Please copy this token now. For your security, it won't be shown
- again.
+
- @forelse ($tokens as $token)
-
-
Description: {{ $token->name }}
-
Last used: {{ $token->last_used_at ? $token->last_used_at->diffForHumans() : 'Never' }}
-
- @if ($token->abilities)
- Permissions:
- @foreach ($token->abilities as $ability)
-
{{ $ability }}
- @endforeach
+
+
+
Issued Tokens
+ @if ($tokens->count() > 1)
+
+
+ @forelse ($tokens as $token)
+
+
+
+ {{ $token->name }}
+ @if ($token->abilities)
+ @foreach ($token->abilities as $ability)
+
+ {{ $ability }}
+
+ @endforeach
+ @endif
+
+
+ Last used: {{ $token->last_used_at ? $token->last_used_at->diffForHumans() : 'Never' }}
+
+
+ @if (auth()->id() === $token->tokenable_id)
+
@endif
-
- @if (auth()->id() === $token->tokenable_id)
-
- @endif
-
- @empty
-
- @endforelse
+ @empty
+
No API tokens found.
+ @endforelse
+
@endif
diff --git a/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php b/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php
new file mode 100644
index 000000000..e30e2ad62
--- /dev/null
+++ b/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php
@@ -0,0 +1,274 @@
+ 0], ['is_api_enabled' => true]);
+
+ $this->team = Team::factory()->create();
+
+ $this->admin = User::factory()->create();
+ $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+ $this->member = User::factory()->create();
+ $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+ $keyId = DB::table('private_keys')->insertGetId([
+ 'uuid' => (string) Str::uuid(),
+ 'name' => 'Test Key',
+ 'private_key' => 'test-key',
+ 'team_id' => $this->team->id,
+ 'created_at' => now(),
+ 'updated_at' => now(),
+ ]);
+
+ $this->server = Server::factory()->create([
+ 'team_id' => $this->team->id,
+ 'private_key_id' => $keyId,
+ ]);
+
+ StandaloneDocker::withoutEvents(function () {
+ $this->destination = StandaloneDocker::firstOrCreate(
+ ['server_id' => $this->server->id, 'network' => 'coolify'],
+ ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+ );
+ });
+
+ $this->project = Project::create([
+ 'uuid' => (string) Str::uuid(),
+ 'name' => 'Test Project',
+ 'team_id' => $this->team->id,
+ ]);
+
+ $this->environment = $this->project->environments()->first();
+
+ $this->application = Application::factory()->create([
+ 'uuid' => (string) Str::uuid(),
+ 'name' => 'Test App',
+ 'environment_id' => $this->environment->id,
+ 'destination_id' => $this->destination->id,
+ 'destination_type' => $this->destination->getMorphClass(),
+ ]);
+
+ $this->unlockedEnv = EnvironmentVariable::create([
+ 'key' => 'UNLOCKED_VAR',
+ 'value' => 'secret-unlocked-value',
+ 'resourceable_type' => Application::class,
+ 'resourceable_id' => $this->application->id,
+ 'is_preview' => false,
+ 'is_shown_once' => false,
+ 'is_multiline' => false,
+ 'is_literal' => false,
+ 'is_runtime' => true,
+ 'is_buildtime' => true,
+ ]);
+
+ $this->lockedEnv = EnvironmentVariable::create([
+ 'key' => 'LOCKED_VAR',
+ 'value' => 'secret-locked-value',
+ 'resourceable_type' => Application::class,
+ 'resourceable_id' => $this->application->id,
+ 'is_preview' => false,
+ 'is_shown_once' => true,
+ 'is_multiline' => false,
+ 'is_literal' => false,
+ 'is_runtime' => true,
+ 'is_buildtime' => true,
+ ]);
+});
+
+// --- Livewire Show component: locked env values ---
+
+test('admin sees unlocked env value in Show component', function () {
+ $this->actingAs($this->admin);
+ session(['currentTeam' => $this->team]);
+
+ $component = Livewire::test(EnvironmentVariableShow::class, [
+ 'env' => $this->unlockedEnv,
+ 'type' => 'application',
+ ]);
+
+ expect($component->get('value'))->toBe('secret-unlocked-value');
+});
+
+test('admin cannot see locked env value in Show component', function () {
+ $this->actingAs($this->admin);
+ session(['currentTeam' => $this->team]);
+
+ $component = Livewire::test(EnvironmentVariableShow::class, [
+ 'env' => $this->lockedEnv,
+ 'type' => 'application',
+ ]);
+
+ expect($component->get('value'))->toBeNull();
+ expect($component->get('real_value'))->toBeNull();
+});
+
+test('member cannot see any env value in Show component', function () {
+ $this->actingAs($this->member);
+ session(['currentTeam' => $this->team]);
+
+ $component = Livewire::test(EnvironmentVariableShow::class, [
+ 'env' => $this->unlockedEnv,
+ 'type' => 'application',
+ ]);
+
+ expect($component->get('value'))->toBeNull();
+ expect($component->get('real_value'))->toBeNull();
+});
+
+test('member has isValueHidden flag set to true', function () {
+ $this->actingAs($this->member);
+ session(['currentTeam' => $this->team]);
+
+ $component = Livewire::test(EnvironmentVariableShow::class, [
+ 'env' => $this->unlockedEnv,
+ 'type' => 'application',
+ ]);
+
+ expect($component->get('isValueHidden'))->toBeTrue();
+});
+
+test('admin has isValueHidden flag set to false', function () {
+ $this->actingAs($this->admin);
+ session(['currentTeam' => $this->team]);
+
+ $component = Livewire::test(EnvironmentVariableShow::class, [
+ 'env' => $this->unlockedEnv,
+ 'type' => 'application',
+ ]);
+
+ expect($component->get('isValueHidden'))->toBeFalse();
+});
+
+// --- Livewire All component: dev view ---
+
+test('admin dev view shows unlocked env value', function () {
+ $this->actingAs($this->admin);
+ session(['currentTeam' => $this->team]);
+
+ $component = Livewire::test(EnvironmentVariableAll::class, [
+ 'resource' => $this->application,
+ ]);
+
+ expect($component->get('variables'))->toContain('UNLOCKED_VAR=secret-unlocked-value');
+});
+
+test('admin dev view hides locked env value', function () {
+ $this->actingAs($this->admin);
+ session(['currentTeam' => $this->team]);
+
+ $component = Livewire::test(EnvironmentVariableAll::class, [
+ 'resource' => $this->application,
+ ]);
+
+ expect($component->get('variables'))->toContain('LOCKED_VAR=(Locked Secret, delete and add again to change)');
+ expect($component->get('variables'))->not->toContain('secret-locked-value');
+});
+
+test('member dev view hides all env values', function () {
+ $this->actingAs($this->member);
+ session(['currentTeam' => $this->team]);
+
+ $component = Livewire::test(EnvironmentVariableAll::class, [
+ 'resource' => $this->application,
+ ]);
+
+ expect($component->get('variables'))->not->toContain('secret-unlocked-value');
+ expect($component->get('variables'))->not->toContain('secret-locked-value');
+ expect($component->get('variables'))->toContain('UNLOCKED_VAR=(Hidden');
+});
+
+// --- API: locked env values hidden ---
+
+test('API hides locked env value even with read:sensitive token', function () {
+ session(['currentTeam' => $this->team]);
+ $token = $this->admin->createToken('admin-sensitive', ['read', 'read:sensitive']);
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$token->plainTextToken,
+ ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
+ $response->assertOk();
+
+ $envs = collect($response->json());
+ $locked = $envs->firstWhere('key', 'LOCKED_VAR');
+ $unlocked = $envs->firstWhere('key', 'UNLOCKED_VAR');
+
+ expect($locked)->not->toBeNull();
+ expect($locked)->not->toHaveKey('value');
+ expect($locked)->not->toHaveKey('real_value');
+
+ expect($unlocked)->not->toBeNull();
+ expect($unlocked)->toHaveKey('value');
+});
+
+test('API hides locked env value with root token', function () {
+ session(['currentTeam' => $this->team]);
+ $token = $this->admin->createToken('admin-root', ['root']);
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$token->plainTextToken,
+ ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
+ $response->assertOk();
+
+ $envs = collect($response->json());
+ $locked = $envs->firstWhere('key', 'LOCKED_VAR');
+
+ expect($locked)->not->toBeNull();
+ expect($locked)->not->toHaveKey('value');
+ expect($locked)->not->toHaveKey('real_value');
+});
+
+// --- API: member role hides env values ---
+
+test('API hides env values for member even with read:sensitive token', function () {
+ session(['currentTeam' => $this->team]);
+ $token = $this->member->createToken('member-sensitive', ['read', 'read:sensitive']);
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$token->plainTextToken,
+ ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
+ $response->assertOk();
+
+ $envs = collect($response->json());
+ $unlocked = $envs->firstWhere('key', 'UNLOCKED_VAR');
+
+ expect($unlocked)->not->toBeNull();
+ expect($unlocked)->not->toHaveKey('value');
+ expect($unlocked)->not->toHaveKey('real_value');
+});
+
+test('API shows env values for admin with read:sensitive token', function () {
+ session(['currentTeam' => $this->team]);
+ $token = $this->admin->createToken('admin-sensitive-2', ['read', 'read:sensitive']);
+
+ $response = $this->withHeaders([
+ 'Authorization' => 'Bearer '.$token->plainTextToken,
+ ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
+ $response->assertOk();
+
+ $envs = collect($response->json());
+ $unlocked = $envs->firstWhere('key', 'UNLOCKED_VAR');
+
+ expect($unlocked)->not->toBeNull();
+ expect($unlocked)->toHaveKey('value');
+});
diff --git a/tests/Feature/Authorization/LegacyMemberTokenTest.php b/tests/Feature/Authorization/LegacyMemberTokenTest.php
new file mode 100644
index 000000000..273327985
--- /dev/null
+++ b/tests/Feature/Authorization/LegacyMemberTokenTest.php
@@ -0,0 +1,127 @@
+ 0, 'is_api_enabled' => true]);
+
+ $this->team = Team::factory()->create();
+ $this->member = User::factory()->create();
+ $this->admin = User::factory()->create();
+
+ $this->team->members()->attach($this->member->id, ['role' => 'member']);
+ $this->team->members()->attach($this->admin->id, ['role' => 'admin']);
+
+ session(['currentTeam' => $this->team]);
+});
+
+function apiRequest($test, string $token, string $method = 'get', string $url = '/api/v1/version')
+{
+ return $test->withHeaders([
+ 'Authorization' => 'Bearer '.$token,
+ 'Content-Type' => 'application/json',
+ ])->{$method.'Json'}($url);
+}
+
+describe('member with legacy elevated token is rejected', function () {
+ test('member with legacy write token gets 403 with descriptive message', function () {
+ $token = $this->member->createToken('legacy-write', ['read', 'write']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(403);
+ $response->assertJsonFragment([
+ 'message' => 'This API token has permissions (write) that exceed your current role as a team member. Members are restricted to read-only API access. Please revoke this token and create a new one with only read permissions.',
+ ]);
+ });
+
+ test('member with legacy deploy token gets 403', function () {
+ $token = $this->member->createToken('legacy-deploy', ['read', 'deploy']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(403);
+ $response->assertSee('deploy');
+ $response->assertSee('revoke this token');
+ });
+
+ test('member with legacy root token gets 403', function () {
+ $token = $this->member->createToken('legacy-root', ['root']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(403);
+ $response->assertSee('root');
+ });
+
+ test('member with legacy read:sensitive token gets 403', function () {
+ $token = $this->member->createToken('legacy-sensitive', ['read', 'read:sensitive']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(403);
+ $response->assertSee('read:sensitive');
+ });
+
+ test('member with legacy write:sensitive token gets 403', function () {
+ $token = $this->member->createToken('legacy-ws', ['read', 'write:sensitive']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(403);
+ $response->assertSee('write:sensitive');
+ });
+
+ test('member with multiple disallowed abilities lists them all', function () {
+ $token = $this->member->createToken('legacy-multi', ['read', 'write', 'deploy', 'read:sensitive']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(403);
+ $json = $response->json();
+ expect($json['message'])->toContain('write');
+ expect($json['message'])->toContain('deploy');
+ expect($json['message'])->toContain('read:sensitive');
+ });
+});
+
+describe('member with read-only token passes through', function () {
+ test('member with read token can access read endpoints', function () {
+ $token = $this->member->createToken('read-only', ['read']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(200);
+ });
+});
+
+describe('admin with elevated token passes through', function () {
+ test('admin with write token is not blocked', function () {
+ $token = $this->admin->createToken('admin-write', ['read', 'write']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(200);
+ });
+
+ test('admin with root token is not blocked', function () {
+ $token = $this->admin->createToken('admin-root', ['root']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(200);
+ });
+
+ test('admin with deploy token is not blocked', function () {
+ $token = $this->admin->createToken('admin-deploy', ['read', 'deploy']);
+
+ $response = apiRequest($this, $token->plainTextToken);
+
+ $response->assertStatus(200);
+ });
+});
diff --git a/tests/Unit/Policies/ApiTokenPolicyTest.php b/tests/Unit/Policies/ApiTokenPolicyTest.php
index 98b59319a..98c60aae8 100644
--- a/tests/Unit/Policies/ApiTokenPolicyTest.php
+++ b/tests/Unit/Policies/ApiTokenPolicyTest.php
@@ -165,3 +165,29 @@
$policy = new ApiTokenPolicy;
expect($policy->useDeployPermissions($user))->toBeFalse();
});
+
+it('allows admin to use sensitive permissions', function () {
+ $user = Mockery::mock(User::class)->makePartial();
+ $user->shouldReceive('isAdmin')->andReturn(true);
+
+ $policy = new ApiTokenPolicy;
+ expect($policy->useSensitivePermissions($user))->toBeTrue();
+});
+
+it('allows owner to use sensitive permissions', function () {
+ $user = Mockery::mock(User::class)->makePartial();
+ $user->shouldReceive('isAdmin')->andReturn(false);
+ $user->shouldReceive('isOwner')->andReturn(true);
+
+ $policy = new ApiTokenPolicy;
+ expect($policy->useSensitivePermissions($user))->toBeTrue();
+});
+
+it('denies member from using sensitive permissions', function () {
+ $user = Mockery::mock(User::class)->makePartial();
+ $user->shouldReceive('isAdmin')->andReturn(false);
+ $user->shouldReceive('isOwner')->andReturn(false);
+
+ $policy = new ApiTokenPolicy;
+ expect($policy->useSensitivePermissions($user))->toBeFalse();
+});
diff --git a/tests/Unit/Policies/S3StoragePolicyTest.php b/tests/Unit/Policies/S3StoragePolicyTest.php
index 4ea580d0f..70ffdf718 100644
--- a/tests/Unit/Policies/S3StoragePolicyTest.php
+++ b/tests/Unit/Policies/S3StoragePolicyTest.php
@@ -52,7 +52,23 @@
expect($policy->update($user, $storage))->toBeTrue();
});
-it('denies team member to update S3 storage from another team', function () {
+it('denies team member to update S3 storage from their team', function () {
+ $teams = collect([
+ (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+ ]);
+
+ $user = Mockery::mock(User::class)->makePartial();
+ $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+ $storage = Mockery::mock(S3Storage::class)->makePartial();
+ $storage->shouldReceive('getAttribute')->with('team_id')->andReturn(1);
+ $storage->team_id = 1;
+
+ $policy = new S3StoragePolicy;
+ expect($policy->update($user, $storage))->toBeFalse();
+});
+
+it('denies team admin to update S3 storage from another team', function () {
$teams = collect([
(object) ['id' => 1, 'pivot' => (object) ['role' => 'admin']],
]);
@@ -68,9 +84,9 @@
expect($policy->update($user, $storage))->toBeFalse();
});
-it('allows team member to delete S3 storage from their team', function () {
+it('allows team admin to delete S3 storage from their team', function () {
$teams = collect([
- (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+ (object) ['id' => 1, 'pivot' => (object) ['role' => 'admin']],
]);
$user = Mockery::mock(User::class)->makePartial();
@@ -84,7 +100,23 @@
expect($policy->delete($user, $storage))->toBeTrue();
});
-it('denies team member to delete S3 storage from another team', function () {
+it('denies team member to delete S3 storage from their team', function () {
+ $teams = collect([
+ (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+ ]);
+
+ $user = Mockery::mock(User::class)->makePartial();
+ $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+ $storage = Mockery::mock(S3Storage::class)->makePartial();
+ $storage->shouldReceive('getAttribute')->with('team_id')->andReturn(1);
+ $storage->team_id = 1;
+
+ $policy = new S3StoragePolicy;
+ expect($policy->delete($user, $storage))->toBeFalse();
+});
+
+it('denies team admin to delete S3 storage from another team', function () {
$teams = collect([
(object) ['id' => 1, 'pivot' => (object) ['role' => 'owner']],
]);
@@ -116,9 +148,9 @@
expect($policy->create($user))->toBeFalse();
});
-it('allows team member to validate connection of S3 storage from their team', function () {
+it('allows team admin to validate connection of S3 storage from their team', function () {
$teams = collect([
- (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+ (object) ['id' => 1, 'pivot' => (object) ['role' => 'admin']],
]);
$user = Mockery::mock(User::class)->makePartial();
@@ -132,7 +164,23 @@
expect($policy->validateConnection($user, $storage))->toBeTrue();
});
-it('denies team member to validate connection of S3 storage from another team', function () {
+it('denies team member to validate connection of S3 storage from their team', function () {
+ $teams = collect([
+ (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+ ]);
+
+ $user = Mockery::mock(User::class)->makePartial();
+ $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+ $storage = Mockery::mock(S3Storage::class)->makePartial();
+ $storage->shouldReceive('getAttribute')->with('team_id')->andReturn(1);
+ $storage->team_id = 1;
+
+ $policy = new S3StoragePolicy;
+ expect($policy->validateConnection($user, $storage))->toBeFalse();
+});
+
+it('denies team admin to validate connection of S3 storage from another team', function () {
$teams = collect([
(object) ['id' => 1, 'pivot' => (object) ['role' => 'admin']],
]);