'array', 'cache.default' => 'array']);
+ Bus::fake();
+ InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+ $this->team = Team::factory()->create();
+ $this->admin = User::factory()->create();
+ $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+ $keyId = DB::table('private_keys')->insertGetId([
+ 'uuid' => (string) Str::uuid(),
+ 'name' => 'Test Key',
+ 'private_key' => 'test-key',
+ 'team_id' => $this->team->id,
+ 'created_at' => now(),
+ 'updated_at' => now(),
+ ]);
+
+ $this->server = Server::factory()->create([
+ 'team_id' => $this->team->id,
+ 'private_key_id' => $keyId,
+ ]);
+
+ StandaloneDocker::withoutEvents(function () {
+ $this->destination = StandaloneDocker::firstOrCreate(
+ ['server_id' => $this->server->id, 'network' => 'coolify'],
+ ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+ );
+ });
+
+ $this->project = Project::create([
+ 'uuid' => (string) Str::uuid(),
+ 'name' => 'Test Project',
+ 'team_id' => $this->team->id,
+ ]);
+
+ $this->environment = $this->project->environments()->first()
+ ?? Environment::factory()->create(['project_id' => $this->project->id]);
+
+ $this->application = Application::factory()->create([
+ 'uuid' => (string) Str::uuid(),
+ 'name' => 'Test App',
+ 'environment_id' => $this->environment->id,
+ 'destination_id' => $this->destination->id,
+ 'destination_type' => $this->destination->getMorphClass(),
+ ]);
+
+ $this->actingAs($this->admin);
+ session(['currentTeam' => $this->team]);
+});
+
+test('livewire file storage rejects parent segments and does not create a local file volume', function () {
+ Livewire::test(Storage::class, ['resource' => $this->application])
+ ->set('file_storage_path', '/../../../../../../etc/example.conf')
+ ->set('file_storage_content', 'owned')
+ ->call('submitFileStorage')
+ ->assertDispatched('error');
+
+ expect(LocalFileVolume::query()->count())->toBe(0);
+});
+
+test('file mount modal shows the calculated host file path above the destination input', function () {
+ Livewire::test(Storage::class, ['resource' => $this->application])
+ ->assertSeeText('This file will be created on the host, then mounted into the container.')
+ ->assertSeeText('Host file path')
+ ->assertSeeText($this->application->workdir().'/')
+ ->set('file_storage_path', '/etc/nginx/nginx.conf')
+ ->assertSeeText($this->application->workdir().'/etc/nginx/nginx.conf')
+ ->assertDontSeeText('Actual file mounted from the host system to the container.');
+});
+
+test('livewire file storage stores safe file mounts under the application configuration root', function () {
+ Livewire::test(Storage::class, ['resource' => $this->application])
+ ->set('file_storage_path', '/etc/nginx/nginx.conf')
+ ->set('file_storage_content', 'server {}')
+ ->call('submitFileStorage')
+ ->assertDispatched('success');
+
+ $volume = LocalFileVolume::query()->sole();
+
+ expect($volume->mount_path)->toBe('/etc/nginx/nginx.conf')
+ ->and($volume->fs_path)->toBe(application_configuration_dir().'/'.$this->application->uuid.'/etc/nginx/nginx.conf')
+ ->and($volume->is_directory)->toBeFalse();
+});
+
+test('livewire host file storage stores an existing host file path without managed content', function () {
+ Livewire::test(Storage::class, ['resource' => $this->application])
+ ->set('host_file_storage_source', '/etc/nginx/nginx.conf')
+ ->set('host_file_storage_destination', '/etc/nginx/nginx.conf')
+ ->call('submitHostFileStorage')
+ ->assertDispatched('success');
+
+ $volume = LocalFileVolume::query()->sole();
+
+ expect($volume->fs_path)->toBe('/etc/nginx/nginx.conf')
+ ->and($volume->mount_path)->toBe('/etc/nginx/nginx.conf')
+ ->and($volume->content)->toBeNull()
+ ->and($volume->is_host_file)->toBeTrue()
+ ->and($volume->is_directory)->toBeFalse();
+
+ Bus::assertNotDispatched(ServerStorageSaveJob::class);
+});
diff --git a/tests/Feature/StorageApiTest.php b/tests/Feature/StorageApiTest.php
index 75357e41e..92d92f860 100644
--- a/tests/Feature/StorageApiTest.php
+++ b/tests/Feature/StorageApiTest.php
@@ -1,5 +1,6 @@
'array', 'cache.default' => 'array']);
Bus::fake();
- InstanceSettings::updateOrCreate(['id' => 0]);
+ InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
$this->team = Team::factory()->create();
$this->user = User::factory()->create();
@@ -61,6 +65,24 @@ function createTestDatabase($context): StandalonePostgresql
]);
}
+function createTestServiceApplication($context): array
+{
+ $service = Service::factory()->create([
+ 'environment_id' => $context->environment->id,
+ 'destination_id' => $context->destination->id,
+ 'destination_type' => $context->destination->getMorphClass(),
+ ]);
+
+ $serviceApplication = ServiceApplication::create([
+ 'uuid' => (string) Str::uuid(),
+ 'name' => 'test-service-app',
+ 'service_id' => $service->id,
+ 'image' => 'nginx:alpine',
+ ]);
+
+ return [$service, $serviceApplication];
+}
+
// ──────────────────────────────────────────────────────────────
// Application Storage Endpoints
// ──────────────────────────────────────────────────────────────
@@ -140,6 +162,56 @@ function createTestDatabase($context): StandalonePostgresql
expect($vol)->not->toBeNull();
expect($vol->mount_path)->toBe('/app/config.json');
expect($vol->is_directory)->toBeFalse();
+ expect($vol->fs_path)->toBe(application_configuration_dir().'/'.$app->uuid.'/app/config.json');
+ });
+
+ test('creates bind only host file storage for application', function () {
+ $app = createTestApplication($this);
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$this->bearerToken,
+ 'Content-Type' => 'application/json',
+ ])->postJson("/api/v1/applications/{$app->uuid}/storages", [
+ 'type' => 'file',
+ 'is_host_file' => true,
+ 'fs_path' => '/etc/nginx/nginx.conf',
+ 'mount_path' => '/etc/nginx/nginx.conf',
+ ]);
+
+ $response->assertStatus(201);
+
+ $vol = LocalFileVolume::where('resource_id', $app->id)
+ ->where('resource_type', get_class($app))
+ ->first();
+
+ expect($vol)->not->toBeNull();
+ expect($vol->fs_path)->toBe('/etc/nginx/nginx.conf');
+ expect($vol->mount_path)->toBe('/etc/nginx/nginx.conf');
+ expect($vol->content)->toBeNull();
+ expect($vol->is_host_file)->toBeTrue();
+ expect($vol->is_directory)->toBeFalse();
+
+ Bus::assertNotDispatched(ServerStorageSaveJob::class);
+ });
+
+ test('rejects file storage paths with parent segments', function () {
+ $app = createTestApplication($this);
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$this->bearerToken,
+ 'Content-Type' => 'application/json',
+ ])->postJson("/api/v1/applications/{$app->uuid}/storages", [
+ 'type' => 'file',
+ 'mount_path' => '/../../../../../../etc/example.conf',
+ 'content' => 'owned',
+ ]);
+
+ $response->assertStatus(422);
+ $response->assertJsonPath('message', 'Validation failed.');
+
+ expect(LocalFileVolume::where('resource_id', $app->id)
+ ->where('resource_type', get_class($app))
+ ->exists())->toBeFalse();
});
test('rejects persistent storage without name', function () {
@@ -331,6 +403,92 @@ function createTestDatabase($context): StandalonePostgresql
expect($vol)->not->toBeNull();
expect($vol->mount_path)->toBe('/extra');
});
+
+ test('creates a file storage for a database under the database configuration root', function () {
+ $db = createTestDatabase($this);
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$this->bearerToken,
+ 'Content-Type' => 'application/json',
+ ])->postJson("/api/v1/databases/{$db->uuid}/storages", [
+ 'type' => 'file',
+ 'mount_path' => '/postgres/postgresql.conf',
+ 'content' => 'listen_addresses = "*"',
+ ]);
+
+ $response->assertStatus(201);
+
+ $vol = LocalFileVolume::where('resource_id', $db->id)
+ ->where('resource_type', get_class($db))
+ ->first();
+
+ expect($vol)->not->toBeNull();
+ expect($vol->fs_path)->toBe(database_configuration_dir().'/'.$db->uuid.'/postgres/postgresql.conf');
+ });
+
+ test('rejects file storage paths with parent segments for a database', function () {
+ $db = createTestDatabase($this);
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$this->bearerToken,
+ 'Content-Type' => 'application/json',
+ ])->postJson("/api/v1/databases/{$db->uuid}/storages", [
+ 'type' => 'file',
+ 'mount_path' => '/postgres/../../../etc/shadow',
+ 'content' => 'owned',
+ ]);
+
+ $response->assertStatus(422);
+
+ expect(LocalFileVolume::where('resource_id', $db->id)
+ ->where('resource_type', get_class($db))
+ ->exists())->toBeFalse();
+ });
+});
+
+describe('POST /api/v1/services/{uuid}/storages', function () {
+ test('creates a file storage for a service resource under the service configuration root', function () {
+ [$service, $serviceApplication] = createTestServiceApplication($this);
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$this->bearerToken,
+ 'Content-Type' => 'application/json',
+ ])->postJson("/api/v1/services/{$service->uuid}/storages", [
+ 'type' => 'file',
+ 'resource_uuid' => $serviceApplication->uuid,
+ 'mount_path' => '/etc/nginx/nginx.conf',
+ 'content' => 'server {}',
+ ]);
+
+ $response->assertStatus(201);
+
+ $vol = LocalFileVolume::where('resource_id', $serviceApplication->id)
+ ->where('resource_type', get_class($serviceApplication))
+ ->first();
+
+ expect($vol)->not->toBeNull();
+ expect($vol->fs_path)->toBe(service_configuration_dir().'/'.$service->uuid.'/etc/nginx/nginx.conf');
+ });
+
+ test('rejects file storage paths with parent segments for a service resource', function () {
+ [$service, $serviceApplication] = createTestServiceApplication($this);
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$this->bearerToken,
+ 'Content-Type' => 'application/json',
+ ])->postJson("/api/v1/services/{$service->uuid}/storages", [
+ 'type' => 'file',
+ 'resource_uuid' => $serviceApplication->uuid,
+ 'mount_path' => '/../../../../../../root/.ssh/authorized_keys',
+ 'content' => 'owned',
+ ]);
+
+ $response->assertStatus(422);
+
+ expect(LocalFileVolume::where('resource_id', $serviceApplication->id)
+ ->where('resource_type', get_class($serviceApplication))
+ ->exists())->toBeFalse();
+ });
});
describe('PATCH /api/v1/databases/{uuid}/storages', function () {
diff --git a/tests/Unit/FileStorageSecurityTest.php b/tests/Unit/FileStorageSecurityTest.php
index 1e08ebbe7..b5e1c7404 100644
--- a/tests/Unit/FileStorageSecurityTest.php
+++ b/tests/Unit/FileStorageSecurityTest.php
@@ -141,3 +141,77 @@
expect(fn () => validateShellSafePath('./data', 'storage path'))
->not->toThrow(Exception::class);
});
+
+test('file mount path validator rejects parent segments and unsafe separators', function (string $path) {
+ expect(fn () => validateFileMountPath($path, 'file storage path'))
+ ->toThrow(Exception::class);
+})->with([
+ 'parent segment to etc' => ['/../../etc/passwd'],
+ 'embedded parent segment' => ['/foo/../bar'],
+ 'parent segment' => ['/..'],
+ 'double slash before parent segment' => ['/foo//../bar'],
+ 'current directory segment' => ['/foo/./bar'],
+ 'backslash parent segment' => ['\\..\\etc\\passwd'],
+ 'null byte' => ["/app/config\0/../../etc/passwd"],
+]);
+
+test('file mount path validator accepts safe absolute container file paths', function (string $path, string $expected) {
+ expect(validateFileMountPath($path, 'file storage path'))->toBe($expected);
+})->with([
+ 'nginx config' => ['/etc/nginx/nginx.conf', '/etc/nginx/nginx.conf'],
+ 'app env filename' => ['/app/.env', '/app/.env'],
+ 'relative input becomes absolute' => ['config/app.yaml', '/config/app.yaml'],
+ 'duplicate slashes collapse' => ['/opt//app///config.json', '/opt/app/config.json'],
+]);
+
+test('host file mount path validator accepts absolute host file paths', function () {
+ expect(validateHostFileMountPath('/etc/nginx/nginx.conf', 'host file path'))
+ ->toBe('/etc/nginx/nginx.conf');
+});
+
+test('host file mount path validator rejects ambiguous or directory paths', function (string $path) {
+ expect(fn () => validateHostFileMountPath($path, 'host file path'))
+ ->toThrow(Exception::class);
+})->with([
+ 'relative path' => ['etc/nginx/nginx.conf'],
+ 'root directory' => ['/'],
+ 'trailing slash' => ['/etc/nginx/'],
+ 'parent segment' => ['/etc/../shadow'],
+ 'current segment' => ['/etc/./nginx.conf'],
+ 'backslash' => ['\\etc\\nginx.conf'],
+]);
+
+test('confined path resolver keeps file mounts inside their resource configuration root', function () {
+ expect(confineFileMountPath('/data/coolify/applications/app-uuid', '/etc/nginx/nginx.conf', 'file storage path'))
+ ->toBe('/data/coolify/applications/app-uuid/etc/nginx/nginx.conf');
+
+ expect(confineFileMountPath('/data/coolify/databases/db-uuid/', 'postgres/postgresql.conf', 'file storage path'))
+ ->toBe('/data/coolify/databases/db-uuid/postgres/postgresql.conf');
+
+ expect(confineFileMountPath('/data/coolify/services/service-uuid', '/config.yaml', 'file storage path'))
+ ->toBe('/data/coolify/services/service-uuid/config.yaml');
+});
+
+test('confined path resolver rejects paths that escape the resource configuration root', function (string $base, string $path) {
+ expect(fn () => confineFileMountPath($base, $path, 'file storage path'))
+ ->toThrow(Exception::class);
+})->with([
+ 'application parent segment' => ['/data/coolify/applications/app-uuid', '/../../etc/passwd'],
+ 'database parent segment' => ['/data/coolify/databases/db-uuid', '/postgres/../../../etc/shadow'],
+ 'service dot segment' => ['/data/coolify/services/service-uuid', '/./config.yaml'],
+]);
+
+test('local file volume write sink keeps saved managed file paths for compatibility', function () {
+ $source = file_get_contents(__DIR__.'/../../app/Models/LocalFileVolume.php');
+
+ expect($source)->not->toContain('confinePathToBase($workdir, $path->value(), \'storage path\')')
+ ->and($source)->toContain('tee {$escapedPath}');
+});
+
+test('host file mounts are bind-only and skipped by server storage writes', function () {
+ $source = file_get_contents(__DIR__.'/../../app/Models/LocalFileVolume.php');
+
+ expect($source)->toContain('if ($this->is_host_file) {')
+ ->and($source)->toContain('return;')
+ ->and($source)->toContain('tee {$escapedPath}');
+});