Andras Bacsai
913d033c75
fix(resources): clarify build server hosting restrictions ( #10961 )
2026-07-16 21:35:23 +02:00
Andras Bacsai
062ad57740
fix(security): enforce team access on mutable actions
...
Authorize cloud provider token access, audit sensitive operations, and
standardize public IDs across deployment and resource flows.
2026-06-04 11:03:06 +02:00
Andras Bacsai
43f33d94ad
Merge remote-tracking branch 'origin/next' into audit-policies
...
# Conflicts:
# app/Http/Controllers/Api/SecurityController.php
# app/Http/Controllers/Api/ServersController.php
# app/Livewire/Admin/Index.php
# app/Livewire/Destination/Show.php
# app/Livewire/NavbarDeleteTeam.php
# app/Livewire/Project/Application/Previews.php
# app/Livewire/Project/DeleteProject.php
# app/Livewire/Project/Shared/ResourceOperations.php
# app/Livewire/Server/Resources.php
# app/Livewire/Server/ValidateAndInstall.php
# app/Livewire/Storage/Show.php
# resources/views/livewire/dashboard.blade.php
# resources/views/livewire/project/application/heading.blade.php
# resources/views/livewire/project/database/heading.blade.php
# resources/views/livewire/project/service/heading.blade.php
# resources/views/livewire/project/shared/environment-variable/show.blade.php
# resources/views/livewire/project/shared/scheduled-task/show.blade.php
# tests/Feature/Security/TrustHostsMiddlewareTest.php
2026-04-19 15:19:37 +02:00
Andras Bacsai
a478ac66eb
refactor: scope destination and resource lookups by current team
...
Use find_destination_for_current_team helper across resource creation
flows and the destination controller. Pass full destination objects to
database creation helpers instead of UUIDs so team relationships are
resolved consistently before the resource is created or linked.
Add feature tests covering destination, backup storage, and resource
proof lookups across teams.
2026-04-19 11:55:12 +02:00
Andras Bacsai
1a603a10ed
fix(models): replace forceFill/forceCreate with fill/create and add fillable guards
...
Replace all uses of `forceFill`, `forceCreate`, and `forceFill` with their
non-force equivalents across models, actions, controllers, and Livewire
components. Add explicit `$fillable` arrays to all affected Eloquent models
to enforce mass assignment protection.
Add ModelFillableCreationTest and ModelFillableRegressionTest to verify that
model creation respects fillable constraints and prevent regressions.
2026-03-31 13:45:31 +02:00
Andras Bacsai
4ec9b7ef69
fix(clone): include uuid field when cloning persistent volumes
...
Ensure that the uuid field is preserved during clone operations for persistent
volumes across all clone methods (CloneMe, ResourceOperations, and the clone_application
helper). This prevents UUID conflicts and ensures cloned volumes receive new unique
identifiers as intended.
Adds test coverage validating that cloned persistent volumes receive new UUIDs
distinct from the original volumes.
2026-03-30 00:06:45 +02:00
Andras Bacsai
67a4fcc2ab
fix: add mass assignment protection to models
...
Replace $guarded = [] with explicit $fillable whitelists across all
models. Update controllers to use request->only($allowedFields) when
assigning request data. Switch Livewire components to forceFill() for
explicit mass assignment. Add integration tests for mass assignment
protection.
2026-03-28 12:32:57 +01:00
Andras Bacsai
86b05b902a
fix(auth): enforce authorization checks across API and Livewire components
...
- Add authorization checks to API controller endpoints (view, create, update, delete)
- Wrap Livewire component methods with try-catch for consistent error handling
- Add AuthorizesRequests trait to components requiring authorization checks
- Ensure all sensitive operations verify user permissions before execution
- Implement unified error handling with handleError() helper function
2026-02-25 14:20:29 +01:00
Andras Bacsai
1759a1631c
chore: prepare for PR
2026-02-25 11:18:46 +01:00
Andras Bacsai
5e8d11f732
refactor: replace queries with cached versions for performance improvements
2025-12-08 13:39:33 +01:00
Andras Bacsai
e74da06465
refactor(clone): consolidate application cloning logic into a dedicated function for improved maintainability and readability
2025-09-11 10:38:08 +02:00
Andras Bacsai
2e85ce0e0e
refactor(urls): replace generateFqdn with generateUrl for consistent URL generation across applications
2025-08-28 09:49:58 +02:00
Andras Bacsai
40f108d6e1
feat(auth): implement authorization checks for application management
2025-08-22 16:47:59 +02:00
Andras Bacsai
e8892b3d29
feat(core): finally fqdn is fqdn and url is url. haha
2025-08-12 10:06:19 +02:00
peaklabs-dev
279edf696c
chore(docker): remove unused arguments on StopService
2025-08-04 22:12:56 +02:00
Andras Bacsai
581151bb11
refactor(resource-operations): filter out build servers from the server list and clean up commented-out code in the resource operations view
2025-06-13 16:49:27 +02:00
peaklabs-dev
43dacd83c9
chore: use the new job dispatch
2025-01-13 11:13:35 +01:00
peaklabs-dev
34873b2c59
feat: volume cloning for ResourceOperations
2025-01-09 14:13:09 +01:00
peaklabs-dev
249e39ea71
fix: implement all the cloneMe changes for ResourceOperations as well
2025-01-08 17:26:59 +01:00
peaklabs-dev
fc1963f642
chore: remove unused computed fields
2025-01-08 17:08:36 +01:00
peaklabs-dev
91e1220912
fix: service cloning on a separate server
...
- To be able to clone a service to a new server we need to set the server_id as well, otherwise it will be cloned on the same server.
2025-01-07 19:26:25 +01:00
peaklabs-dev
d53065967e
fix: exclude system and computed fields from model replication
...
- Remove auto-generated properties (`id`, `created_at` and `updated_at` ) from replicate
- Exclude computed count properties (`additional_servers_count`, `additional_networks_count`) loaded by global scope to prevent errors
2025-01-07 17:18:04 +01:00
Andras Bacsai
1fe4dd722b
Revert "rector: arrrrr"
...
This reverts commit 16c0cd10d8
2025-01-07 15:31:43 +01:00
Andras Bacsai
16c0cd10d8
rector: arrrrr
2025-01-07 14:52:08 +01:00
Andras Bacsai
bf9d89f279
Merge branch 'next' into fix-environement-route
2024-12-17 12:17:50 +01:00
Andras Bacsai
2a9d499251
feat: migrate env variables to polymorphic relationship
...
fix: proxy status query ui
2024-12-17 10:38:42 +01:00
Andras Bacsai
2565deba4f
fix: resource clone name + volume name generation
2024-12-16 10:25:56 +01:00
peaklabs-dev
277fd78769
new uuid routes
2024-11-22 16:03:20 +01:00
Lucas Michot
8e1444eaa7
Get rid of many useless blank lines
2024-10-31 17:44:01 +01:00
Lucas Michot
c5403b0b3f
Always prefer ::class notation
2024-10-28 14:56:13 +01:00
andrasbacsai
96c4f5b8da
Fix styling
2024-07-25 11:31:59 +00:00
Andras Bacsai
6a4aa492c0
fix: random generated uuid will be full length (not 7 characters)
2024-07-25 13:31:01 +02:00
andrasbacsai
47051127af
Fix styling
2024-06-11 09:36:42 +00:00
Andras Bacsai
7ad2e1ca05
Merge branch 'next' into php-codestyle
2024-06-11 11:36:07 +02:00
Andras Bacsai
7345ccbbee
feat: easily redirect between www-and-non-www domains
2024-06-11 11:32:08 +02:00
Thijmen
d86274cc37
Fix styling
2024-06-10 20:43:34 +00:00
Andras Bacsai
c6844ff47a
Add keydb, dragonfly and clickhouse
2024-04-10 15:00:46 +02:00
Andras Bacsai
34d6a12d95
feat: experimental caddy support
2024-03-11 15:08:05 +01:00
Andras Bacsai
628fec6904
fix: sentry error
2024-01-31 14:22:48 +01:00
Andras Bacsai
1cef233db2
fix: regenerate labels on application clone
2024-01-31 09:03:54 +01:00
Andras Bacsai
abcc004953
feat: clone any resource
2024-01-22 16:08:18 +01:00
