Merge branch 'main' into feature/edit-config-entities

Merge pull request 'Update TODO.md with current status (closes #54 )' (#55 ) from update-todo-md into main
Reviewed-on: #55
2026-02-16 09:28:30 +01:00 · 2026-02-16 09:26:15 +01:00 · 2026-02-16 00:26:07 -08:00 · 2026-02-16 09:26:01 +01:00 · 2026-02-16 09:12:08 +01:00
9 changed files with 395 additions and 168 deletions
--- a/TODO.md
+++ b/TODO.md
@@ -54,7 +54,7 @@
 - [x] View deployment history per app
 - [x] Container logs viewing
 - [ ] Deployment rollback to previous image
- [ ] Deployment cancellation
+- [x] Deployment cancellation

 ### Manual Container Controls
 - [x] Restart container
@@ -210,9 +210,9 @@ Protected Routes (require auth):
 - [ ] Update deploy service to save previous image before building new one

 ### 3.3 Deployment Cancellation
- [ ] Add cancellation context to deploy service
- [ ] Add `POST /apps/:id/deployments/:id/cancel` endpoint
- [ ] Handle cleanup of partial builds/containers
+- [x] Add cancellation context to deploy service
+- [x] Add `POST /apps/:id/deployments/:id/cancel` endpoint
+- [x] Handle cleanup of partial builds/containers

 ## Phase 4: Lower Priority (Nice to Have)

--- a/internal/handlers/app.go
+++ b/internal/handlers/app.go
@@ -4,6 +4,8 @@ import (
 	"context"
 	"database/sql"
 	"encoding/json"
+	"errors"
+	"fmt"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -1140,6 +1142,207 @@ func (h *Handlers) HandlePortDelete() http.HandlerFunc {
 	}
 }

+// ErrVolumePathEmpty is returned when a volume path is empty.
+var ErrVolumePathEmpty = errors.New("path must not be empty")
+
+// ErrVolumePathNotAbsolute is returned when a volume path is not absolute.
+var ErrVolumePathNotAbsolute = errors.New("path must be absolute")
+
+// ErrVolumePathNotClean is returned when a volume path is not clean.
+var ErrVolumePathNotClean = errors.New("path must be clean")
+
+// ValidateVolumePath checks that a path is absolute and clean.
+func ValidateVolumePath(p string) error {
+	if p == "" {
+		return ErrVolumePathEmpty
+	}
+
+	if !filepath.IsAbs(p) {
+		return ErrVolumePathNotAbsolute
+	}
+
+	cleaned := filepath.Clean(p)
+	if cleaned != p {
+		return fmt.Errorf("%w (expected %q)", ErrVolumePathNotClean, cleaned)
+	}
+
+	return nil
+}
+
+// HandleEnvVarEdit handles editing an existing environment variable.
+func (h *Handlers) HandleEnvVarEdit() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+		envVarIDStr := chi.URLParam(request, "varID")
+
+		envVarID, parseErr := strconv.ParseInt(envVarIDStr, 10, 64)
+		if parseErr != nil {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		envVar, findErr := models.FindEnvVar(request.Context(), h.db, envVarID)
+		if findErr != nil || envVar == nil || envVar.AppID != appID {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		formErr := request.ParseForm()
+		if formErr != nil {
+			http.Error(writer, "Bad Request", http.StatusBadRequest)
+
+			return
+		}
+
+		key := request.FormValue("key")
+		value := request.FormValue("value")
+
+		if key == "" || value == "" {
+			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+
+			return
+		}
+
+		envVar.Key = key
+		envVar.Value = value
+
+		saveErr := envVar.Save(request.Context())
+		if saveErr != nil {
+			h.log.Error("failed to update env var", "error", saveErr)
+		}
+
+		http.Redirect(
+			writer,
+			request,
+			"/apps/"+appID+"?success=env-updated",
+			http.StatusSeeOther,
+		)
+	}
+}
+
+// HandleLabelEdit handles editing an existing label.
+func (h *Handlers) HandleLabelEdit() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+		labelIDStr := chi.URLParam(request, "labelID")
+
+		labelID, parseErr := strconv.ParseInt(labelIDStr, 10, 64)
+		if parseErr != nil {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		label, findErr := models.FindLabel(request.Context(), h.db, labelID)
+		if findErr != nil || label == nil || label.AppID != appID {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		formErr := request.ParseForm()
+		if formErr != nil {
+			http.Error(writer, "Bad Request", http.StatusBadRequest)
+
+			return
+		}
+
+		key := request.FormValue("key")
+		value := request.FormValue("value")
+
+		if key == "" || value == "" {
+			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+
+			return
+		}
+
+		label.Key = key
+		label.Value = value
+
+		saveErr := label.Save(request.Context())
+		if saveErr != nil {
+			h.log.Error("failed to update label", "error", saveErr)
+		}
+
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+	}
+}
+
+// HandleVolumeEdit handles editing an existing volume mount.
+func (h *Handlers) HandleVolumeEdit() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+		volumeIDStr := chi.URLParam(request, "volumeID")
+
+		volumeID, parseErr := strconv.ParseInt(volumeIDStr, 10, 64)
+		if parseErr != nil {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		volume, findErr := models.FindVolume(request.Context(), h.db, volumeID)
+		if findErr != nil || volume == nil || volume.AppID != appID {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		formErr := request.ParseForm()
+		if formErr != nil {
+			http.Error(writer, "Bad Request", http.StatusBadRequest)
+
+			return
+		}
+
+		hostPath := request.FormValue("host_path")
+		containerPath := request.FormValue("container_path")
+		readOnly := request.FormValue("readonly") == "1"
+
+		if hostPath == "" || containerPath == "" {
+			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+
+			return
+		}
+
+		pathErr := validateVolumePaths(hostPath, containerPath)
+		if pathErr != nil {
+			h.log.Error("invalid volume path", "error", pathErr)
+			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+
+			return
+		}
+
+		volume.HostPath = hostPath
+		volume.ContainerPath = containerPath
+		volume.ReadOnly = readOnly
+
+		saveErr := volume.Save(request.Context())
+		if saveErr != nil {
+			h.log.Error("failed to update volume", "error", saveErr)
+		}
+
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+	}
+}
+
+// validateVolumePaths validates both host and container paths for a volume.
+func validateVolumePaths(hostPath, containerPath string) error {
+	hostErr := ValidateVolumePath(hostPath)
+	if hostErr != nil {
+		return fmt.Errorf("host path: %w", hostErr)
+	}
+
+	containerErr := ValidateVolumePath(containerPath)
+	if containerErr != nil {
+		return fmt.Errorf("container path: %w", containerErr)
+	}
+
+	return nil
+}
+
 // formatDeployKey formats an SSH public key with a descriptive comment.
 // Format: ssh-ed25519 AAAA... upaas_2025-01-15_myapp
 func formatDeployKey(pubKey string, createdAt time.Time, appName string) string {
--- a/internal/handlers/volume_validation_test.go
+++ b/internal/handlers/volume_validation_test.go
@@ -0,0 +1,34 @@
+package handlers //nolint:testpackage // tests exported ValidateVolumePath function
+
+import "testing"
+
+func TestValidateVolumePath(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		path    string
+		wantErr bool
+	}{
+		{"valid absolute path", "/data/myapp", false},
+		{"root path", "/", false},
+		{"empty path", "", true},
+		{"relative path", "data/myapp", true},
+		{"path with dotdot", "/data/../etc", true},
+		{"path with trailing slash", "/data/", true},
+		{"path with double slash", "/data//myapp", true},
+		{"single dot path", ".", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			err := ValidateVolumePath(tt.path)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("ValidateVolumePath(%q) error = %v, wantErr %v",
+					tt.path, err, tt.wantErr)
+			}
+		})
+	}
+}
--- a/internal/middleware/middleware.go
+++ b/internal/middleware/middleware.go
@@ -235,9 +235,9 @@ func (m *Middleware) CSRF() func(http.Handler) http.Handler {
 // loginRateLimit configures the login rate limiter.
 const (
 	loginRateLimit      = rate.Limit(5.0 / 60.0) // 5 requests per 60 seconds
-	loginBurst          = 5                      // allow burst of 5
-	limiterExpiry       = 10 * time.Minute       // evict entries not seen in 10 minutes
-	limiterCleanupEvery = 1 * time.Minute        // sweep interval
+	loginBurst          = 5                       // allow burst of 5
+	limiterExpiry       = 10 * time.Minute        // evict entries not seen in 10 minutes
+	limiterCleanupEvery = 1 * time.Minute         // sweep interval
 )

 // ipLimiterEntry stores a rate limiter with its last-seen timestamp.
@@ -249,8 +249,8 @@ type ipLimiterEntry struct {
 // ipLimiter tracks per-IP rate limiters for login attempts with automatic
 // eviction of stale entries to prevent unbounded memory growth.
 type ipLimiter struct {
-	mu        sync.Mutex
-	limiters  map[string]*ipLimiterEntry
+	mu       sync.Mutex
+	limiters map[string]*ipLimiterEntry
 	lastSweep time.Time
 }

--- a/internal/models/app.go
+++ b/internal/models/app.go
@@ -32,23 +32,23 @@ const (
 type App struct {
 	db *database.Database

-	ID                string
-	Name              string
-	RepoURL           string
-	Branch            string
-	DockerfilePath    string
+	ID             string
+	Name           string
+	RepoURL        string
+	Branch         string
+	DockerfilePath string
 	WebhookSecret     string
 	WebhookSecretHash string
 	SSHPrivateKey     string
-	SSHPublicKey      string
-	ImageID           sql.NullString
-	PreviousImageID   sql.NullString
-	Status            AppStatus
-	DockerNetwork     sql.NullString
-	NtfyTopic         sql.NullString
-	SlackWebhook      sql.NullString
-	CreatedAt         time.Time
-	UpdatedAt         time.Time
+	SSHPublicKey   string
+	ImageID         sql.NullString
+	PreviousImageID sql.NullString
+	Status          AppStatus
+	DockerNetwork  sql.NullString
+	NtfyTopic      sql.NullString
+	SlackWebhook   sql.NullString
+	CreatedAt      time.Time
+	UpdatedAt      time.Time
 }

 // NewApp creates a new App with a database reference.
--- a/internal/server/routes.go
+++ b/internal/server/routes.go
@@ -54,48 +54,51 @@ func (s *Server) SetupRoutes() {
 		r.Group(func(r chi.Router) {
 			r.Use(s.mw.SessionAuth())

-			// Dashboard
-			r.Get("/", s.handlers.HandleDashboard())
+		// Dashboard
+		r.Get("/", s.handlers.HandleDashboard())

-			// Logout
-			r.Post("/logout", s.handlers.HandleLogout())
+		// Logout
+		r.Post("/logout", s.handlers.HandleLogout())

-			// App routes
-			r.Get("/apps/new", s.handlers.HandleAppNew())
-			r.Post("/apps", s.handlers.HandleAppCreate())
-			r.Get("/apps/{id}", s.handlers.HandleAppDetail())
-			r.Get("/apps/{id}/edit", s.handlers.HandleAppEdit())
-			r.Post("/apps/{id}", s.handlers.HandleAppUpdate())
-			r.Post("/apps/{id}/delete", s.handlers.HandleAppDelete())
-			r.Post("/apps/{id}/deploy", s.handlers.HandleAppDeploy())
-			r.Post("/apps/{id}/deployments/cancel", s.handlers.HandleCancelDeploy())
-			r.Get("/apps/{id}/deployments", s.handlers.HandleAppDeployments())
-			r.Get("/apps/{id}/deployments/{deploymentID}/logs", s.handlers.HandleDeploymentLogsAPI())
-			r.Get("/apps/{id}/deployments/{deploymentID}/download", s.handlers.HandleDeploymentLogDownload())
-			r.Get("/apps/{id}/logs", s.handlers.HandleAppLogs())
-			r.Get("/apps/{id}/container-logs", s.handlers.HandleContainerLogsAPI())
-			r.Get("/apps/{id}/status", s.handlers.HandleAppStatusAPI())
-			r.Get("/apps/{id}/recent-deployments", s.handlers.HandleRecentDeploymentsAPI())
-			r.Post("/apps/{id}/rollback", s.handlers.HandleAppRollback())
-			r.Post("/apps/{id}/restart", s.handlers.HandleAppRestart())
-			r.Post("/apps/{id}/stop", s.handlers.HandleAppStop())
-			r.Post("/apps/{id}/start", s.handlers.HandleAppStart())
+		// App routes
+		r.Get("/apps/new", s.handlers.HandleAppNew())
+		r.Post("/apps", s.handlers.HandleAppCreate())
+		r.Get("/apps/{id}", s.handlers.HandleAppDetail())
+		r.Get("/apps/{id}/edit", s.handlers.HandleAppEdit())
+		r.Post("/apps/{id}", s.handlers.HandleAppUpdate())
+		r.Post("/apps/{id}/delete", s.handlers.HandleAppDelete())
+		r.Post("/apps/{id}/deploy", s.handlers.HandleAppDeploy())
+		r.Post("/apps/{id}/deployments/cancel", s.handlers.HandleCancelDeploy())
+		r.Get("/apps/{id}/deployments", s.handlers.HandleAppDeployments())
+		r.Get("/apps/{id}/deployments/{deploymentID}/logs", s.handlers.HandleDeploymentLogsAPI())
+		r.Get("/apps/{id}/deployments/{deploymentID}/download", s.handlers.HandleDeploymentLogDownload())
+		r.Get("/apps/{id}/logs", s.handlers.HandleAppLogs())
+		r.Get("/apps/{id}/container-logs", s.handlers.HandleContainerLogsAPI())
+		r.Get("/apps/{id}/status", s.handlers.HandleAppStatusAPI())
+		r.Get("/apps/{id}/recent-deployments", s.handlers.HandleRecentDeploymentsAPI())
+		r.Post("/apps/{id}/rollback", s.handlers.HandleAppRollback())
+		r.Post("/apps/{id}/restart", s.handlers.HandleAppRestart())
+		r.Post("/apps/{id}/stop", s.handlers.HandleAppStop())
+		r.Post("/apps/{id}/start", s.handlers.HandleAppStart())

-			// Environment variables
-			r.Post("/apps/{id}/env-vars", s.handlers.HandleEnvVarAdd())
-			r.Post("/apps/{id}/env-vars/{varID}/delete", s.handlers.HandleEnvVarDelete())
+		// Environment variables
+		r.Post("/apps/{id}/env-vars", s.handlers.HandleEnvVarAdd())
+		r.Post("/apps/{id}/env-vars/{varID}/edit", s.handlers.HandleEnvVarEdit())
+		r.Post("/apps/{id}/env-vars/{varID}/delete", s.handlers.HandleEnvVarDelete())

-			// Labels
-			r.Post("/apps/{id}/labels", s.handlers.HandleLabelAdd())
-			r.Post("/apps/{id}/labels/{labelID}/delete", s.handlers.HandleLabelDelete())
+		// Labels
+		r.Post("/apps/{id}/labels", s.handlers.HandleLabelAdd())
+		r.Post("/apps/{id}/labels/{labelID}/edit", s.handlers.HandleLabelEdit())
+		r.Post("/apps/{id}/labels/{labelID}/delete", s.handlers.HandleLabelDelete())

-			// Volumes
-			r.Post("/apps/{id}/volumes", s.handlers.HandleVolumeAdd())
-			r.Post("/apps/{id}/volumes/{volumeID}/delete", s.handlers.HandleVolumeDelete())
+		// Volumes
+		r.Post("/apps/{id}/volumes", s.handlers.HandleVolumeAdd())
+		r.Post("/apps/{id}/volumes/{volumeID}/edit", s.handlers.HandleVolumeEdit())
+		r.Post("/apps/{id}/volumes/{volumeID}/delete", s.handlers.HandleVolumeDelete())

-			// Ports
-			r.Post("/apps/{id}/ports", s.handlers.HandlePortAdd())
-			r.Post("/apps/{id}/ports/{portID}/delete", s.handlers.HandlePortDelete())
+		// Ports
+		r.Post("/apps/{id}/ports", s.handlers.HandlePortAdd())
+		r.Post("/apps/{id}/ports/{portID}/delete", s.handlers.HandlePortDelete())
 		})
 	})

--- a/internal/service/deploy/deploy.go
+++ b/internal/service/deploy/deploy.go
@@ -82,7 +82,7 @@ type deploymentLogWriter struct {
 	lineBuffer bytes.Buffer // buffer for incomplete lines
 	mu         sync.Mutex
 	done       chan struct{}
-	flushed    sync.WaitGroup  // waits for flush goroutine to finish
+	flushed    sync.WaitGroup // waits for flush goroutine to finish
 	flushCtx   context.Context //nolint:containedctx // needed for async flush goroutine
 }

--- a/internal/service/deploy/deploy_rollback_test.go
+++ b/internal/service/deploy/deploy_rollback_test.go
@@ -1,74 +0,0 @@
-package deploy_test
-
-import (
-	"context"
-	"database/sql"
-	"log/slog"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"git.eeqj.de/sneak/upaas/internal/models"
-	"git.eeqj.de/sneak/upaas/internal/service/deploy"
-)
-
-func TestRollback_NoPreviousImage(t *testing.T) {
-	t.Parallel()
-
-	svc := deploy.NewTestService(slog.Default())
-	app := &models.App{
-		ID:              "app-rollback-1",
-		PreviousImageID: sql.NullString{},
-	}
-
-	err := svc.Rollback(context.Background(), app)
-	assert.ErrorIs(t, err, deploy.ErrNoPreviousImage)
-}
-
-func TestRollback_EmptyPreviousImage(t *testing.T) {
-	t.Parallel()
-
-	svc := deploy.NewTestService(slog.Default())
-	app := &models.App{
-		ID:              "app-rollback-2",
-		PreviousImageID: sql.NullString{String: "", Valid: true},
-	}
-
-	err := svc.Rollback(context.Background(), app)
-	assert.ErrorIs(t, err, deploy.ErrNoPreviousImage)
-}
-
-func TestRollback_DeploymentLocked(t *testing.T) {
-	t.Parallel()
-
-	svc := deploy.NewTestService(slog.Default())
-
-	// Simulate a deploy holding the lock
-	assert.True(t, svc.TryLockApp("app-rollback-3"))
-	defer svc.UnlockApp("app-rollback-3")
-
-	app := &models.App{
-		ID:              "app-rollback-3",
-		PreviousImageID: sql.NullString{String: "sha256:abc123", Valid: true},
-	}
-
-	err := svc.Rollback(context.Background(), app)
-	assert.ErrorIs(t, err, deploy.ErrDeploymentInProgress)
-}
-
-func TestRollback_LockedApp(t *testing.T) {
-	t.Parallel()
-
-	svc := deploy.NewTestService(slog.Default())
-
-	assert.True(t, svc.TryLockApp("app-rollback-4"))
-	defer svc.UnlockApp("app-rollback-4")
-
-	app := &models.App{
-		ID:              "app-rollback-4",
-		PreviousImageID: sql.NullString{String: "sha256:abc123", Valid: true},
-	}
-
-	err := svc.Rollback(context.Background(), app)
-	assert.ErrorIs(t, err, deploy.ErrDeploymentInProgress)
-}
--- a/templates/app_detail.html
+++ b/templates/app_detail.html
@@ -112,15 +112,34 @@
                </thead>
                <tbody class="table-body">
                    {{range .EnvVars}}
-                    <tr>
-                        <td class="font-mono font-medium">{{.Key}}</td>
-                        <td class="font-mono text-gray-500">{{.Value}}</td>
-                        <td class="text-right">
-                            <form method="POST" action="/apps/{{$.App.ID}}/env/{{.ID}}/delete" class="inline" x-data="confirmAction('Delete this environment variable?')" @submit="confirm($event)">
-                {{ .CSRFField }}
-                                <button type="submit" class="text-error-500 hover:text-error-700 text-sm">Delete</button>
-                            </form>
-                        </td>
+                    <tr x-data="{ editing: false }">
+                        <template x-if="!editing">
+                            <td class="font-mono font-medium">{{.Key}}</td>
+                        </template>
+                        <template x-if="!editing">
+                            <td class="font-mono text-gray-500">{{.Value}}</td>
+                        </template>
+                        <template x-if="!editing">
+                            <td class="text-right">
+                                <button @click="editing = true" class="text-primary-600 hover:text-primary-800 text-sm mr-2">Edit</button>
+                                <form method="POST" action="/apps/{{$.App.ID}}/env-vars/{{.ID}}/delete" class="inline" x-data="confirmAction('Delete this environment variable?')" @submit="confirm($event)">
+                                    {{ $.CSRFField }}
+                                    <button type="submit" class="text-error-500 hover:text-error-700 text-sm">Delete</button>
+                                </form>
+                            </td>
+                        </template>
+                        <template x-if="editing">
+                            <td colspan="3">
+                                <form method="POST" action="/apps/{{$.App.ID}}/env-vars/{{.ID}}/edit" class="flex gap-2 items-center">
+                                    {{ $.CSRFField }}
+                                    <input type="text" name="key" value="{{.Key}}" required class="input flex-1 font-mono text-sm">
+                                    <input type="text" name="value" value="{{.Value}}" required class="input flex-1 font-mono text-sm">
+                                    <button type="submit" class="btn-primary text-sm">Save</button>
+                                    <button type="button" @click="editing = false" class="text-gray-500 hover:text-gray-700 text-sm">Cancel</button>
+                                </form>
+                                <p class="text-xs text-amber-600 mt-1">⚠ Container restart needed after env var changes.</p>
+                            </td>
+                        </template>
                    </tr>
                    {{end}}
                </tbody>
@@ -157,15 +176,33 @@
                        </td>
                    </tr>
                    {{range .Labels}}
-                    <tr>
-                        <td class="font-mono font-medium">{{.Key}}</td>
-                        <td class="font-mono text-gray-500">{{.Value}}</td>
-                        <td class="text-right">
-                            <form method="POST" action="/apps/{{$.App.ID}}/labels/{{.ID}}/delete" class="inline" x-data="confirmAction('Delete this label?')" @submit="confirm($event)">
-                {{ .CSRFField }}
-                                <button type="submit" class="text-error-500 hover:text-error-700 text-sm">Delete</button>
-                            </form>
-                        </td>
+                    <tr x-data="{ editing: false }">
+                        <template x-if="!editing">
+                            <td class="font-mono font-medium">{{.Key}}</td>
+                        </template>
+                        <template x-if="!editing">
+                            <td class="font-mono text-gray-500">{{.Value}}</td>
+                        </template>
+                        <template x-if="!editing">
+                            <td class="text-right">
+                                <button @click="editing = true" class="text-primary-600 hover:text-primary-800 text-sm mr-2">Edit</button>
+                                <form method="POST" action="/apps/{{$.App.ID}}/labels/{{.ID}}/delete" class="inline" x-data="confirmAction('Delete this label?')" @submit="confirm($event)">
+                                    {{ $.CSRFField }}
+                                    <button type="submit" class="text-error-500 hover:text-error-700 text-sm">Delete</button>
+                                </form>
+                            </td>
+                        </template>
+                        <template x-if="editing">
+                            <td colspan="3">
+                                <form method="POST" action="/apps/{{$.App.ID}}/labels/{{.ID}}/edit" class="flex gap-2 items-center">
+                                    {{ $.CSRFField }}
+                                    <input type="text" name="key" value="{{.Key}}" required class="input flex-1 font-mono text-sm">
+                                    <input type="text" name="value" value="{{.Value}}" required class="input flex-1 font-mono text-sm">
+                                    <button type="submit" class="btn-primary text-sm">Save</button>
+                                    <button type="button" @click="editing = false" class="text-gray-500 hover:text-gray-700 text-sm">Cancel</button>
+                                </form>
+                            </td>
+                        </template>
                    </tr>
                    {{end}}
                </tbody>
@@ -195,22 +232,46 @@
                </thead>
                <tbody class="table-body">
                    {{range .Volumes}}
-                    <tr>
-                        <td class="font-mono">{{.HostPath}}</td>
-                        <td class="font-mono">{{.ContainerPath}}</td>
-                        <td>
-                            {{if .ReadOnly}}
-                            <span class="badge-neutral">Read-only</span>
-                            {{else}}
-                            <span class="badge-info">Read-write</span>
-                            {{end}}
-                        </td>
-                        <td class="text-right">
-                            <form method="POST" action="/apps/{{$.App.ID}}/volumes/{{.ID}}/delete" class="inline" x-data="confirmAction('Delete this volume mount?')" @submit="confirm($event)">
-                {{ .CSRFField }}
-                                <button type="submit" class="text-error-500 hover:text-error-700 text-sm">Delete</button>
-                            </form>
-                        </td>
+                    <tr x-data="{ editing: false }">
+                        <template x-if="!editing">
+                            <td class="font-mono">{{.HostPath}}</td>
+                        </template>
+                        <template x-if="!editing">
+                            <td class="font-mono">{{.ContainerPath}}</td>
+                        </template>
+                        <template x-if="!editing">
+                            <td>
+                                {{if .ReadOnly}}
+                                <span class="badge-neutral">Read-only</span>
+                                {{else}}
+                                <span class="badge-info">Read-write</span>
+                                {{end}}
+                            </td>
+                        </template>
+                        <template x-if="!editing">
+                            <td class="text-right">
+                                <button @click="editing = true" class="text-primary-600 hover:text-primary-800 text-sm mr-2">Edit</button>
+                                <form method="POST" action="/apps/{{$.App.ID}}/volumes/{{.ID}}/delete" class="inline" x-data="confirmAction('Delete this volume mount?')" @submit="confirm($event)">
+                                    {{ $.CSRFField }}
+                                    <button type="submit" class="text-error-500 hover:text-error-700 text-sm">Delete</button>
+                                </form>
+                            </td>
+                        </template>
+                        <template x-if="editing">
+                            <td colspan="4">
+                                <form method="POST" action="/apps/{{$.App.ID}}/volumes/{{.ID}}/edit" class="flex gap-2 items-center">
+                                    {{ $.CSRFField }}
+                                    <input type="text" name="host_path" value="{{.HostPath}}" required class="input flex-1 font-mono text-sm" placeholder="/host/path">
+                                    <input type="text" name="container_path" value="{{.ContainerPath}}" required class="input flex-1 font-mono text-sm" placeholder="/container/path">
+                                    <label class="flex items-center gap-1 text-sm text-gray-600 whitespace-nowrap">
+                                        <input type="checkbox" name="readonly" value="1" {{if .ReadOnly}}checked{{end}} class="rounded border-gray-300 text-primary-600 focus:ring-primary-500">
+                                        RO
+                                    </label>
+                                    <button type="submit" class="btn-primary text-sm">Save</button>
+                                    <button type="button" @click="editing = false" class="text-gray-500 hover:text-gray-700 text-sm">Cancel</button>
+                                </form>
+                            </td>
+                        </template>
                    </tr>
                    {{end}}
                </tbody>
Author	SHA1	Message	Date
Jeffrey Paul	0c8dcc2eb1	Merge branch 'main' into feature/edit-config-entities	2026-02-16 09:28:30 +01:00
Jeffrey Paul	d0375555af	Merge pull request 'Update TODO.md with current status (closes #54 )' (#55 ) from update-todo-md into main Reviewed-on: #55	2026-02-16 09:26:15 +01:00
clawbot	e9d284698a	feat: edit existing env vars, labels, and volume mounts Add inline edit functionality for environment variables, labels, and volume mounts on the app detail page. Each entity row now has an Edit button that reveals an inline form using Alpine.js. - POST /apps/{id}/env-vars/{varID}/edit - POST /apps/{id}/labels/{labelID}/edit - POST /apps/{id}/volumes/{volumeID}/edit - Path validation for volume host and container paths - Warning banner about container restart after env var changes - Tests for ValidateVolumePath fixes #67	2026-02-16 00:26:07 -08:00
Jeffrey Paul	96a91b09ca	Merge branch 'main' into update-todo-md	2026-02-16 09:26:01 +01:00
clawbot	6696db957d	Update TODO.md: check off deployment cancellation	2026-02-16 09:12:08 +01:00