claude-hdb
d9525ec1cf
Coolify API tokens are team-scoped, and a wrong-team token does not error: the API resolves what it cannot see to `null` (getResourceByUuid walks resource → environment → project → team_id and returns null on a mismatch). To cast, `null` is indistinguishable from "this resource does not exist yet" — an invitation to create it. So an apply with a token minted under the wrong team would not fail loudly; it would provision a duplicate set of resources into the wrong team, against whatever server that team owns. Silent, mutating, discovered late. That makes this a correctness bug, not hardening. - environments.yaml carries a required `team:` per environment (id, name, or both). Required is the point: an environment with no declared team is one cast cannot verify it is pointed at. - Every command that reaches a live Coolify (apply, diff, server add, smoke) resolves GET /teams/current — the only endpoint that answers "what team does this token act as?" — and aborts on mismatch before its first READ, not merely its first write: a wrong-team diff reports "everything is absent", which is the very lie an apply would then act on. - server add and smoke take --env for this reason. A server belongs to exactly one team forever (no pivot, no is_system_wide escape hatch), and smoke writes env vars onto a live app. - New read-only `cast team` prints the token's team, so the binding can be filled in without a chicken-and-egg. With --env it also checks the binding: the dry run for "would apply refuse?". Team id 0 is a first-class value, not a falsy absent — it is the Root Team that a single-admin instance keeps everything in (app/Models/User.php). Also records the #4 investigation in docs/semantics.md: GithubApp `is_system_wide` IS the supported way to serve every team — list_github_apps scopes to `team_id = token's team OR is_system_wide`, and POST /github-apps accepts the flag — so per-team App duplication is unnecessary. Corollary: resolving a GitHub App by name is NOT a proxy for being in the right team, which is the second reason the assert has to be explicit. Closes #9 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
57 lines
1.7 KiB
TypeScript
57 lines
1.7 KiB
TypeScript
import { execFileSync } from "node:child_process";
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
function runCli(args: string[]): { code: number; output: string } {
|
|
try {
|
|
const output = execFileSync("node", ["dist/cli.js", ...args], {
|
|
encoding: "utf8",
|
|
stdio: "pipe",
|
|
});
|
|
return { code: 0, output };
|
|
} catch (e) {
|
|
const err = e as { status: number; stderr: string; stdout: string };
|
|
return { code: err.status, output: `${err.stdout}${err.stderr}` };
|
|
}
|
|
}
|
|
|
|
describe("infra cli", () => {
|
|
it("refuses apply --path with --env prod, exit non-zero", () => {
|
|
const r = runCli([
|
|
"apply",
|
|
"acme/widget",
|
|
"--env",
|
|
"prod",
|
|
"--path",
|
|
"/tmp/x",
|
|
]);
|
|
expect(r.code).not.toBe(0);
|
|
expect(r.output).toMatch(/--path.*prod/);
|
|
});
|
|
it("prints usage on unknown command", () => {
|
|
const r = runCli(["frobnicate"]);
|
|
expect(r.code).not.toBe(0);
|
|
expect(r.output).toMatch(/usage: cast (apply|diff)/i);
|
|
});
|
|
// Both of these reach a live Coolify and mutate — `server add` registers a
|
|
// server into the token's team (permanently: a server belongs to exactly one
|
|
// team), and `smoke` writes env vars onto a live app. Neither may run without
|
|
// an environment to assert the token's team against.
|
|
it("refuses server add without --env, exit non-zero", () => {
|
|
const r = runCli([
|
|
"server",
|
|
"add",
|
|
"prod-box",
|
|
"--ip",
|
|
"10.0.0.1",
|
|
"--key",
|
|
"/tmp/k",
|
|
]);
|
|
expect(r.code).not.toBe(0);
|
|
expect(r.output).toMatch(/--env/);
|
|
});
|
|
it("refuses smoke without --env, exit non-zero", () => {
|
|
const r = runCli(["smoke"]);
|
|
expect(r.code).not.toBe(0);
|
|
expect(r.output).toMatch(/--env/);
|
|
});
|
|
});
|