6871160623
Expose GitHub app secrets and file storage content only when the request has sensitive read access. Hide LocalFileVolume content by default and resolve application UUIDs from route parameters.
471 lines
17 KiB
PHP
471 lines
17 KiB
PHP
<?php
|
|
|
|
use App\Models\Application;
|
|
use App\Models\Environment;
|
|
use App\Models\InstanceSettings;
|
|
use App\Models\LocalFileVolume;
|
|
use App\Models\LocalPersistentVolume;
|
|
use App\Models\Project;
|
|
use App\Models\Server;
|
|
use App\Models\StandaloneDocker;
|
|
use App\Models\StandalonePostgresql;
|
|
use App\Models\Team;
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\Bus;
|
|
use Illuminate\Support\Str;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
beforeEach(function () {
|
|
config()->set('app.maintenance.driver', 'file');
|
|
config()->set('cache.default', 'array');
|
|
|
|
Bus::fake();
|
|
InstanceSettings::query()->delete();
|
|
$settings = new InstanceSettings;
|
|
$settings->id = 0;
|
|
$settings->save();
|
|
|
|
$this->team = Team::factory()->create();
|
|
$this->user = User::factory()->create();
|
|
$this->team->members()->attach($this->user->id, ['role' => 'owner']);
|
|
|
|
$plainTextToken = Str::random(40);
|
|
$token = $this->user->tokens()->create([
|
|
'name' => 'test-token',
|
|
'token' => hash('sha256', $plainTextToken),
|
|
'abilities' => ['*'],
|
|
'team_id' => $this->team->id,
|
|
]);
|
|
$this->bearerToken = $token->getKey().'|'.$plainTextToken;
|
|
|
|
$this->server = Server::factory()->create(['team_id' => $this->team->id]);
|
|
$this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
|
|
$this->project = Project::factory()->create(['team_id' => $this->team->id]);
|
|
$this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
|
|
});
|
|
|
|
function createTestApplication($context): Application
|
|
{
|
|
return Application::create([
|
|
'name' => 'test-storage-app',
|
|
'git_repository' => 'https://github.com/test/test',
|
|
'git_branch' => 'main',
|
|
'build_pack' => 'nixpacks',
|
|
'ports_exposes' => '3000',
|
|
'environment_id' => $context->environment->id,
|
|
'destination_id' => $context->destination->id,
|
|
'destination_type' => $context->destination->getMorphClass(),
|
|
]);
|
|
}
|
|
|
|
function createTestDatabase($context): StandalonePostgresql
|
|
{
|
|
return StandalonePostgresql::create([
|
|
'name' => 'test-postgres',
|
|
'image' => 'postgres:15-alpine',
|
|
'postgres_user' => 'postgres',
|
|
'postgres_password' => 'password',
|
|
'postgres_db' => 'postgres',
|
|
'environment_id' => $context->environment->id,
|
|
'destination_id' => $context->destination->id,
|
|
'destination_type' => $context->destination->getMorphClass(),
|
|
]);
|
|
}
|
|
|
|
function createStorageApiToken($context, array $abilities): string
|
|
{
|
|
$plainTextToken = Str::random(40);
|
|
$token = $context->user->tokens()->create([
|
|
'name' => 'storage-test-token',
|
|
'token' => hash('sha256', $plainTextToken),
|
|
'abilities' => $abilities,
|
|
'team_id' => $context->team->id,
|
|
]);
|
|
|
|
return $token->getKey().'|'.$plainTextToken;
|
|
}
|
|
|
|
// ──────────────────────────────────────────────────────────────
|
|
// Application Storage Endpoints
|
|
// ──────────────────────────────────────────────────────────────
|
|
|
|
describe('GET /api/v1/applications/{uuid}/storages', function () {
|
|
test('lists storages for an application', function () {
|
|
$app = createTestApplication($this);
|
|
|
|
LocalPersistentVolume::create([
|
|
'name' => $app->uuid.'-test-vol',
|
|
'mount_path' => '/data',
|
|
'resource_id' => $app->id,
|
|
'resource_type' => $app->getMorphClass(),
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
])->getJson("/api/v1/applications/{$app->uuid}/storages");
|
|
|
|
$response->assertStatus(200);
|
|
$response->assertJsonCount(1, 'persistent_storages');
|
|
$response->assertJsonCount(0, 'file_storages');
|
|
});
|
|
|
|
test('returns 404 for non-existent application', function () {
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
])->getJson('/api/v1/applications/non-existent-uuid/storages');
|
|
|
|
$response->assertStatus(404);
|
|
});
|
|
|
|
test('hides file storage content for read tokens and reveals it for sensitive tokens', function () {
|
|
$app = createTestApplication($this);
|
|
|
|
LocalFileVolume::create([
|
|
'fs_path' => '/tmp/config.json',
|
|
'mount_path' => '/app/config.json',
|
|
'content' => '{"secret": "hidden"}',
|
|
'is_directory' => false,
|
|
'resource_id' => $app->id,
|
|
'resource_type' => $app->getMorphClass(),
|
|
]);
|
|
|
|
$readToken = createStorageApiToken($this, ['read']);
|
|
$sensitiveToken = createStorageApiToken($this, ['read', 'read:sensitive']);
|
|
|
|
$readResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$readToken,
|
|
])->getJson("/api/v1/applications/{$app->uuid}/storages");
|
|
|
|
auth()->forgetGuards();
|
|
|
|
$sensitiveResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$sensitiveToken,
|
|
])->getJson("/api/v1/applications/{$app->uuid}/storages");
|
|
|
|
$readResponse->assertSuccessful();
|
|
$sensitiveResponse->assertSuccessful();
|
|
|
|
expect($readResponse->getContent())->not->toContain('"content":')
|
|
->and($sensitiveResponse->getContent())->toContain('"content":')
|
|
->and($sensitiveResponse->getContent())->toContain('hidden');
|
|
});
|
|
});
|
|
|
|
describe('POST /api/v1/applications/{uuid}/storages', function () {
|
|
test('creates a persistent storage', function () {
|
|
$app = createTestApplication($this);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson("/api/v1/applications/{$app->uuid}/storages", [
|
|
'type' => 'persistent',
|
|
'name' => 'my-volume',
|
|
'mount_path' => '/data',
|
|
]);
|
|
|
|
$response->assertStatus(201);
|
|
|
|
$vol = LocalPersistentVolume::where('resource_id', $app->id)
|
|
->where('resource_type', $app->getMorphClass())
|
|
->first();
|
|
|
|
expect($vol)->not->toBeNull();
|
|
expect($vol->name)->toBe($app->uuid.'-my-volume');
|
|
expect($vol->mount_path)->toBe('/data');
|
|
expect($vol->uuid)->not->toBeNull();
|
|
});
|
|
|
|
test('creates a file storage', function () {
|
|
$app = createTestApplication($this);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson("/api/v1/applications/{$app->uuid}/storages", [
|
|
'type' => 'file',
|
|
'mount_path' => '/app/config.json',
|
|
'content' => '{"key": "value"}',
|
|
]);
|
|
|
|
$response->assertStatus(201);
|
|
|
|
$vol = LocalFileVolume::where('resource_id', $app->id)
|
|
->where('resource_type', get_class($app))
|
|
->first();
|
|
|
|
expect($vol)->not->toBeNull();
|
|
expect($vol->mount_path)->toBe('/app/config.json');
|
|
expect($vol->is_directory)->toBeFalse();
|
|
});
|
|
|
|
test('hides created file storage content for write tokens and reveals it for sensitive tokens', function () {
|
|
$app = createTestApplication($this);
|
|
$writeToken = createStorageApiToken($this, ['write']);
|
|
$sensitiveToken = createStorageApiToken($this, ['write', 'read:sensitive']);
|
|
|
|
$writeResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$writeToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson("/api/v1/applications/{$app->uuid}/storages", [
|
|
'type' => 'file',
|
|
'mount_path' => '/app/hidden.json',
|
|
'content' => '{"secret": "write-hidden"}',
|
|
]);
|
|
|
|
auth()->forgetGuards();
|
|
|
|
$sensitiveResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$sensitiveToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson("/api/v1/applications/{$app->uuid}/storages", [
|
|
'type' => 'file',
|
|
'mount_path' => '/app/visible.json',
|
|
'content' => '{"secret": "write-visible"}',
|
|
]);
|
|
|
|
$writeResponse->assertCreated();
|
|
$sensitiveResponse->assertCreated();
|
|
|
|
expect($writeResponse->getContent())->not->toContain('"content":')
|
|
->and($sensitiveResponse->getContent())->toContain('"content":')
|
|
->and($sensitiveResponse->getContent())->toContain('write-visible');
|
|
});
|
|
|
|
test('rejects persistent storage without name', function () {
|
|
$app = createTestApplication($this);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson("/api/v1/applications/{$app->uuid}/storages", [
|
|
'type' => 'persistent',
|
|
'mount_path' => '/data',
|
|
]);
|
|
|
|
$response->assertStatus(422);
|
|
});
|
|
|
|
test('rejects invalid type-specific fields', function () {
|
|
$app = createTestApplication($this);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson("/api/v1/applications/{$app->uuid}/storages", [
|
|
'type' => 'persistent',
|
|
'name' => 'vol',
|
|
'mount_path' => '/data',
|
|
'content' => 'should not be here',
|
|
]);
|
|
|
|
$response->assertStatus(422);
|
|
});
|
|
});
|
|
|
|
describe('PATCH /api/v1/applications/{uuid}/storages', function () {
|
|
test('updates a persistent storage by uuid', function () {
|
|
$app = createTestApplication($this);
|
|
|
|
$vol = LocalPersistentVolume::create([
|
|
'name' => $app->uuid.'-test-vol',
|
|
'mount_path' => '/data',
|
|
'resource_id' => $app->id,
|
|
'resource_type' => $app->getMorphClass(),
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->patchJson("/api/v1/applications/{$app->uuid}/storages", [
|
|
'uuid' => $vol->uuid,
|
|
'type' => 'persistent',
|
|
'mount_path' => '/new-data',
|
|
]);
|
|
|
|
$response->assertStatus(200);
|
|
expect($vol->fresh()->mount_path)->toBe('/new-data');
|
|
});
|
|
|
|
test('updates a persistent storage by id (backwards compat)', function () {
|
|
$app = createTestApplication($this);
|
|
|
|
$vol = LocalPersistentVolume::create([
|
|
'name' => $app->uuid.'-test-vol',
|
|
'mount_path' => '/data',
|
|
'resource_id' => $app->id,
|
|
'resource_type' => $app->getMorphClass(),
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->patchJson("/api/v1/applications/{$app->uuid}/storages", [
|
|
'id' => $vol->id,
|
|
'type' => 'persistent',
|
|
'mount_path' => '/updated',
|
|
]);
|
|
|
|
$response->assertStatus(200);
|
|
expect($vol->fresh()->mount_path)->toBe('/updated');
|
|
});
|
|
|
|
test('returns 422 when neither uuid nor id is provided', function () {
|
|
$app = createTestApplication($this);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->patchJson("/api/v1/applications/{$app->uuid}/storages", [
|
|
'type' => 'persistent',
|
|
'mount_path' => '/data',
|
|
]);
|
|
|
|
$response->assertStatus(422);
|
|
});
|
|
});
|
|
|
|
describe('DELETE /api/v1/applications/{uuid}/storages/{storage_uuid}', function () {
|
|
test('deletes a persistent storage', function () {
|
|
$app = createTestApplication($this);
|
|
|
|
$vol = LocalPersistentVolume::create([
|
|
'name' => $app->uuid.'-test-vol',
|
|
'mount_path' => '/data',
|
|
'resource_id' => $app->id,
|
|
'resource_type' => $app->getMorphClass(),
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
])->deleteJson("/api/v1/applications/{$app->uuid}/storages/{$vol->uuid}");
|
|
|
|
$response->assertStatus(200);
|
|
$response->assertJson(['message' => 'Storage deleted.']);
|
|
expect(LocalPersistentVolume::find($vol->id))->toBeNull();
|
|
});
|
|
|
|
test('finds file storage without type param and calls deleteStorageOnServer', function () {
|
|
$app = createTestApplication($this);
|
|
|
|
$vol = LocalFileVolume::create([
|
|
'fs_path' => '/tmp/test',
|
|
'mount_path' => '/app/config.json',
|
|
'content' => '{}',
|
|
'is_directory' => false,
|
|
'resource_id' => $app->id,
|
|
'resource_type' => get_class($app),
|
|
]);
|
|
|
|
// Verify the storage is found via fileStorages (not persistentStorages)
|
|
$freshApp = Application::find($app->id);
|
|
expect($freshApp->persistentStorages->where('uuid', $vol->uuid)->first())->toBeNull();
|
|
expect($freshApp->fileStorages->where('uuid', $vol->uuid)->first())->not->toBeNull();
|
|
expect($vol)->toBeInstanceOf(LocalFileVolume::class);
|
|
});
|
|
|
|
test('returns 404 for non-existent storage', function () {
|
|
$app = createTestApplication($this);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
])->deleteJson("/api/v1/applications/{$app->uuid}/storages/non-existent");
|
|
|
|
$response->assertStatus(404);
|
|
});
|
|
});
|
|
|
|
// ──────────────────────────────────────────────────────────────
|
|
// Database Storage Endpoints
|
|
// ──────────────────────────────────────────────────────────────
|
|
|
|
describe('GET /api/v1/databases/{uuid}/storages', function () {
|
|
test('lists storages for a database', function () {
|
|
$db = createTestDatabase($this);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
])->getJson("/api/v1/databases/{$db->uuid}/storages");
|
|
|
|
$response->assertStatus(200);
|
|
$response->assertJsonStructure(['persistent_storages', 'file_storages']);
|
|
// Database auto-creates a default persistent volume
|
|
$response->assertJsonCount(1, 'persistent_storages');
|
|
});
|
|
|
|
test('returns 404 for non-existent database', function () {
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
])->getJson('/api/v1/databases/non-existent-uuid/storages');
|
|
|
|
$response->assertStatus(404);
|
|
});
|
|
});
|
|
|
|
describe('POST /api/v1/databases/{uuid}/storages', function () {
|
|
test('creates a persistent storage for a database', function () {
|
|
$db = createTestDatabase($this);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson("/api/v1/databases/{$db->uuid}/storages", [
|
|
'type' => 'persistent',
|
|
'name' => 'extra-data',
|
|
'mount_path' => '/extra',
|
|
]);
|
|
|
|
$response->assertStatus(201);
|
|
|
|
$vol = LocalPersistentVolume::where('name', $db->uuid.'-extra-data')->first();
|
|
expect($vol)->not->toBeNull();
|
|
expect($vol->mount_path)->toBe('/extra');
|
|
});
|
|
});
|
|
|
|
describe('PATCH /api/v1/databases/{uuid}/storages', function () {
|
|
test('updates a persistent storage by uuid', function () {
|
|
$db = createTestDatabase($this);
|
|
|
|
$vol = LocalPersistentVolume::create([
|
|
'name' => $db->uuid.'-test-vol',
|
|
'mount_path' => '/data',
|
|
'resource_id' => $db->id,
|
|
'resource_type' => $db->getMorphClass(),
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->patchJson("/api/v1/databases/{$db->uuid}/storages", [
|
|
'uuid' => $vol->uuid,
|
|
'type' => 'persistent',
|
|
'mount_path' => '/updated',
|
|
]);
|
|
|
|
$response->assertStatus(200);
|
|
expect($vol->fresh()->mount_path)->toBe('/updated');
|
|
});
|
|
});
|
|
|
|
describe('DELETE /api/v1/databases/{uuid}/storages/{storage_uuid}', function () {
|
|
test('deletes a persistent storage', function () {
|
|
$db = createTestDatabase($this);
|
|
|
|
$vol = LocalPersistentVolume::create([
|
|
'name' => $db->uuid.'-test-vol',
|
|
'mount_path' => '/extra',
|
|
'resource_id' => $db->id,
|
|
'resource_type' => $db->getMorphClass(),
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
])->deleteJson("/api/v1/databases/{$db->uuid}/storages/{$vol->uuid}");
|
|
|
|
$response->assertStatus(200);
|
|
expect(LocalPersistentVolume::find($vol->id))->toBeNull();
|
|
});
|
|
});
|