Merge remote-tracking branch 'origin/next' into feat/api-move-resources-between-projects

bootstrap/helpers/api.php

@@ -3,15 +3,24 @@
 use App\Enums\BuildPackTypes;
 use App\Enums\RedirectTypes;
 use App\Enums\StaticImageTypes;
+use App\Rules\ValidGitBranch;
+use App\Support\ValidationPatterns;
 use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Database\Eloquent\Model;
 use Illuminate\Http\Request;
 use Illuminate\Validation\Rule;
 
 function getTeamIdFromToken()
 {
-    $token = auth()->user()->currentAccessToken();
+    $user = auth()->user();
+    $token = $user?->currentAccessToken();
+    $teamId = data_get($token, 'team_id');
 
-    return data_get($token, 'team_id');
+    if (! $user || is_null($teamId) || ! $user->teams()->where('teams.id', $teamId)->exists()) {
+        return null;
+    }
+
+    return $teamId;
 }
 function invalidTokenResponse()
 {
@@ -79,34 +88,49 @@ function serializeApiResponse($data)
     }
 }
 
+/**
+ * Re-expose a model's `$hidden` sensitive fields when the current API request
+ * carries the `read:sensitive` or `root` token ability (set by the
+ * ApiSensitiveData middleware).
+ */
+function exposeSensitiveFields(Model $model): Model
+{
+    if (request()->attributes->get('can_read_sensitive', false) === true && filled($model->getHidden())) {
+        $model->makeVisible($model->getHidden());
+    }
+
+    return $model;
+}
+
 function sharedDataApplications()
 {
     return [
         'git_repository' => 'string',
-        'git_branch' => 'string',
+        'git_branch' => ['string', new ValidGitBranch],
         'build_pack' => Rule::enum(BuildPackTypes::class),
         'is_static' => 'boolean',
         'is_spa' => 'boolean',
         'is_auto_deploy_enabled' => 'boolean',
         'is_force_https_enabled' => 'boolean',
+        'is_preview_deployments_enabled' => 'boolean',
         'static_image' => Rule::enum(StaticImageTypes::class),
-        'domains' => 'string|nullable',
+        'domains' => ValidationPatterns::applicationDomainRules(),
         'redirect' => Rule::enum(RedirectTypes::class),
         'git_commit_sha' => ['string', 'regex:/^[a-zA-Z0-9][a-zA-Z0-9._\-\/]*$/'],
-        'docker_registry_image_name' => 'string|nullable',
-        'docker_registry_image_tag' => 'string|nullable',
-        'install_command' => 'string|nullable',
-        'build_command' => 'string|nullable',
-        'start_command' => 'string|nullable',
+        'docker_registry_image_name' => ValidationPatterns::dockerImageNameRules(),
+        'docker_registry_image_tag' => ValidationPatterns::dockerImageTagRules(),
+        'install_command' => ValidationPatterns::shellSafeCommandRules(),
+        'build_command' => ValidationPatterns::shellSafeCommandRules(),
+        'start_command' => ValidationPatterns::shellSafeCommandRules(),
         'ports_exposes' => 'string|regex:/^(\d+)(,\d+)*$/',
         'ports_mappings' => 'string|regex:/^(\d+:\d+)(,\d+:\d+)*$/|nullable',
         'custom_network_aliases' => 'string|nullable',
-        'base_directory' => 'string|nullable',
-        'publish_directory' => 'string|nullable',
+        'base_directory' => ValidationPatterns::directoryPathRules(),
+        'publish_directory' => ValidationPatterns::directoryPathRules(),
         'health_check_enabled' => 'boolean',
         'health_check_type' => 'string|in:http,cmd',
         'health_check_command' => ['nullable', 'string', 'max:1000', 'regex:/^[a-zA-Z0-9 \-_.\/:=@,+]+$/'],
-        'health_check_path' => ['string', 'regex:#^[a-zA-Z0-9/\-_.~%]+$#'],
+        'health_check_path' => ['string', 'regex:#^[a-zA-Z0-9/\-_.~%,;]+$#'],
         'health_check_port' => 'integer|nullable|min:1|max:65535',
         'health_check_host' => ['string', 'regex:/^[a-zA-Z0-9.\-_]+$/'],
         'health_check_method' => 'string|in:GET,HEAD,POST,OPTIONS',
@@ -125,22 +149,26 @@ function sharedDataApplications()
         'limits_cpuset' => 'string|nullable',
         'limits_cpu_shares' => 'numeric',
         'custom_labels' => 'string|nullable',
-        'custom_docker_run_options' => 'string|nullable',
+        'custom_docker_run_options' => ValidationPatterns::shellSafeCommandRules(2000),
+        // Security: deployment commands are intentionally arbitrary shell (e.g. "php artisan migrate").
+        // Access is gated by API token authentication. Commands run inside the app container, not the host.
         'post_deployment_command' => 'string|nullable',
-        'post_deployment_command_container' => 'string',
+        'post_deployment_command_container' => ValidationPatterns::containerNameRules(),
         'pre_deployment_command' => 'string|nullable',
-        'pre_deployment_command_container' => 'string',
+        'pre_deployment_command_container' => ValidationPatterns::containerNameRules(),
         'manual_webhook_secret_github' => 'string|nullable',
         'manual_webhook_secret_gitlab' => 'string|nullable',
         'manual_webhook_secret_bitbucket' => 'string|nullable',
         'manual_webhook_secret_gitea' => 'string|nullable',
-        'dockerfile_location' => ['string', 'nullable', 'max:255', 'regex:'.\App\Support\ValidationPatterns::FILE_PATH_PATTERN],
-        'docker_compose_location' => ['string', 'nullable', 'max:255', 'regex:'.\App\Support\ValidationPatterns::FILE_PATH_PATTERN],
+        'dockerfile_location' => ValidationPatterns::filePathRules(),
+        'dockerfile_target_build' => ValidationPatterns::dockerTargetRules(),
+        'docker_compose_location' => ValidationPatterns::filePathRules(),
         'docker_compose' => 'string|nullable',
         'docker_compose_domains' => 'array|nullable',
-        'docker_compose_custom_start_command' => 'string|nullable',
-        'docker_compose_custom_build_command' => 'string|nullable',
+        'docker_compose_custom_start_command' => ValidationPatterns::shellSafeCommandRules(),
+        'docker_compose_custom_build_command' => ValidationPatterns::shellSafeCommandRules(),
         'is_container_label_escape_enabled' => 'boolean',
+        'is_preserve_repository_enabled' => 'boolean',
     ];
 }
 
@@ -230,9 +258,13 @@ function removeUnnecessaryFieldsFromRequest(Request $request)
     $request->offsetUnset('is_spa');
     $request->offsetUnset('is_auto_deploy_enabled');
     $request->offsetUnset('is_force_https_enabled');
+    $request->offsetUnset('is_preview_deployments_enabled');
     $request->offsetUnset('connect_to_docker_network');
     $request->offsetUnset('force_domain_override');
     $request->offsetUnset('autogenerate_domain');
     $request->offsetUnset('is_container_label_escape_enabled');
+    $request->offsetUnset('is_preserve_repository_enabled');
+    $request->offsetUnset('include_source_commit_in_build');
     $request->offsetUnset('docker_compose_raw');
+    $request->offsetUnset('tags');
 }