fix: redact compose service response secrets

apps/dokploy/__test__/security/service-environment-reveal.test.ts

@@ -73,6 +73,7 @@ const permissionMocks = vi.hoisted(() => ({
 	checkServiceAccess: vi.fn(),
 	checkServicePermissionAndAccess: vi.fn(),
 	findMemberByUserId: vi.fn(),
+	hasPermission: vi.fn(),
 }));
 
 const auditMocks = vi.hoisted(() => ({
@@ -161,6 +162,7 @@ vi.mock("@dokploy/server/services/permission", () => ({
 	checkServicePermissionAndAccess:
 		permissionMocks.checkServicePermissionAndAccess,
 	findMemberByUserId: permissionMocks.findMemberByUserId,
+	hasPermission: permissionMocks.hasPermission,
 }));
 
 vi.mock("@dokploy/server/templates/github", () => ({
@@ -236,20 +238,26 @@ const compose = (organizationId = "org-1") => ({
 	appName: "compose-one",
 	sourceType: "docker",
 	env: "COMPOSE_SECRET=secret",
+	composeFile:
+		"services:\n  api:\n    environment:\n      TOKEN: compose-secret",
+	customGitUrl: "https://compose-token@example.com/org/private.git",
 	environment: {
 		project: {
 			organizationId,
 		},
 	},
 });
 
+const redactedCustomGitUrl = `https://${REDACTED_SECRET_VALUE}@example.com/org/private.git`;
+
 describe("service environment reveal boundary", () => {
 	beforeEach(() => {
 		vi.clearAllMocks();
 		permissionMocks.checkServiceAccess.mockResolvedValue(undefined);
 		permissionMocks.checkServicePermissionAndAccess.mockResolvedValue(
 			undefined,
 		);
+		permissionMocks.hasPermission.mockResolvedValue(false);
 		serverMocks.canEditDeployGitSource.mockResolvedValue(true);
 		serverMocks.findApplicationById.mockResolvedValue(application());
 		serverMocks.findComposeById.mockResolvedValue(compose());
@@ -283,7 +291,15 @@ describe("service environment reveal boundary", () => {
 		const caller = composeRouter.createCaller(createContext());
 
 		const normalRead = await caller.one({ composeId: "compose-1" });
-		expect(normalRead.env).toBe(REDACTED_SECRET_VALUE);
+		expect(normalRead).toMatchObject({
+			env: REDACTED_SECRET_VALUE,
+			composeFile: REDACTED_SECRET_VALUE,
+			customGitUrl: redactedCustomGitUrl,
+		});
+		expect(permissionMocks.hasPermission).toHaveBeenCalledWith(
+			expect.anything(),
+			{ envVars: ["read"] },
+		);
 
 		const revealed = await caller.revealEnvironment({
 			composeId: "compose-1",
@@ -299,6 +315,38 @@ describe("service environment reveal boundary", () => {
 		});
 	});
 
+	it("keeps the compose file for callers that can read env vars", async () => {
+		permissionMocks.hasPermission.mockResolvedValueOnce(true);
+
+		const normalRead = await composeRouter
+			.createCaller(createContext())
+			.one({ composeId: "compose-1" });
+
+		expect(normalRead).toMatchObject({
+			env: REDACTED_SECRET_VALUE,
+			composeFile: compose().composeFile,
+			customGitUrl: redactedCustomGitUrl,
+		});
+	});
+
+	it("redacts compose secrets in update responses", async () => {
+		serverMocks.updateCompose.mockResolvedValueOnce(compose());
+
+		const updated = await composeRouter
+			.createCaller(createContext())
+			.update({ composeId: "compose-1", composeFile: REDACTED_SECRET_VALUE });
+
+		expect(serverMocks.updateCompose).toHaveBeenCalledWith(
+			"compose-1",
+			expect.objectContaining({ composeFile: compose().composeFile }),
+		);
+		expect(updated).toMatchObject({
+			env: REDACTED_SECRET_VALUE,
+			composeFile: REDACTED_SECRET_VALUE,
+			customGitUrl: redactedCustomGitUrl,
+		});
+	});
+
 	it("denies reveal when the service belongs to another organization", async () => {
 		serverMocks.findApplicationById.mockResolvedValueOnce(application("org-2"));
 

apps/dokploy/server/api/routers/compose.ts

@@ -48,6 +48,7 @@ import {
 	checkServiceAccess,
 	checkServicePermissionAndAccess,
 	findMemberByUserId,
+	hasPermission,
 } from "@dokploy/server/services/permission";
 import {
 	type CompleteTemplate,
@@ -60,6 +61,8 @@ import { assertCustomGitUrlAllowed } from "@dokploy/server/utils/providers/git";
 import {
 	preserveSecretPlaceholderFields,
 	redactDeployableServiceSecrets,
+	redactSecretFields,
+	redactSensitiveText,
 } from "@dokploy/server/utils/security/redaction";
 import { TRPCError } from "@trpc/server";
 import { and, desc, eq, ilike, or, sql } from "drizzle-orm";
@@ -101,6 +104,51 @@ import { assertDeploySourceCredentialAccess } from "../utils/deploy-source-acces
 import { assertTargetEnvironmentAccess } from "../utils/placement-access";
 import { assertServiceEnvironmentReadAccess } from "../utils/service-environment";
 
+type SecretRecord = Record<string, unknown>;
+
+const redactCustomGitUrl = <T extends SecretRecord | null | undefined>(
+	record: T,
+) => {
+	if (!record) {
+		return record;
+	}
+
+	const redacted = { ...record };
+	if ("customGitUrl" in redacted) {
+		redacted.customGitUrl = redactSensitiveText(
+			redacted.customGitUrl as string | null | undefined,
+		);
+	}
+
+	return redacted as T;
+};
+
+const redactComposeSecrets = <T extends SecretRecord | null | undefined>(
+	record: T,
+	{ redactComposeFile = true }: { redactComposeFile?: boolean } = {},
+) => {
+	if (!record) {
+		return record;
+	}
+
+	const redacted = redactCustomGitUrl(
+		redactDeployableServiceSecrets(
+			redactGitProviderSecrets(
+				record as T & {
+					bitbucket?: object | null;
+					gitea?: object | null;
+					github?: object | null;
+					gitlab?: object | null;
+				},
+			),
+		),
+	);
+
+	return redactComposeFile
+		? redactSecretFields(redacted, ["composeFile"])
+		: redacted;
+};
+
 const composeSourceUpdateFields = [
 	"bitbucketBranch",
 	"bitbucketId",
@@ -258,7 +306,7 @@ export const composeRouter = createTRPCRouter({
 					resourceId: newService.composeId,
 					resourceName: newService.appName,
 				});
-				return redactDeployableServiceSecrets(newService);
+				return redactComposeSecrets(newService);
 			} catch (error) {
 				throw error;
 			}
@@ -311,8 +359,13 @@ export const composeRouter = createTRPCRouter({
 				}
 			}
 
+			const canReadEnvVars = await hasPermission(ctx, { envVars: ["read"] });
+
 			return {
-				...redactDeployableServiceSecrets(redactGitProviderSecrets(compose)),
+				// The compose file editor loads composeFile from this response.
+				...redactComposeSecrets(compose, {
+					redactComposeFile: !canReadEnvVars,
+				}),
 				hasGitProviderAccess,
 				unauthorizedProvider,
 			};
@@ -360,7 +413,7 @@ export const composeRouter = createTRPCRouter({
 				resourceId: input.composeId,
 				resourceName: updated?.name,
 			});
-			return redactDeployableServiceSecrets(updated);
+			return redactComposeSecrets(updated);
 		}),
 	saveEnvironment: protectedProcedure
 		.input(apiSaveEnvironmentVariablesCompose)
@@ -439,9 +492,7 @@ export const composeRouter = createTRPCRouter({
 				resourceId: composeResult.composeId,
 				resourceName: composeResult.appName,
 			});
-			return redactDeployableServiceSecrets(
-				redactGitProviderSecrets(composeResult),
-			);
+			return redactComposeSecrets(composeResult);
 		}),
 	cleanQueues: protectedProcedure
 		.input(apiFindCompose)
@@ -932,7 +983,7 @@ export const composeRouter = createTRPCRouter({
 				resourceId: compose.composeId,
 				resourceName: compose.name,
 			});
-			return redactDeployableServiceSecrets(compose);
+			return redactComposeSecrets(compose);
 		}),
 
 	templates: protectedProcedure
@@ -1055,7 +1106,7 @@ export const composeRouter = createTRPCRouter({
 				resourceId: input.composeId,
 				resourceName: updatedCompose.name,
 			});
-			return redactDeployableServiceSecrets(updatedCompose);
+			return redactComposeSecrets(updatedCompose);
 		}),
 
 	processTemplate: protectedProcedure