Merge remote-tracking branch 'origin/next' into audit-policies

app/Models/Application.php

@@ -39,7 +39,7 @@ use Visus\Cuid2\Cuid2;
         'git_full_url' => ['type' => 'string', 'nullable' => true, 'description' => 'Git full URL.'],
         'docker_registry_image_name' => ['type' => 'string', 'nullable' => true, 'description' => 'Docker registry image name.'],
         'docker_registry_image_tag' => ['type' => 'string', 'nullable' => true, 'description' => 'Docker registry image tag.'],
-        'build_pack' => ['type' => 'string', 'description' => 'Build pack.', 'enum' => ['nixpacks', 'static', 'dockerfile', 'dockercompose']],
+        'build_pack' => ['type' => 'string', 'description' => 'Build pack.', 'enum' => ['nixpacks', 'railpack', 'static', 'dockerfile', 'dockercompose']],
         'static_image' => ['type' => 'string', 'description' => 'Static image used when static site is deployed.'],
         'install_command' => ['type' => 'string', 'description' => 'Install command.'],
         'build_command' => ['type' => 'string', 'description' => 'Build command.'],
@@ -960,7 +960,7 @@ class Application extends BaseModel
     {
         return $this->morphMany(EnvironmentVariable::class, 'resourceable')
             ->where('is_preview', false)
-            ->where('key', 'not like', 'NIXPACKS_%');
+            ->withoutBuildpackControlVariables();
     }
 
     public function nixpacks_environment_variables()
@@ -970,6 +970,13 @@ class Application extends BaseModel
             ->where('key', 'like', 'NIXPACKS_%');
     }
 
+    public function railpack_environment_variables()
+    {
+        return $this->morphMany(EnvironmentVariable::class, 'resourceable')
+            ->where('is_preview', false)
+            ->where('key', 'like', 'RAILPACK_%');
+    }
+
     public function environment_variables_preview()
     {
         return $this->morphMany(EnvironmentVariable::class, 'resourceable')
@@ -988,7 +995,7 @@ class Application extends BaseModel
     {
         return $this->morphMany(EnvironmentVariable::class, 'resourceable')
             ->where('is_preview', true)
-            ->where('key', 'not like', 'NIXPACKS_%');
+            ->withoutBuildpackControlVariables();
     }
 
     public function nixpacks_environment_variables_preview()
@@ -998,6 +1005,13 @@ class Application extends BaseModel
             ->where('key', 'like', 'NIXPACKS_%');
     }
 
+    public function railpack_environment_variables_preview()
+    {
+        return $this->morphMany(EnvironmentVariable::class, 'resourceable')
+            ->where('is_preview', true)
+            ->where('key', 'like', 'RAILPACK_%');
+    }
+
     public function scheduled_tasks(): HasMany
     {
         return $this->hasMany(ScheduledTask::class)->orderBy('name', 'asc');
@@ -1117,7 +1131,7 @@ class Application extends BaseModel
 
     public function could_set_build_commands(): bool
     {
-        if ($this->build_pack === 'nixpacks') {
+        if ($this->build_pack === 'nixpacks' || $this->build_pack === 'railpack') {
             return true;
         }
 

app/Models/ApplicationPreview.php

@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Support\ValidationPatterns;
 use Illuminate\Database\Eloquent\SoftDeletes;
 use Spatie\Url\Url;
 use Visus\Cuid2\Cuid2;
@@ -42,11 +43,18 @@ class ApplicationPreview extends BaseModel
                 $networkKeys = collect($networks)->keys();
                 $volumeKeys = collect($volumes)->keys();
                 $volumeKeys->each(function ($key) use ($server) {
-                    instant_remote_process(["docker volume rm -f $key"], $server, false);
+                    if (! preg_match(ValidationPatterns::VOLUME_NAME_PATTERN, $key)) {
+                        return;
+                    }
+                    instant_remote_process(['docker volume rm -f '.escapeshellarg($key)], $server, false);
                 });
                 $networkKeys->each(function ($key) use ($server) {
-                    instant_remote_process(["docker network disconnect $key coolify-proxy"], $server, false);
-                    instant_remote_process(["docker network rm $key"], $server, false);
+                    if (! preg_match(ValidationPatterns::DOCKER_NETWORK_PATTERN, $key)) {
+                        return;
+                    }
+                    $k = escapeshellarg($key);
+                    instant_remote_process(["docker network disconnect {$k} coolify-proxy"], $server, false);
+                    instant_remote_process(["docker network rm {$k}"], $server, false);
                 });
             } else {
                 // Regular application volume cleanup

app/Models/EnvironmentVariable.php

@@ -3,6 +3,8 @@
 namespace App\Models;
 
 use App\Models\EnvironmentVariable as ModelsEnvironmentVariable;
+use App\Support\ValidationPatterns;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use OpenApi\Attributes as OA;
 
@@ -32,6 +34,8 @@ use OpenApi\Attributes as OA;
 )]
 class EnvironmentVariable extends BaseModel
 {
+    public const BUILDPACK_CONTROL_VARIABLE_PREFIXES = ['NIXPACKS_', 'RAILPACK_'];
+
     protected $attributes = [
         'is_runtime' => true,
         'is_buildtime' => true,
@@ -74,11 +78,11 @@ class EnvironmentVariable extends BaseModel
         'resourceable_id' => 'integer',
     ];
 
-    protected $appends = ['real_value', 'is_shared', 'is_really_required', 'is_nixpacks', 'is_coolify'];
+    protected $appends = ['real_value', 'is_shared', 'is_really_required', 'is_buildpack_control', 'is_coolify'];
 
     protected static function booted()
     {
-        static::created(function (EnvironmentVariable $environment_variable) {
+        static::created(function (ModelsEnvironmentVariable $environment_variable) {
             if ($environment_variable->resourceable_type === Application::class && ! $environment_variable->is_preview) {
                 $found = ModelsEnvironmentVariable::where('key', $environment_variable->key)
                     ->where('resourceable_type', Application::class)
@@ -109,7 +113,7 @@ class EnvironmentVariable extends BaseModel
             ]);
         });
 
-        static::saving(function (EnvironmentVariable $environmentVariable) {
+        static::saving(function (ModelsEnvironmentVariable $environmentVariable) {
             $environmentVariable->updateIsShared();
         });
     }
@@ -119,6 +123,30 @@ class EnvironmentVariable extends BaseModel
         return $this->belongsTo(Service::class);
     }
 
+    public function scopeWithoutBuildpackControlVariables(Builder $query): Builder
+    {
+        foreach (self::BUILDPACK_CONTROL_VARIABLE_PREFIXES as $prefix) {
+            $query->where('key', 'not like', "{$prefix}%");
+        }
+
+        return $query;
+    }
+
+    public static function isBuildpackControlKey(?string $key): bool
+    {
+        if (blank($key)) {
+            return false;
+        }
+
+        foreach (self::BUILDPACK_CONTROL_VARIABLE_PREFIXES as $prefix) {
+            if (str($key)->startsWith($prefix)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
     protected function value(): Attribute
     {
         return Attribute::make(
@@ -188,16 +216,10 @@ class EnvironmentVariable extends BaseModel
         );
     }
 
-    protected function isNixpacks(): Attribute
+    protected function isBuildpackControl(): Attribute
     {
         return Attribute::make(
-            get: function () {
-                if (str($this->key)->startsWith('NIXPACKS_')) {
-                    return true;
-                }
-
-                return false;
-            }
+            get: fn () => self::isBuildpackControlKey($this->key),
         );
     }
 
@@ -349,7 +371,9 @@ class EnvironmentVariable extends BaseModel
     protected function key(): Attribute
     {
         return Attribute::make(
-            set: fn (string $value) => str($value)->trim()->replace(' ', '_')->value,
+            set: fn (string $value) => ValidationPatterns::validatedEnvironmentVariableKey(
+                ValidationPatterns::normalizeEnvironmentVariableKey($value)
+            ),
         );
     }
 

app/Models/InstanceSettings.php

@@ -45,6 +45,7 @@ class InstanceSettings extends Model
         'is_sponsorship_popup_enabled',
         'dev_helper_version',
         'is_wire_navigate_enabled',
+        'is_mcp_server_enabled',
     ];
 
     protected $casts = [
@@ -67,6 +68,7 @@ class InstanceSettings extends Model
         'update_check_frequency' => 'string',
         'sentinel_token' => 'encrypted',
         'is_wire_navigate_enabled' => 'boolean',
+        'is_mcp_server_enabled' => 'boolean',
     ];
 
     protected static function booted(): void

app/Models/LocalFileVolume.php

@@ -10,6 +10,12 @@ use Symfony\Component\Yaml\Yaml;
 
 class LocalFileVolume extends BaseModel
 {
+    public const MAX_CONTENT_SIZE = 5_242_880;
+
+    public const BINARY_PLACEHOLDER = '[binary file]';
+
+    public const TOO_LARGE_PLACEHOLDER = '[file too large to display]';
+
     protected $casts = [
         // 'fs_path' => 'encrypted',
         // 'mount_path' => 'encrypted',
@@ -33,7 +39,7 @@ class LocalFileVolume extends BaseModel
         'is_preview_suffix_enabled',
     ];
 
-    public $appends = ['is_binary'];
+    public $appends = ['is_binary', 'is_too_large'];
 
     protected static function booted()
     {
@@ -46,9 +52,14 @@ class LocalFileVolume extends BaseModel
     protected function isBinary(): Attribute
     {
         return Attribute::make(
-            get: function () {
-                return $this->content === '[binary file]';
-            }
+            get: fn () => $this->content === self::BINARY_PLACEHOLDER
+        );
+    }
+
+    protected function isTooLarge(): Attribute
+    {
+        return Attribute::make(
+            get: fn () => $this->content === self::TOO_LARGE_PLACEHOLDER
         );
     }
 
@@ -81,10 +92,17 @@ class LocalFileVolume extends BaseModel
 
         $isFile = instant_remote_process(["test -f {$escapedPath} && echo OK || echo NOK"], $server);
         if ($isFile === 'OK') {
+            if ($this->remoteFileExceedsLimit($escapedPath, $server)) {
+                $this->content = self::TOO_LARGE_PLACEHOLDER;
+                $this->is_directory = false;
+                $this->save();
+
+                return;
+            }
             $content = instant_remote_process(["cat {$escapedPath}"], $server, false);
             // Check if content contains binary data by looking for null bytes or non-printable characters
             if (str_contains($content, "\0") || preg_match('/[\x00-\x08\x0B\x0C\x0E-\x1F]/', $content)) {
-                $content = '[binary file]';
+                $content = self::BINARY_PLACEHOLDER;
             }
             $this->content = $content;
             $this->is_directory = false;
@@ -92,6 +110,18 @@ class LocalFileVolume extends BaseModel
         }
     }
 
+    protected function remoteFileExceedsLimit(string $escapedPath, $server): bool
+    {
+        $sizeOutput = instant_remote_process(
+            ["stat -c%s {$escapedPath} 2>/dev/null || wc -c < {$escapedPath}"],
+            $server,
+            false,
+        );
+        $size = (int) trim((string) $sizeOutput);
+
+        return $size > self::MAX_CONTENT_SIZE;
+    }
+
     public function deleteStorageOnServer()
     {
         $this->load(['service']);
@@ -173,9 +203,12 @@ class LocalFileVolume extends BaseModel
         $isFile = instant_remote_process(["test -f {$escapedPath} && echo OK || echo NOK"], $server);
         $isDir = instant_remote_process(["test -d {$escapedPath} && echo OK || echo NOK"], $server);
         if ($isFile === 'OK' && $this->is_directory) {
-            $content = instant_remote_process(["cat {$escapedPath}"], $server, false);
+            if ($this->remoteFileExceedsLimit($escapedPath, $server)) {
+                $this->content = self::TOO_LARGE_PLACEHOLDER;
+            } else {
+                $this->content = instant_remote_process(["cat {$escapedPath}"], $server, false);
+            }
             $this->is_directory = false;
-            $this->content = $content;
             $this->save();
             FileStorageChanged::dispatch(data_get($server, 'team_id'));
             throw new \Exception('The following file is a file on the server, but you are trying to mark it as a directory. Please delete the file on the server or mark it as directory.');

app/Models/S3Storage.php

@@ -2,11 +2,13 @@
 
 namespace App\Models;
 
+use App\Rules\SafeWebhookUrl;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Notifications\Messages\MailMessage;
 use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Facades\Validator;
 
 class S3Storage extends BaseModel
 {
@@ -139,6 +141,14 @@ class S3Storage extends BaseModel
     public function testConnection(bool $shouldSave = false)
     {
         try {
+            $validator = Validator::make(
+                ['endpoint' => $this['endpoint']],
+                ['endpoint' => ['required', new SafeWebhookUrl]],
+            );
+            if ($validator->fails()) {
+                throw new \RuntimeException('S3 endpoint is not allowed: '.$validator->errors()->first('endpoint'));
+            }
+
             $disk = Storage::build([
                 'driver' => 's3',
                 'region' => $this['region'],

app/Models/ScheduledTask.php

@@ -76,20 +76,14 @@ class ScheduledTask extends BaseModel
         return $this->hasMany(ScheduledTaskExecution::class)->orderBy('created_at', 'desc');
     }
 
-    public function server()
+    public function server(): ?Server
     {
         if ($this->application) {
-            if ($this->application->destination && $this->application->destination->server) {
-                return $this->application->destination->server;
-            }
-        } elseif ($this->service) {
-            if ($this->service->destination && $this->service->destination->server) {
-                return $this->service->destination->server;
-            }
-        } elseif ($this->database) {
-            if ($this->database->destination && $this->database->destination->server) {
-                return $this->database->destination->server;
-            }
+            return $this->application->destination?->server;
+        }
+
+        if ($this->service) {
+            return $this->service->destination?->server;
         }
 
         return null;

app/Models/Server.php

@@ -1236,10 +1236,8 @@ $schema://$host {
         $this->refresh();
         $unreachableNotificationSent = (bool) $this->unreachable_notification_sent;
         $isReachable = (bool) $this->settings->is_reachable;
-        if ($isReachable === true) {
-            $this->unreachable_count = 0;
-            $this->save();
 
+        if ($isReachable === true) {
             if ($unreachableNotificationSent === true) {
                 $this->sendReachableNotification();
             }
@@ -1247,28 +1245,8 @@ $schema://$host {
             return;
         }
 
-        $this->increment('unreachable_count');
-
-        if ($this->unreachable_count === 1) {
-            $this->settings->is_reachable = true;
-            $this->settings->save();
-
-            return;
-        }
-
         if ($this->unreachable_count >= 2 && ! $unreachableNotificationSent) {
-            $failedChecks = 0;
-            for ($i = 0; $i < 3; $i++) {
-                $status = $this->serverStatus();
-                sleep(5);
-                if (! $status) {
-                    $failedChecks++;
-                }
-            }
-
-            if ($failedChecks === 3 && ! $unreachableNotificationSent) {
-                $this->sendUnreachableNotification();
-            }
+            $this->sendUnreachableNotification();
         }
     }
 

app/Models/ServerSetting.php

@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use Illuminate\Contracts\Encryption\DecryptException;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Facades\Log;
@@ -49,6 +50,7 @@ use OpenApi\Attributes as OA;
         'updated_at' => ['type' => 'string'],
         'delete_unused_volumes' => ['type' => 'boolean', 'description' => 'The flag to indicate if the unused volumes should be deleted.'],
         'delete_unused_networks' => ['type' => 'boolean', 'description' => 'The flag to indicate if the unused networks should be deleted.'],
+        'connection_timeout' => ['type' => 'integer', 'description' => 'SSH connection timeout in seconds.'],
     ]
 )]
 class ServerSetting extends Model
@@ -97,6 +99,7 @@ class ServerSetting extends Model
         'is_terminal_enabled',
         'deployment_queue_limit',
         'disable_application_image_retention',
+        'connection_timeout',
     ];
 
     protected $casts = [
@@ -108,6 +111,7 @@ class ServerSetting extends Model
         'is_usable' => 'boolean',
         'is_terminal_enabled' => 'boolean',
         'disable_application_image_retention' => 'boolean',
+        'connection_timeout' => 'integer',
     ];
 
     protected static function booted()
@@ -141,19 +145,54 @@ class ServerSetting extends Model
      * Validate that a sentinel token contains only safe characters.
      * Prevents OS command injection when the token is interpolated into shell commands.
      */
-    public static function isValidSentinelToken(string $token): bool
+    public static function isValidSentinelToken(?string $token): bool
     {
+        if ($token === null) {
+            return false;
+        }
+
         return (bool) preg_match('/\A[a-zA-Z0-9._\-+=\/]+\z/', $token);
     }
 
-    public function generateSentinelToken(bool $save = true, bool $ignoreEvent = false)
+    /**
+     * Returns a valid sentinel token, regenerating it if the stored value is
+     * empty, undecryptable, or otherwise invalid. Throws only when regeneration
+     * still fails to produce a valid token.
+     */
+    public function ensureValidSentinelToken(): string
+    {
+        try {
+            $token = $this->sentinel_token;
+        } catch (DecryptException) {
+            $token = null;
+        }
+
+        if (! self::isValidSentinelToken($token)) {
+            // Clear undecryptable raw value so Eloquent's dirty-check won't try to
+            // decrypt the bad original during save().
+            $attrs = $this->getAttributes();
+            $attrs['sentinel_token'] = null;
+            $this->setRawAttributes($attrs, true);
+
+            $this->generateSentinelToken(save: true, ignoreEvent: true);
+            $this->refresh();
+            $token = $this->sentinel_token;
+        }
+
+        if (! self::isValidSentinelToken($token)) {
+            throw new \RuntimeException('Sentinel token invalid after regeneration. Allowed characters: a-z, A-Z, 0-9, dot, underscore, hyphen, plus, slash, equals.');
+        }
+
+        return $token;
+    }
+
+    public function generateSentinelToken(bool $save = true, bool $ignoreEvent = false): string
     {
         $data = [
             'server_uuid' => $this->server->uuid,
         ];
-        $token = json_encode($data);
-        $encrypted = encrypt($token);
-        $this->sentinel_token = $encrypted;
+        $token = encrypt(json_encode($data));
+        $this->sentinel_token = $token;
         if ($save) {
             if ($ignoreEvent) {
                 $this->saveQuietly();

app/Models/SharedEnvironmentVariable.php

@@ -2,6 +2,8 @@
 
 namespace App\Models;
 
+use App\Support\ValidationPatterns;
+use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Model;
 
 class SharedEnvironmentVariable extends Model
@@ -33,6 +35,13 @@ class SharedEnvironmentVariable extends Model
         'value' => 'encrypted',
     ];
 
+    protected function key(): Attribute
+    {
+        return Attribute::make(
+            set: fn (string $value) => ValidationPatterns::validatedEnvironmentVariableKey($value),
+        );
+    }
+
     public function team()
     {
         return $this->belongsTo(Team::class);

app/Models/StandaloneDocker.php

@@ -134,8 +134,11 @@ class StandaloneDocker extends BaseModel
         $mongodbs = $this->mongodbs;
         $mysqls = $this->mysqls;
         $mariadbs = $this->mariadbs;
+        $keydbs = $this->keydbs;
+        $dragonflies = $this->dragonflies;
+        $clickhouses = $this->clickhouses;
 
-        return $postgresqls->concat($redis)->concat($mongodbs)->concat($mysqls)->concat($mariadbs);
+        return $postgresqls->concat($redis)->concat($mongodbs)->concat($mysqls)->concat($mariadbs)->concat($keydbs)->concat($dragonflies)->concat($clickhouses);
     }
 
     public function attachedTo()

app/Models/User.php

@@ -257,7 +257,7 @@ class User extends Authenticatable implements SendsEmail
             Carbon::now()->addMinutes(Config::get('auth.verification.expire', 60)),
             [
                 'id' => $this->getKey(),
-                'hash' => sha1($this->getEmailForVerification()),
+                'hash' => hash('sha256', $this->getEmailForVerification()),
             ]
         );
         $mail->view('emails.email-verification', [