcheck tools once', function () {
+ $application = Mockery::mock(Application::class);
+ $application->shouldReceive('getAttribute')->with('install_command')->andReturn(null);
+
+ $deployPackages = Mockery::mock(EnvironmentVariable::class)->makePartial();
+ $deployPackages->forceFill([
+ 'key' => 'RAILPACK_DEPLOY_APT_PACKAGES',
+ 'is_literal' => false,
+ 'is_multiline' => false,
+ ]);
+ $deployPackages->shouldReceive('getResolvedValueWithServer')->once()->with(Mockery::type(Server::class))->andReturn('ffmpeg curl');
+
+ $envQuery = Mockery::mock();
+ $envQuery->shouldReceive('withoutBuildpackControlVariables')->once()->andReturnSelf();
+ $envQuery->shouldReceive('where')->with('is_buildtime', true)->once()->andReturnSelf();
+ $envQuery->shouldReceive('get')->once()->andReturn(collect([]));
+ $application->shouldReceive('environment_variables')->once()->andReturn($envQuery);
+
+ $railpackQuery = Mockery::mock();
+ $railpackQuery->shouldReceive('get')->once()->andReturn(collect([$deployPackages]));
+ $application->shouldReceive('railpack_environment_variables')->once()->andReturn($railpackQuery);
+
+ $job = Mockery::mock(ApplicationDeploymentJob::class)->makePartial();
+ $job->shouldAllowMockingProtectedMethods();
+ $job->shouldReceive('generate_coolify_env_variables')->andReturn(collect([]));
+
+ $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+ $applicationProperty = $reflection->getProperty('application');
+ $applicationProperty->setAccessible(true);
+ $applicationProperty->setValue($job, $application);
+
+ $pullRequestProperty = $reflection->getProperty('pull_request_id');
+ $pullRequestProperty->setAccessible(true);
+ $pullRequestProperty->setValue($job, 0);
+
+ $mainServerProperty = $reflection->getProperty('mainServer');
+ $mainServerProperty->setAccessible(true);
+ $mainServerProperty->setValue($job, Mockery::mock(Server::class));
+
+ $method = $reflection->getMethod('generate_railpack_env_variables');
+ $method->setAccessible(true);
+ $variables = $method->invoke($job);
+
+ expect($variables->get('RAILPACK_DEPLOY_APT_PACKAGES'))->toBe('ffmpeg curl wget');
+
+ $envArgsProperty = $reflection->getProperty('env_railpack_args');
+ $envArgsProperty->setAccessible(true);
+ $envArgs = $envArgsProperty->getValue($job);
+
+ expect($envArgs)->toContain("--env 'RAILPACK_DEPLOY_APT_PACKAGES=ffmpeg curl wget'");
+});
diff --git a/tests/Unit/ApplicationSettingStaticCastTest.php b/tests/Unit/ApplicationSettingStaticCastTest.php
index 35ab7faaf..fe0eaec22 100644
--- a/tests/Unit/ApplicationSettingStaticCastTest.php
+++ b/tests/Unit/ApplicationSettingStaticCastTest.php
@@ -11,7 +11,7 @@
it('casts is_static to boolean when true', function () {
$setting = new ApplicationSetting;
- $setting->is_static = true;
+ $setting->setRawAttributes(['is_static' => true]);
// Verify it's cast to boolean
expect($setting->is_static)->toBeTrue()
@@ -20,7 +20,7 @@
it('casts is_static to boolean when false', function () {
$setting = new ApplicationSetting;
- $setting->is_static = false;
+ $setting->setRawAttributes(['is_static' => false]);
// Verify it's cast to boolean
expect($setting->is_static)->toBeFalse()
@@ -29,7 +29,7 @@
it('casts is_static from string "1" to boolean true', function () {
$setting = new ApplicationSetting;
- $setting->is_static = '1';
+ $setting->setRawAttributes(['is_static' => '1']);
// Should cast string to boolean
expect($setting->is_static)->toBeTrue()
@@ -38,7 +38,7 @@
it('casts is_static from string "0" to boolean false', function () {
$setting = new ApplicationSetting;
- $setting->is_static = '0';
+ $setting->setRawAttributes(['is_static' => '0']);
// Should cast string to boolean
expect($setting->is_static)->toBeFalse()
@@ -47,7 +47,7 @@
it('casts is_static from integer 1 to boolean true', function () {
$setting = new ApplicationSetting;
- $setting->is_static = 1;
+ $setting->setRawAttributes(['is_static' => 1]);
// Should cast integer to boolean
expect($setting->is_static)->toBeTrue()
@@ -56,7 +56,7 @@
it('casts is_static from integer 0 to boolean false', function () {
$setting = new ApplicationSetting;
- $setting->is_static = 0;
+ $setting->setRawAttributes(['is_static' => 0]);
// Should cast integer to boolean
expect($setting->is_static)->toBeFalse()
@@ -103,3 +103,65 @@
->and($casts[$field])->toBe('boolean');
}
});
+
+it('casts stop_grace_period to integer', function () {
+ $setting = new ApplicationSetting;
+ $casts = $setting->getCasts();
+
+ expect($casts)->toHaveKey('stop_grace_period')
+ ->and($casts['stop_grace_period'])->toBe('integer');
+});
+
+it('handles null stop_grace_period for default behavior', function () {
+ $setting = new ApplicationSetting;
+ $setting->stop_grace_period = null;
+
+ expect($setting->stop_grace_period)->toBeNull();
+});
+
+it('casts stop_grace_period from string to integer', function () {
+ $setting = new ApplicationSetting;
+ $setting->stop_grace_period = '60';
+
+ expect($setting->stop_grace_period)->toBe(60)
+ ->and($setting->stop_grace_period)->toBeInt();
+});
+
+it('casts stop_grace_period zero to integer (documents fallback trigger)', function () {
+ $setting = new ApplicationSetting;
+ $setting->stop_grace_period = 0;
+
+ expect($setting->stop_grace_period)->toBe(0)
+ ->and($setting->stop_grace_period)->toBeInt();
+});
+
+it('casts stop_grace_period negative value to integer (documents fallback trigger)', function () {
+ $setting = new ApplicationSetting;
+ $setting->stop_grace_period = -10;
+
+ expect($setting->stop_grace_period)->toBe(-10)
+ ->and($setting->stop_grace_period)->toBeInt();
+});
+
+it('resolves valid stop grace periods', function (?int $storedValue, int $expectedValue) {
+ $setting = new ApplicationSetting;
+ $setting->stop_grace_period = $storedValue;
+
+ expect($setting->stopGracePeriodSeconds())->toBe($expectedValue);
+})->with([
+ 'minimum' => [MIN_STOP_GRACE_PERIOD_SECONDS, MIN_STOP_GRACE_PERIOD_SECONDS],
+ 'custom' => [300, 300],
+ 'maximum' => [MAX_STOP_GRACE_PERIOD_SECONDS, MAX_STOP_GRACE_PERIOD_SECONDS],
+]);
+
+it('falls back to default stop grace period for invalid stored values', function (?int $storedValue) {
+ $setting = new ApplicationSetting;
+ $setting->stop_grace_period = $storedValue;
+
+ expect($setting->stopGracePeriodSeconds())->toBe(DEFAULT_STOP_GRACE_PERIOD_SECONDS);
+})->with([
+ 'null' => [null],
+ 'zero' => [0],
+ 'negative' => [-10],
+ 'above maximum' => [MAX_STOP_GRACE_PERIOD_SECONDS + 1],
+]);
diff --git a/tests/Unit/DeploymentConfiguration/ApplicationConfigurationSnapshotTest.php b/tests/Unit/DeploymentConfiguration/ApplicationConfigurationSnapshotTest.php
new file mode 100644
index 000000000..2106697b2
--- /dev/null
+++ b/tests/Unit/DeploymentConfiguration/ApplicationConfigurationSnapshotTest.php
@@ -0,0 +1,123 @@
+create();
+ $project = Project::factory()->create(['team_id' => $team->id]);
+ $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+ return Application::factory()->create(array_merge([
+ 'environment_id' => $environment->id,
+ 'status' => 'running:healthy',
+ 'fqdn' => 'https://example.com',
+ 'build_command' => 'npm run build',
+ 'start_command' => 'npm run start',
+ ], $attributes));
+}
+
+function markSnapshotTestApplicationDeployed(Application $application): ApplicationDeploymentQueue
+{
+ $deployment = ApplicationDeploymentQueue::create([
+ 'application_id' => (string) $application->id,
+ 'deployment_uuid' => (string) Str::uuid(),
+ 'status' => 'finished',
+ 'commit' => 'HEAD',
+ ]);
+
+ $application->markDeploymentConfigurationApplied($deployment);
+
+ return $deployment->refresh();
+}
+
+it('does not report preview deployment toggles as pending production configuration changes', function () {
+ $application = snapshotTestApplication();
+ markSnapshotTestApplicationDeployed($application);
+
+ $application->settings->update(['is_preview_deployments_enabled' => true]);
+
+ expect($application->refresh()->pendingDeploymentConfigurationDiff()->isChanged())->toBeFalse();
+});
+
+it('detects build-impacting changes', function () {
+ $application = snapshotTestApplication();
+ markSnapshotTestApplicationDeployed($application);
+
+ $application->update(['build_command' => 'pnpm build']);
+ $diff = $application->refresh()->pendingDeploymentConfigurationDiff();
+
+ expect($diff->isChanged())->toBeTrue()
+ ->and($diff->requiresBuild())->toBeTrue()
+ ->and(collect($diff->changes())->pluck('label'))->toContain('Build command');
+});
+
+it('detects redeploy-only domain changes', function () {
+ $application = snapshotTestApplication();
+ markSnapshotTestApplicationDeployed($application);
+
+ $application->update(['fqdn' => 'https://new.example.com']);
+ $diff = $application->refresh()->pendingDeploymentConfigurationDiff();
+
+ expect($diff->isChanged())->toBeTrue()
+ ->and($diff->requiresBuild())->toBeFalse()
+ ->and(collect($diff->changes())->pluck('label'))->toContain('Domains');
+});
+
+it('detects environment variable value changes without exposing secret values', function () {
+ $application = snapshotTestApplication();
+ EnvironmentVariable::create([
+ 'key' => 'API_TOKEN',
+ 'value' => 'old-secret',
+ 'is_buildtime' => false,
+ 'is_runtime' => true,
+ 'is_preview' => false,
+ 'resourceable_type' => Application::class,
+ 'resourceable_id' => $application->id,
+ ]);
+ markSnapshotTestApplicationDeployed($application->refresh());
+
+ $application->environment_variables()->where('key', 'API_TOKEN')->first()->update(['value' => 'new-secret']);
+ $diff = $application->refresh()->pendingDeploymentConfigurationDiff();
+ $change = collect($diff->changes())->firstWhere('label', 'API_TOKEN');
+
+ expect($change)->not->toBeNull()
+ ->and($change['display_summary'])->toBe('Changed')
+ ->and($change['old_display_value'])->toBe('Set')
+ ->and($change['new_display_value'])->toBe('Set')
+ ->and(json_encode($diff->toArray()))->not->toContain('old-secret')->not->toContain('new-secret');
+});
+
+it('describes added environment variables as set without exposing secret values', function () {
+ $application = snapshotTestApplication();
+ markSnapshotTestApplicationDeployed($application);
+
+ EnvironmentVariable::create([
+ 'key' => 'API_TOKEN',
+ 'value' => 'new-secret',
+ 'is_buildtime' => false,
+ 'is_runtime' => true,
+ 'is_preview' => false,
+ 'resourceable_type' => Application::class,
+ 'resourceable_id' => $application->id,
+ ]);
+
+ $diff = $application->refresh()->pendingDeploymentConfigurationDiff();
+ $change = collect($diff->changes())->firstWhere('label', 'API_TOKEN');
+
+ expect($change)->not->toBeNull()
+ ->and($change['display_summary'])->toBeNull()
+ ->and($change['old_display_value'])->toBe('Not set')
+ ->and($change['new_display_value'])->toBe('Set')
+ ->and(json_encode($diff->toArray()))->not->toContain('new-secret');
+});
diff --git a/tests/Unit/DetectsSkipDeployCommitsTest.php b/tests/Unit/DetectsSkipDeployCommitsTest.php
new file mode 100644
index 000000000..5255df5d6
--- /dev/null
+++ b/tests/Unit/DetectsSkipDeployCommitsTest.php
@@ -0,0 +1,115 @@
+toBeFalse();
+ });
+
+ test('returns false when only nulls or empty strings are provided', function () use ($harnessClass) {
+ expect($harnessClass::shouldSkipDeploy([null, '', null]))->toBeFalse();
+ });
+
+ test('returns true when all messages contain [skip ci]', function () use ($harnessClass) {
+ $messages = [
+ 'Update docs [skip ci]',
+ 'Fix typo [skip ci]',
+ ];
+ expect($harnessClass::shouldSkipDeploy($messages))->toBeTrue();
+ });
+
+ test('returns true when single message contains [skip cd]', function () use ($harnessClass) {
+ expect($harnessClass::shouldSkipDeploy(['Update README [skip cd]']))->toBeTrue();
+ });
+
+ test('returns true with mixed [skip ci] and [skip cd] (case-insensitive)', function () use ($harnessClass) {
+ $messages = [
+ 'Docs [SKIP CI]',
+ 'Changelog [Skip Cd]',
+ ];
+ expect($harnessClass::shouldSkipDeploy($messages))->toBeTrue();
+ });
+
+ test('returns false when at least one message has no skip marker', function () use ($harnessClass) {
+ $messages = [
+ 'Update docs [skip ci]',
+ 'Actual feature change',
+ ];
+ expect($harnessClass::shouldSkipDeploy($messages))->toBeFalse();
+ });
+
+ test('returns false when single message has no skip marker', function () use ($harnessClass) {
+ expect($harnessClass::shouldSkipDeploy(['Deploy this please']))->toBeFalse();
+ });
+
+ test('null entries are filtered before evaluation', function () use ($harnessClass) {
+ $messages = [
+ null,
+ 'Docs [skip ci]',
+ null,
+ ];
+ expect($harnessClass::shouldSkipDeploy($messages))->toBeTrue();
+ });
+
+ test('matches PR title scenario (single string)', function () use ($harnessClass) {
+ expect($harnessClass::shouldSkipDeploy(['chore: update readme [skip ci]']))->toBeTrue();
+ expect($harnessClass::shouldSkipDeploy(['feat: real change']))->toBeFalse();
+ expect($harnessClass::shouldSkipDeploy([null]))->toBeFalse();
+ });
+});
+
+describe('shouldSkipDeployAny (any-marker)', function () use ($harnessClass) {
+ test('returns false when messages array is empty', function () use ($harnessClass) {
+ expect($harnessClass::shouldSkipDeployAny([]))->toBeFalse();
+ });
+
+ test('returns false when only nulls or empty strings are provided', function () use ($harnessClass) {
+ expect($harnessClass::shouldSkipDeployAny([null, '', null]))->toBeFalse();
+ });
+
+ test('returns true when any one message contains [skip ci]', function () use ($harnessClass) {
+ $messages = [
+ 'Real feature change',
+ 'docs: update readme [skip ci]',
+ ];
+ expect($harnessClass::shouldSkipDeployAny($messages))->toBeTrue();
+ });
+
+ test('returns true when any one message contains [skip cd]', function () use ($harnessClass) {
+ expect($harnessClass::shouldSkipDeployAny(['feature change', 'chore [skip cd]']))->toBeTrue();
+ });
+
+ test('returns true case-insensitively', function () use ($harnessClass) {
+ expect($harnessClass::shouldSkipDeployAny(['feat: docs [SKIP CI]']))->toBeTrue();
+ expect($harnessClass::shouldSkipDeployAny(['feat: docs [Skip Cd]']))->toBeTrue();
+ });
+
+ test('returns false when no message contains a skip marker', function () use ($harnessClass) {
+ $messages = [
+ 'feat: add new endpoint',
+ 'fix: handle edge case',
+ ];
+ expect($harnessClass::shouldSkipDeployAny($messages))->toBeFalse();
+ });
+
+ test('null and empty entries are skipped, real markers still match', function () use ($harnessClass) {
+ expect($harnessClass::shouldSkipDeployAny([null, '', 'docs [skip ci]', null]))->toBeTrue();
+ expect($harnessClass::shouldSkipDeployAny([null, '', null]))->toBeFalse();
+ });
+
+ test('PR title alone with skip marker triggers skip', function () use ($harnessClass) {
+ expect($harnessClass::shouldSkipDeployAny(['chore: update readme [skip ci]']))->toBeTrue();
+ });
+
+ test('PR title without skip marker but commit message with skip marker triggers skip', function () use ($harnessClass) {
+ expect($harnessClass::shouldSkipDeployAny(['feat: real change', 'wip [skip cd]']))->toBeTrue();
+ });
+});
diff --git a/tests/Unit/DocmostMailDriverTemplateTest.php b/tests/Unit/DocmostMailDriverTemplateTest.php
new file mode 100644
index 000000000..3512017ef
--- /dev/null
+++ b/tests/Unit/DocmostMailDriverTemplateTest.php
@@ -0,0 +1,23 @@
+toContain('MAIL_DRIVER=${MAIL_DRIVER:?}')
+ ->not->toContain('MAIL_DRIVER=${MAIL_DRIVER}');
+
+ foreach (['service-templates.json', 'service-templates-latest.json'] as $templateFile) {
+ $templates = json_decode(
+ file_get_contents(__DIR__."/../../templates/{$templateFile}"),
+ associative: true,
+ flags: JSON_THROW_ON_ERROR,
+ );
+
+ $generatedCompose = base64_decode($templates['docmost']['compose'], strict: true);
+
+ expect($generatedCompose)
+ ->toContain('MAIL_DRIVER=${MAIL_DRIVER:?}')
+ ->not->toContain('MAIL_DRIVER=${MAIL_DRIVER}');
+ }
+});
diff --git a/tests/Unit/EnvironmentVariableBuildpackControlTest.php b/tests/Unit/EnvironmentVariableBuildpackControlTest.php
new file mode 100644
index 000000000..c24956c0d
--- /dev/null
+++ b/tests/Unit/EnvironmentVariableBuildpackControlTest.php
@@ -0,0 +1,74 @@
+key = 'NIXPACKS_NODE_VERSION';
+
+ expect($env->is_buildpack_control)->toBeTrue();
+});
+
+it('flags RAILPACK_ keys as buildpack control variables', function () {
+ $env = new EnvironmentVariable;
+ $env->key = 'RAILPACK_NODE_VERSION';
+
+ expect($env->is_buildpack_control)->toBeTrue();
+});
+
+it('does not flag user-defined keys as buildpack control variables', function () {
+ $env = new EnvironmentVariable;
+ $env->key = 'MY_BUILD_VAR';
+
+ expect($env->is_buildpack_control)->toBeFalse();
+});
+
+it('does not flag empty key as buildpack control variable', function () {
+ $env = new EnvironmentVariable;
+
+ expect($env->is_buildpack_control)->toBeFalse();
+});
+
+it('lists is_buildpack_control in appends and drops legacy is_nixpacks', function () {
+ $env = new EnvironmentVariable;
+
+ expect($env->getAppends())->toContain('is_buildpack_control');
+ expect($env->getAppends())->not->toContain('is_nixpacks');
+});
+
+it('normalizes environment variable keys before storing them on the model', function () {
+ $env = new EnvironmentVariable;
+ $env->key = ' node.name ';
+
+ expect($env->key)->toBe('node.name');
+});
+
+it('allows Docker-compatible environment variable keys on the model', function (string $key) {
+ $env = new EnvironmentVariable;
+ $env->key = $key;
+
+ expect($env->key)->toBe($key);
+})->with([
+ 'starts with digit' => '1BAD',
+ 'hyphen' => 'BAD-KEY',
+ 'dot' => 'node.name',
+ 'uppercase dots' => 'XPACK.SECURITY.ENABLED',
+ 'semicolon' => 'BAD;KEY',
+]);
+
+it('rejects environment variable keys Docker cannot represent on the model', function () {
+ $env = new EnvironmentVariable;
+
+ expect(function () use ($env) {
+ $env->key = 'BAD=KEY';
+ })->toThrow(InvalidArgumentException::class, 'Docker-compatible');
+});
+
+it('rejects shared environment variable keys Docker cannot represent on the model', function () {
+ $env = new SharedEnvironmentVariable;
+
+ expect(function () use ($env) {
+ $env->key = 'BAD=KEY';
+ })->toThrow(InvalidArgumentException::class, 'Docker-compatible');
+});
diff --git a/tests/Unit/GenerateEnvValueTest.php b/tests/Unit/GenerateEnvValueTest.php
new file mode 100644
index 000000000..7e7755f4d
--- /dev/null
+++ b/tests/Unit/GenerateEnvValueTest.php
@@ -0,0 +1,29 @@
+toBeString()
+ ->toMatch('/^[0-9a-f]+$/');
+
+ expect(strlen($value))->toBe($expectedLength);
+})->with([
+ 'HEX_32' => ['HEX_32', 32],
+ 'HEX_64' => ['HEX_64', 64],
+ 'HEX_128' => ['HEX_128', 128],
+]);
+
+test('real base64 magic variables generate valid base64 strings from expected byte lengths', function (string $command, int $expectedBytes) {
+ $value = generateEnvValue($command);
+ $decodedValue = base64_decode($value, true);
+
+ expect($value)->toBeString();
+ expect($decodedValue)->not->toBeFalse();
+ expect(strlen($decodedValue))->toBe($expectedBytes);
+})->with([
+ 'REALBASE64' => ['REALBASE64', 32],
+ 'REALBASE64_32' => ['REALBASE64_32', 32],
+ 'REALBASE64_64' => ['REALBASE64_64', 64],
+ 'REALBASE64_128' => ['REALBASE64_128', 128],
+]);
diff --git a/tests/Unit/IsReachableChangedTest.php b/tests/Unit/IsReachableChangedTest.php
new file mode 100644
index 000000000..76f9863bf
--- /dev/null
+++ b/tests/Unit/IsReachableChangedTest.php
@@ -0,0 +1,61 @@
+is_reachable = $isReachable;
+
+ $server = Mockery::mock(Server::class)->makePartial()->shouldAllowMockingProtectedMethods();
+ $server->shouldReceive('refresh')->andReturnSelf();
+ $server->shouldReceive('getAttribute')->with('settings')->andReturn($settings);
+ $server->shouldReceive('getAttribute')->with('unreachable_notification_sent')->andReturn($notificationSent);
+ $server->shouldReceive('getAttribute')->with('unreachable_count')->andReturn($unreachableCount);
+
+ return $server;
+}
+
+it('sends Reachable notification when reachable and notification was previously sent', function () {
+ $server = makeServerForReachabilityTest(isReachable: true, notificationSent: true, unreachableCount: 0);
+ $server->shouldReceive('sendReachableNotification')->once();
+ $server->shouldNotReceive('sendUnreachableNotification');
+
+ $server->isReachableChanged();
+});
+
+it('does not send any notification when reachable and notification was never sent', function () {
+ $server = makeServerForReachabilityTest(isReachable: true, notificationSent: false, unreachableCount: 0);
+ $server->shouldNotReceive('sendReachableNotification');
+ $server->shouldNotReceive('sendUnreachableNotification');
+
+ $server->isReachableChanged();
+});
+
+it('sends Unreachable notification when count >= 2 and not yet notified', function () {
+ $server = makeServerForReachabilityTest(isReachable: false, notificationSent: false, unreachableCount: 2);
+ $server->shouldReceive('sendUnreachableNotification')->once();
+ $server->shouldNotReceive('sendReachableNotification');
+
+ $server->isReachableChanged();
+});
+
+it('does not send Unreachable notification on first transient failure (count=1)', function () {
+ $server = makeServerForReachabilityTest(isReachable: false, notificationSent: false, unreachableCount: 1);
+ $server->shouldNotReceive('sendUnreachableNotification');
+ $server->shouldNotReceive('sendReachableNotification');
+
+ $server->isReachableChanged();
+});
+
+it('does not double-send Unreachable when already notified', function () {
+ $server = makeServerForReachabilityTest(isReachable: false, notificationSent: true, unreachableCount: 5);
+ $server->shouldNotReceive('sendUnreachableNotification');
+ $server->shouldNotReceive('sendReachableNotification');
+
+ $server->isReachableChanged();
+});
diff --git a/tests/Unit/LocalFileVolumeContentSizeTest.php b/tests/Unit/LocalFileVolumeContentSizeTest.php
new file mode 100644
index 000000000..1fd315884
--- /dev/null
+++ b/tests/Unit/LocalFileVolumeContentSizeTest.php
@@ -0,0 +1,66 @@
+toBe(5_242_880);
+});
+
+it('exposes binary and too-large placeholder constants', function () {
+ expect(LocalFileVolume::BINARY_PLACEHOLDER)->toBe('[binary file]');
+ expect(LocalFileVolume::TOO_LARGE_PLACEHOLDER)->toBe('[file too large to display]');
+});
+
+it('flags is_too_large when content matches the placeholder', function () {
+ $volume = new LocalFileVolume;
+ $volume->content = LocalFileVolume::TOO_LARGE_PLACEHOLDER;
+
+ expect($volume->is_too_large)->toBeTrue();
+ expect($volume->is_binary)->toBeFalse();
+});
+
+it('flags is_binary when content matches the placeholder', function () {
+ $volume = new LocalFileVolume;
+ $volume->content = LocalFileVolume::BINARY_PLACEHOLDER;
+
+ expect($volume->is_binary)->toBeTrue();
+ expect($volume->is_too_large)->toBeFalse();
+});
+
+it('does not flag normal content as binary or too large', function () {
+ $volume = new LocalFileVolume;
+ $volume->content = "hello\nworld\n";
+
+ expect($volume->is_binary)->toBeFalse();
+ expect($volume->is_too_large)->toBeFalse();
+});
+
+it('does not flag empty content as binary or too large', function () {
+ $volume = new LocalFileVolume;
+ $volume->content = null;
+
+ expect($volume->is_binary)->toBeFalse();
+ expect($volume->is_too_large)->toBeFalse();
+});
+
+it('exposes the too-large flag via toArray for Livewire serialization', function () {
+ $volume = new LocalFileVolume;
+ $volume->content = LocalFileVolume::TOO_LARGE_PLACEHOLDER;
+
+ $array = $volume->toArray();
+
+ expect($array)->toHaveKey('is_too_large');
+ expect($array['is_too_large'])->toBeTrue();
+});
diff --git a/tests/Unit/ServerBackoffTest.php b/tests/Unit/ServerBackoffTest.php
index bdcefb74f..9f1f747d4 100644
--- a/tests/Unit/ServerBackoffTest.php
+++ b/tests/Unit/ServerBackoffTest.php
@@ -1,11 +1,13 @@
is_reachable = true;
$settings->shouldReceive('update')
->with(['is_reachable' => false, 'is_usable' => false])
->once();
$server = Mockery::mock(Server::class)->makePartial()->shouldAllowMockingProtectedMethods();
$server->shouldReceive('getAttribute')->with('settings')->andReturn($settings);
+ $server->shouldReceive('getAttribute')->with('unreachable_notification_sent')->andReturn(false);
$server->shouldReceive('increment')->with('unreachable_count')->once();
$server->id = 1;
$server->name = 'test-server';
+ $server->unreachable_count = 1; // Will become 2 after increment in real code; mock keeps value as-is
$job = new ServerConnectionCheckJob($server);
$job->failed(new TimeoutExceededException);
@@ -152,6 +159,50 @@
});
});
+describe('ServerConnectionCheckJob ServerReachabilityChanged dispatch', function () {
+ // ServerReachabilityChanged's constructor calls $server->isReachableChanged() — verifying that
+ // call is a clean proxy for "the event was dispatched", and avoids serializing a Mockery proxy
+ // through the event dispatcher (which trips Eloquent static method lookups on the proxy class).
+ $invoke = function (bool $wasReachable, bool $wasNotified, bool $isReachable, int $unreachableCount, bool $expectDispatch) {
+ $server = Mockery::mock(Server::class)->makePartial()->shouldAllowMockingProtectedMethods();
+ $server->shouldReceive('getAttribute')->with('unreachable_count')->andReturn($unreachableCount);
+ $server->shouldReceive('getAttribute')->with('id')->andReturn(1);
+ if ($expectDispatch) {
+ $server->shouldReceive('isReachableChanged')->once()->andReturnNull();
+ } else {
+ $server->shouldNotReceive('isReachableChanged');
+ }
+
+ $job = new ServerConnectionCheckJob($server);
+ $method = new ReflectionMethod($job, 'dispatchReachabilityChangedIfNeeded');
+ $method->invoke($job, $wasReachable, $wasNotified, $isReachable);
+ };
+
+ it('dispatches event when count crosses unreachable threshold', function () use ($invoke) {
+ $invoke(true, false, false, 2, true);
+ });
+
+ it('does not dispatch on first transient failure (count=1)', function () use ($invoke) {
+ $invoke(true, false, false, 1, false);
+ });
+
+ it('does not dispatch when already notified and still unreachable', function () use ($invoke) {
+ $invoke(false, true, false, 5, false);
+ });
+
+ it('dispatches recovery event when previously unreachable', function () use ($invoke) {
+ $invoke(false, false, true, 0, true);
+ });
+
+ it('dispatches recovery event when previously notified', function () use ($invoke) {
+ $invoke(true, true, true, 0, true);
+ });
+
+ it('does not dispatch when consistently reachable and never notified', function () use ($invoke) {
+ $invoke(true, false, true, 0, false);
+ });
+});
+
describe('ServerCheckJob unreachable_count', function () {
it('increments unreachable_count on timeout', function () {
$server = Mockery::mock(Server::class)->makePartial()->shouldAllowMockingProtectedMethods();
diff --git a/tests/Unit/StandaloneDatabaseRegistryTest.php b/tests/Unit/StandaloneDatabaseRegistryTest.php
new file mode 100644
index 000000000..7c56d5f8d
--- /dev/null
+++ b/tests/Unit/StandaloneDatabaseRegistryTest.php
@@ -0,0 +1,45 @@
+not->toBeEmpty();
+
+ $onDisk = collect($files)
+ ->map(fn (string $path) => 'App\\Models\\'.basename($path, '.php'))
+ ->reject(fn (string $class) => $class === StandaloneDocker::class)
+ ->sort()
+ ->values()
+ ->all();
+
+ $registered = collect(STANDALONE_DATABASE_MODELS)->values()->sort()->values()->all();
+
+ expect($registered)->toBe(
+ $onDisk,
+ 'STANDALONE_DATABASE_MODELS in bootstrap/helpers/constants.php is out of sync with the App\\Models\\Standalone* classes on disk. '
+ .'Add the missing model(s) to the registry (and to DATABASE_TYPES) so MCP/API helpers can resolve them.'
+ );
+});
+
+test('STANDALONE_DATABASE_MODELS keys mirror DATABASE_TYPES', function () {
+ expect(array_keys(STANDALONE_DATABASE_MODELS))->toEqualCanonicalizing(DATABASE_TYPES);
+});
+
+test('every STANDALONE_DATABASE_MODELS entry is an Eloquent model with whereUuid scope', function () {
+ foreach (STANDALONE_DATABASE_MODELS as $slug => $modelClass) {
+ expect(class_exists($modelClass))->toBeTrue("{$slug} maps to non-existent class {$modelClass}");
+ expect(is_subclass_of($modelClass, Model::class))
+ ->toBeTrue("{$modelClass} is not an Eloquent model");
+ expect(method_exists($modelClass, 'team'))
+ ->toBeTrue("{$modelClass} is missing team() accessor required by queryDatabaseByUuidWithinTeam()");
+ }
+});
diff --git a/tests/Unit/ValidationPatternsTest.php b/tests/Unit/ValidationPatternsTest.php
index 9ecffe46d..a959b18d5 100644
--- a/tests/Unit/ValidationPatternsTest.php
+++ b/tests/Unit/ValidationPatternsTest.php
@@ -1,5 +1,6 @@
toContain('nullable')
->not->toContain('required');
});
+
+it('accepts Docker-compatible environment variable keys', function (string $key) {
+ expect(ValidationPatterns::isValidEnvironmentVariableKey($key))->toBeTrue();
+})->with([
+ 'letters' => 'APP_ENV',
+ 'leading underscore' => '_TOKEN',
+ 'railpack control variable' => 'RAILPACK_NODE_VERSION',
+ 'digits after first character' => 'NODE_VERSION_20',
+ 'starts with digit' => '1BAD',
+ 'hyphen' => 'BAD-KEY',
+ 'dot' => 'node.name',
+ 'uppercase dots' => 'XPACK.SECURITY.ENABLED',
+ 'semicolon' => 'BAD;KEY',
+ 'space' => 'BAD KEY',
+]);
+
+it('rejects environment variable keys Docker cannot represent', function (string $key) {
+ expect(ValidationPatterns::isValidEnvironmentVariableKey($key))->toBeFalse();
+})->with([
+ 'equals' => 'BAD=KEY',
+ 'empty' => '',
+]);
+
+it('generates environment variable key rules with correct defaults', function () {
+ $rules = ValidationPatterns::environmentVariableKeyRules();
+
+ expect($rules)->toContain('required')
+ ->toContain('string')
+ ->toContain('max:255')
+ ->toContain('regex:'.ValidationPatterns::ENVIRONMENT_VARIABLE_KEY_PATTERN);
+});
+
+it('normalizes environment variable keys by trimming surrounding whitespace', function () {
+ expect(ValidationPatterns::normalizeEnvironmentVariableKey(' node.name '))->toBe('node.name');
+});
+
+it('normalizes environment variable keys before model validation', function () {
+ $environmentVariable = new EnvironmentVariable;
+ $environmentVariable->key = ' APP_ENV ';
+
+ expect($environmentVariable->key)->toBe('APP_ENV');
+});
diff --git a/versions.json b/versions.json
index 3307b7f2e..b40eafe2c 100644
--- a/versions.json
+++ b/versions.json
@@ -1,16 +1,16 @@
{
"coolify": {
"v4": {
- "version": "4.0.0"
+ "version": "4.1.0"
},
"nightly": {
"version": "4.0.0"
},
"helper": {
- "version": "1.0.13"
+ "version": "1.0.14"
},
"realtime": {
- "version": "1.0.13"
+ "version": "1.0.15"
},
"sentinel": {
"version": "0.0.21"
diff --git a/vite.config.js b/vite.config.js
index fc739c95d..6c706d272 100644
--- a/vite.config.js
+++ b/vite.config.js
@@ -4,6 +4,8 @@ import vue from "@vitejs/plugin-vue";
export default defineConfig(({ mode }) => {
const env = loadEnv(mode, process.cwd(), '')
+ const viteHost = env.VITE_HOST || null;
+ const vitePort = Number(env.VITE_PORT || 5173);
return {
server: {
@@ -14,9 +16,20 @@ export default defineConfig(({ mode }) => {
],
},
host: "0.0.0.0",
- hmr: {
- host: env.VITE_HOST || '0.0.0.0'
+ allowedHosts: true,
+ cors: {
+ origin: [
+ /^https?:\/\/localhost(:\d+)?$/,
+ /^https?:\/\/127\.0\.0\.1(:\d+)?$/,
+ /^https?:\/\/\[::1\](:\d+)?$/,
+ ...(env.APP_URL ? [env.APP_URL] : []),
+ ...(viteHost ? [`http://${viteHost}:${vitePort}`, `https://${viteHost}:${vitePort}`] : []),
+ ],
},
+ origin: viteHost ? `http://${viteHost}:${vitePort}` : undefined,
+ hmr: viteHost
+ ? { host: viteHost, clientPort: vitePort }
+ : true,
},
plugins: [
laravel({