[agentHits]

What is this PR about?

The S3 destination Test button only ran rclone ls, so a key that can read but not write passed the test, and scheduled backups later failed with PutObject ... StatusCode: 403. This PR makes the test check read, write and delete access separately and show which ones work.

Server (destination.testConnection)

• Runs three checks in order against the configured bucket, on the same target as before (execAsync locally, execAsyncRemote in cloud mode):
  • read: rclone ls of the bucket root, same retry/timeout flags as before;
  • write: rclone rcat of a tiny object at dokploy-connection-test/<timestamp>-<random>.txt (content is piped in with printf; every argument goes through shell-quote);
  • delete: rclone deletefile of that same object. Skipped when the write failed.
• The write check still runs when read fails, so write-only keys are reported correctly.
• If all checks pass, the mutation returns { read: { ok: true }, write: { ok: true }, delete: { ok: true } }.
• If any check fails, it throws BAD_REQUEST with one line per check, so API/MCP clients still get an error:

  Read: OK
  Write: FAILED - 403 AccessDenied (the key cannot upload objects)
  Delete: SKIPPED - no test object was uploaded
  

  If the upload works but the delete is denied, the delete line names the leftover object (<bucket>/dokploy-connection-test/....txt).
• Failure reasons are reduced to the HTTP status and S3 error code plus a short hint. They go through redactSensitiveText, and the access key and secret values are replaced. The command line (which carries the credentials as env assignments) never reaches the reason.
• The stored-secret placeholder handling and its organization check are unchanged.
• New helpers: packages/server/src/utils/destination/connection-test.ts (commands, runner, failure summary) and connection-test-report.ts (client-safe types plus format/parse of the report lines).

UI (handle-destinations.tsx)

• After Test, the dialog shows a small list next to the Test button: a check, cross or "skipped" icon per operation, with the reason. On success it reads "Read, write and delete access confirmed".
• The success toast is unchanged apart from a short description. For a check failure, the toast says "Destination test failed" and points to the list in the dialog. Other errors (validation, unreachable server) keep the old toast and alert.

For a read-only key, the dialog now shows:

• ✓ Read: OK
• ✗ Write: Failed - 403 AccessDenied (the key cannot upload objects)
• – Delete: Skipped - no test object was uploaded

Checks

From apps/dokploy:

• CI=true bunx vitest run --config __test__/vitest.config.ts __test__/destination/destination-connection-test.test.ts __test__/destination/destination-connection-report.test.ts: 12 passed.
  • Against the old router, all 7 new router tests fail on assertions. The report test fails on the old code because the module does not exist there.
• CI=true bunx vitest run --config __test__/vitest.config.ts __test__/destination: 4 files, 30 passed.
• CI=true bunx vitest run --config __test__/vitest.config.ts __test__/backup/rclone-command-boundary.test.ts: 6 passed. It now checks that all three commands pass credentials only as env and quote hostile bucket names.
• Full suite: 234 files passed. The only failures are the *.real.test.ts files (no Docker socket locally) and two files that time out under full-suite load (better-auth-schema-compat, cloud-queue-availability). Both pass when run on their own and are unrelated to this change.

From the repo root:

• bun run typecheck: exit 0.
• bun run format-and-lint: 0 errors. The 33 warnings and 16 infos were already there, and none are in the changed files.

The new tests cover:

• all checks passing, locally and on a cloud server;
• a read-only key, where the message lists Read OK, Write FAILED and Delete SKIPPED, with no key value in it;
• a write-only key;
• write OK but delete denied, where the leftover path matches the uploaded object;
• masking of keys in unrecognized rclone output;
• running the write and delete commands under /bin/sh with a stub rclone and a hostile bucket name. Nothing gets injected, and the target is under dokploy-connection-test/.

Not checked: a real S3 endpoint. The dialog was not opened in a browser, so only typecheck and lint cover it.

Rollout notes

• No migration or config change.
• The Test button now writes and deletes a small object under dokploy-connection-test/ in the bucket. If the key cannot delete, that object stays and the dialog names it so it can be removed by hand.
• A test with a broken endpoint can take longer, because up to three rclone calls run instead of one.
• destination.testConnection now returns an object on success instead of an empty value. Callers that ignore the result are unaffected.

🤖 Generated with Claude Code