coolify/tests/Feature/ServiceApplicationsApiTest.php

<?php

use App\Actions\Service\DeployServiceApplication;
use App\Actions\Service\RestartServiceApplication;
use App\Actions\Service\StopServiceApplication;
use App\Models\Environment;
use App\Models\InstanceSettings;
use App\Models\Project;
use App\Models\Server;
use App\Models\Service;
use App\Models\ServiceApplication;
use App\Models\StandaloneDocker;
use App\Models\Team;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\Queue;
use Illuminate\Support\Str;

uses(RefreshDatabase::class);

beforeEach(function () {
    Queue::fake();
    config()->set('app.maintenance.store', 'array');
    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);

    $this->team = Team::factory()->create();
    $this->user = User::factory()->create();
    $this->team->members()->attach($this->user->id, ['role' => 'owner']);

    $this->bearerToken = createBearerTokenForServiceApplicationsApiTest($this->user, $this->team);

    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
    $this->server->settings->update([
        'is_reachable' => true,
        'is_usable' => true,
        'force_disabled' => false,
    ]);
    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
});

function createBearerTokenForServiceApplicationsApiTest(User $user, Team $team, array $abilities = ['*']): string
{
    $plainTextToken = Str::random(40);
    $token = $user->tokens()->create([
        'name' => 'test-token',
        'token' => hash('sha256', $plainTextToken),
        'abilities' => $abilities,
        'team_id' => $team->id,
    ]);

    return $token->getKey().'|'.$plainTextToken;
}

function createServiceWithApplicationForApiTest(object $ctx): object
{
    $service = Service::factory()->create([
        'environment_id' => $ctx->environment->id,
        'server_id' => $ctx->server->id,
        'destination_id' => $ctx->destination->id,
        'destination_type' => $ctx->destination->getMorphClass(),
        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
    ]);

    $sa = ServiceApplication::create([
        'uuid' => (string) Str::uuid(),
        'name' => 'web',
        'service_id' => $service->id,
        'image' => 'nginx:alpine',
    ]);

    return (object) ['service' => $service, 'serviceApplication' => $sa];
}

function createServiceWithoutApplicationsForApiTest(object $ctx): Service
{
    return Service::factory()->create([
        'environment_id' => $ctx->environment->id,
        'server_id' => $ctx->server->id,
        'destination_id' => $ctx->destination->id,
        'destination_type' => $ctx->destination->getMorphClass(),
        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
    ]);
}

describe('GET /api/v1/services/{uuid}/applications', function () {
    test('returns empty array when service has no applications', function () {
        $service = createServiceWithoutApplicationsForApiTest($this);

        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->getJson("/api/v1/services/{$service->uuid}/applications");

        $response->assertStatus(200);
        $response->assertJson([]);
    });

    test('lists service applications for the service', function () {
        $ctx = createServiceWithApplicationForApiTest($this);

        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->getJson("/api/v1/services/{$ctx->service->uuid}/applications");

        $response->assertStatus(200);
        $response->assertJsonFragment(['uuid' => $ctx->serviceApplication->uuid]);
    });

    test('returns 404 when service does not exist', function () {
        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->getJson('/api/v1/services/00000000-0000-0000-0000-000000000001/applications');

        $response->assertStatus(404);
        $response->assertJsonFragment(['message' => 'Service not found.']);
    });

    test('does not list applications from another team', function () {
        $otherTeam = Team::factory()->create();
        $otherServer = Server::factory()->create(['team_id' => $otherTeam->id]);
        $otherServer->settings->update([
            'is_reachable' => true,
            'is_usable' => true,
            'force_disabled' => false,
        ]);

        $otherCtx = (object) [
            'server' => $otherServer,
            'destination' => StandaloneDocker::where('server_id', $otherServer->id)->first(),
            'environment' => Environment::factory()->create([
                'project_id' => Project::factory()->create(['team_id' => $otherTeam->id])->id,
            ]),
        ];
        $ctx = createServiceWithApplicationForApiTest($otherCtx);

        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->getJson("/api/v1/services/{$ctx->service->uuid}/applications");

        $response->assertStatus(404);
        $response->assertJsonFragment(['message' => 'Service not found.']);
    });
});

describe('GET /api/v1/services/{uuid}/applications/{app_uuid}', function () {
    test('returns 404 for unknown service', function () {
        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->getJson('/api/v1/services/00000000-0000-0000-0000-000000000002/applications/non-existent-uuid-12345');

        $response->assertStatus(404);
        $response->assertJsonFragment(['message' => 'Service not found.']);
    });

    test('returns 404 when application uuid is not under service', function () {
        $ctx = createServiceWithApplicationForApiTest($this);

        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->getJson("/api/v1/services/{$ctx->service->uuid}/applications/00000000-0000-0000-0000-000000000003");

        $response->assertStatus(404);
        $response->assertJsonFragment(['message' => 'Service application not found.']);
    });

    test('returns service application', function () {
        $ctx = createServiceWithApplicationForApiTest($this);

        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->getJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}");

        $response->assertStatus(200);
        $response->assertJsonFragment(['uuid' => $ctx->serviceApplication->uuid, 'name' => 'web']);
    });

    test('returns an editable url with persisted port overrides', function () {
        $ctx = createServiceWithApplicationForApiTest($this);
        $ctx->serviceApplication->update([
            'fqdn' => 'https://web.example.com',
            'domain_port_overrides' => [
                'https://web.example.com' => 8080,
            ],
        ]);

        $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->getJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}")
            ->assertSuccessful()
            ->assertJsonPath('url', 'https://web.example.com:8080')
            ->assertJsonMissingPath('domain_port_overrides');
    });
});

describe('PATCH /api/v1/services/{uuid}/applications/{app_uuid}', function () {
    test('returns 400 without valid token', function () {
        $response = $this->patchJson('/api/v1/services/some-uuid/applications/some-app', [
            'human_name' => 'x',
        ], ['Accept' => 'application/json', 'Content-Type' => 'application/json']);

        $response->assertStatus(401);
    });

    test('updates human_name', function () {
        $ctx = createServiceWithApplicationForApiTest($this);

        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
            'human_name' => 'Web UI',
        ]);

        $response->assertStatus(200);
        $response->assertJsonFragment(['human_name' => 'Web UI']);
        $ctx->serviceApplication->refresh();
        expect($ctx->serviceApplication->human_name)->toBe('Web UI');
    });

    test('round trips and moves a port override when renaming a domain', function () {
        $ctx = createServiceWithApplicationForApiTest($this);
        $ctx->serviceApplication->update([
            'fqdn' => 'https://old.example.com',
            'domain_port_overrides' => [
                'https://old.example.com' => 8080,
            ],
        ]);

        $url = $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->getJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}")
            ->json('url');

        $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
            'url' => str_replace('old.example.com', 'new.example.com', $url),
        ])->assertSuccessful()
            ->assertJsonPath('url', 'https://new.example.com:8080');

        expect($ctx->serviceApplication->fresh())
            ->fqdn->toBe('https://new.example.com')
            ->domain_port_overrides->toBe([
                'https://new.example.com' => 8080,
            ]);
    });

    test('updates the HTTP to HTTPS redirect setting', function () {
        config(['app.maintenance.driver' => 'file']);
        $ctx = createServiceWithApplicationForApiTest($this);

        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
            'is_force_https_enabled' => false,
        ]);

        $response->assertSuccessful();
        expect($ctx->serviceApplication->fresh()->is_force_https_enabled)->toBeFalse();
    });

    test('updates the maximum restart count', function () {
        $ctx = createServiceWithApplicationForApiTest($this);
        $ctx->serviceApplication->update(['restart_limit_reached' => true]);

        $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
            'max_restart_count' => 0,
        ])->assertSuccessful()
            ->assertJsonPath('max_restart_count', 0)
            ->assertJsonPath('restart_limit_reached', false);

        expect($ctx->serviceApplication->fresh())
            ->max_restart_count->toBe(0)
            ->restart_limit_reached->toBeFalse();
    });

    test('rejects an invalid maximum restart count', function (mixed $value) {
        $ctx = createServiceWithApplicationForApiTest($this);

        $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
            'max_restart_count' => $value,
        ])->assertJsonValidationErrors('max_restart_count');
    })->with([
        'negative' => -1,
        'decimal' => 1.5,
        'text' => 'unlimited',
    ]);

    test('updates the traefik certificate resolver', function (?string $initial, ?string $value) {
        $ctx = createServiceWithApplicationForApiTest($this);
        $ctx->serviceApplication->update(['traefik_certificate_resolver' => $initial]);

        $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
            'traefik_certificate_resolver' => $value,
        ])->assertSuccessful()
            ->assertJsonPath('traefik_certificate_resolver', $value);

        expect($ctx->serviceApplication->fresh()->traefik_certificate_resolver)->toBe($value);
    })->with([
        'custom resolver' => [null, 'cloudflare'],
        'no resolver' => [null, 'none'],
        'server setting' => ['cloudflare', null],
    ]);

    test('rejects an invalid traefik certificate resolver', function () {
        $ctx = createServiceWithApplicationForApiTest($this);
        $ctx->serviceApplication->update(['traefik_certificate_resolver' => 'cloudflare']);

        $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
            'traefik_certificate_resolver' => 'a.b=c',
        ])->assertUnprocessable()
            ->assertJsonValidationErrors('traefik_certificate_resolver');

        expect($ctx->serviceApplication->fresh()->traefik_certificate_resolver)->toBe('cloudflare');
    });

    test('returns 422 for invalid url scheme', function () {
        $ctx = createServiceWithApplicationForApiTest($this);

        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
            'url' => 'ftp://example.com',
        ]);

        $response->assertStatus(422);
    });

    test('returns 422 for a url port outside the valid TCP range', function (string $url) {
        $ctx = createServiceWithApplicationForApiTest($this);

        $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
            'url' => $url,
        ])->assertUnprocessable();
    })->with([
        'zero' => 'https://example.com:0',
        'above maximum' => 'https://example.com:65536',
    ]);

    test('returns 422 when enabling log drain but server has no log drain', function () {
        $ctx = createServiceWithApplicationForApiTest($this);

        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
            'is_log_drain_enabled' => true,
        ]);

        $response->assertStatus(422);
        expect((string) $response->json('errors.is_log_drain_enabled.0'))->toContain('Log drain');
    });

    test('read-only token cannot update a service application', function () {
        $ctx = createServiceWithApplicationForApiTest($this);
        $readOnlyToken = createBearerTokenForServiceApplicationsApiTest($this->user, $this->team, ['read']);

        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$readOnlyToken,
        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
            'human_name' => 'Blocked',
        ]);

        $response->assertStatus(403);
    });

    test('returns 409 for domain conflicts unless forced', function () {
        $ctx = createServiceWithApplicationForApiTest($this);
        $ctx->serviceApplication->update(['fqdn' => 'http://used.example.com']);
        $otherApplication = ServiceApplication::create([
            'name' => 'admin',
            'service_id' => $ctx->service->id,
            'image' => 'nginx:alpine',
        ]);

        $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$otherApplication->uuid}", [
            'url' => 'http://used.example.com',
        ])->assertStatus(409);

        $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$otherApplication->uuid}?force_domain_override=true", [
            'url' => 'http://used.example.com',
        ])->assertStatus(200);

        $otherApplication->refresh();
        expect($otherApplication->fqdn)->toBe('http://used.example.com');
    });
});

describe('POST /api/v1/services/{uuid}/applications/{app_uuid}/restart', function () {
    test('returns 400 without valid token', function () {
        $response = $this->postJson('/api/v1/services/some-uuid/applications/some-app/restart');

        $response->assertStatus(401);
    });

    test('queues restart for a service application', function () {
        $ctx = createServiceWithApplicationForApiTest($this);

        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->postJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}/restart");

        $response->assertStatus(200);
        $response->assertJsonFragment(['message' => 'Service application restart request queued.']);
        RestartServiceApplication::assertPushed();
    });
});

describe('POST /api/v1/services/{uuid}/applications/{app_uuid}/start', function () {
    test('write token cannot start a service application', function () {
        $ctx = createServiceWithApplicationForApiTest($this);
        $writeToken = createBearerTokenForServiceApplicationsApiTest($this->user, $this->team, ['write']);

        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$writeToken,
        ])->postJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}/start");

        $response->assertStatus(403);
    });

    test('queues deploy for a service application', function () {
        $ctx = createServiceWithApplicationForApiTest($this);

        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->postJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}/start?latest=1&force=1");

        $response->assertStatus(200);
        $response->assertJsonFragment(['message' => 'Service application deploy request queued.']);
        DeployServiceApplication::assertPushed();
    });
});

describe('POST /api/v1/services/{uuid}/applications/{app_uuid}/stop', function () {
    test('queues stop for a service application', function () {
        $ctx = createServiceWithApplicationForApiTest($this);

        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->postJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}/stop");

        $response->assertStatus(200);
        $response->assertJsonFragment(['message' => 'Service application stop request queued.']);
        StopServiceApplication::assertPushed();
    });
});

describe('GET /api/v1/services/{uuid}/applications/{app_uuid}/logs', function () {
    test('returns 400 when server is not functional', function () {
        $ctx = createServiceWithApplicationForApiTest($this);
        $this->server->settings->update([
            'is_reachable' => false,
        ]);

        $response = $this->withHeaders([
            'Authorization' => 'Bearer '.$this->bearerToken,
        ])->getJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}/logs");

        $response->assertStatus(400);
        $response->assertJsonFragment(['message' => 'Server is not functional.']);
    });
});

it('applies UI domain validation to service API updates', function (string $target, string $url) {
    $ctx = createServiceWithApplicationForApiTest($this);
    $ctx->serviceApplication->update(['fqdn' => 'https://original.example.com']);
    $isApplication = $target === 'application';
    $path = $isApplication
        ? "/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}"
        : "/api/v1/services/{$ctx->service->uuid}";
    $payload = $isApplication ? ['url' => $url] : ['urls' => [['name' => 'web', 'url' => $url]]];

    $this->withToken($this->bearerToken)->patchJson($path, $payload)
        ->assertUnprocessable()
        ->assertJsonValidationErrors($isApplication ? 'url' : 'urls.0.url');

    expect($ctx->serviceApplication->fresh()->fqdn)->toBe('https://original.example.com');
})->with(['application', 'service'])->with([
    'wildcard' => 'https://*.example.com',
    'too long' => 'https://example.com/'.str_repeat('a', 2048),
]);

it('rejects oversized service domains before creating a service', function () {
    $count = Service::count();

    $this->withToken($this->bearerToken)->postJson('/api/v1/services', [
        'project_uuid' => $this->project->uuid,
        'environment_uuid' => $this->environment->uuid,
        'server_uuid' => $this->server->uuid,
        'docker_compose_raw' => base64_encode("services:\n  web:\n    image: nginx:alpine\n"),
        'urls' => [['name' => 'web', 'url' => 'https://example.com/'.str_repeat('a', 2048)]],
    ])->assertUnprocessable()->assertJsonValidationErrors('urls.0.url');

    expect(Service::count())->toBe($count);
});