Mark Henderson
3192e0f7b9
Coolify v4's POST/PATCH /applications/{uuid}/envs only accepts key,
value, is_preview, is_literal, is_multiline, is_shown_once. Sending
is_build_time triggers a 422 "This field is not allowed." — it's now
a derived read-only flag (is_buildtime) computed from Dockerfile ARG
usage. Breaks agents trying to upsert env vars.
Three-layer fix so this can't regress:
- lib/coolify.ts: COOLIFY_ENV_WRITE_FIELDS whitelist enforced at the
network boundary, regardless of caller shape
- app/api/workspaces/[slug]/apps/[uuid]/envs: stops forwarding the
field; returns a deprecation warning when callers send it; GET
reads both is_buildtime and is_build_time for version parity
- app/api/mcp/route.ts: same treatment in the MCP dispatcher;
AI_CAPABILITIES.md doc corrected
Also bundles (not related to the above):
- Workspace API keys are now revealable from settings. New
key_encrypted column stores AES-256-GCM(VIBN_SECRETS_KEY, token).
POST /api/workspaces/[slug]/keys/[keyId]/reveal returns plaintext
for session principals only; API-key principals cannot reveal
siblings. Legacy keys stay valid for auth but can't reveal.
- P5.3 Object storage: lib/gcp/storage.ts + lib/workspace-gcs.ts
idempotently provision a per-workspace GCS bucket, service
account, IAM binding and HMAC key. New POST /api/workspaces/
[slug]/storage/buckets endpoint. Migration script + smoke test
included. Proven end-to-end against prod master-ai-484822.
Made-with: Cursor
40 lines
2.3 KiB
SQL
40 lines
2.3 KiB
SQL
-- =============================================================================
|
|
-- VIBN P5.3 — per-workspace GCS storage columns on vibn_workspaces
|
|
--
|
|
-- Adds the columns that ensureWorkspaceGcsProvisioned() persists into:
|
|
--
|
|
-- gcp_service_account_email — workspace's dedicated GCP SA, e.g.
|
|
-- vibn-ws-mark@master-ai-484822.iam.gserviceaccount.com
|
|
-- gcp_service_account_key_enc — base64( secret-box(SA JSON keyfile) ).
|
|
-- Currently only used for runtime auth from app
|
|
-- code (env injection); control-plane auth still
|
|
-- uses GOOGLE_SERVICE_ACCOUNT_KEY_B64.
|
|
-- gcs_default_bucket_name — globally-unique GCS bucket created on first
|
|
-- provision, e.g. vibn-ws-mark-a3f9c1.
|
|
-- gcs_hmac_access_id — S3-compatible HMAC access key id (plain text;
|
|
-- not a secret on its own).
|
|
-- gcs_hmac_secret_enc — base64( secret-box(HMAC secret) ). Decrypted
|
|
-- only when STORAGE_SECRET_ACCESS_KEY needs to be
|
|
-- injected into a Coolify app.
|
|
-- gcp_provision_status — independent of provision_status so a partial
|
|
-- GCP failure does not flip the whole workspace.
|
|
-- Values: 'pending' | 'partial' | 'ready' | 'error'.
|
|
-- gcp_provision_error — last error message from the GCP provisioner.
|
|
--
|
|
-- Safe to re-run.
|
|
-- =============================================================================
|
|
|
|
ALTER TABLE vibn_workspaces
|
|
ADD COLUMN IF NOT EXISTS gcp_service_account_email TEXT,
|
|
ADD COLUMN IF NOT EXISTS gcp_service_account_key_enc TEXT,
|
|
ADD COLUMN IF NOT EXISTS gcs_default_bucket_name TEXT,
|
|
ADD COLUMN IF NOT EXISTS gcs_hmac_access_id TEXT,
|
|
ADD COLUMN IF NOT EXISTS gcs_hmac_secret_enc TEXT,
|
|
ADD COLUMN IF NOT EXISTS gcp_provision_status TEXT NOT NULL DEFAULT 'pending',
|
|
ADD COLUMN IF NOT EXISTS gcp_provision_error TEXT;
|
|
|
|
CREATE INDEX IF NOT EXISTS vibn_workspaces_gcp_status_idx
|
|
ON vibn_workspaces (gcp_provision_status);
|
|
|
|
SELECT 'P5.3 workspace-GCS migration complete' AS status;
|