fix: resolve wsl_v5 whitespace issue in deploy

Add required blank line before assignment statement in
cleanupCancelledDeploy.

TODO.md

@@ -1,312 +0,0 @@
-# UPAAS Implementation Plan
-
-## Feature Roadmap
-
-### Core Infrastructure
-- [x] Uber fx dependency injection
-- [x] Chi router integration
-- [x] Structured logging (slog) with TTY detection
-- [x] Configuration via Viper (env vars, config files)
-- [x] SQLite database with embedded migrations
-- [x] Embedded templates (html/template)
-- [x] Embedded static assets (Tailwind CSS, JS)
-- [x] Server startup (`Server.Run()`)
-- [x] Graceful shutdown (`Server.Shutdown()`)
-- [x] Route wiring (`SetupRoutes()`)
-
-### Authentication & Authorization
-- [x] Single admin user model
-- [x] Argon2id password hashing
-- [x] Initial setup flow (create admin on first run)
-- [x] Cookie-based session management (gorilla/sessions)
-- [x] Session middleware for protected routes
-- [x] Login/logout handlers
-- [ ] API token authentication (for JSON API)
-
-### App Management
-- [x] Create apps with name, repo URL, branch, Dockerfile path
-- [x] Edit app configuration
-- [x] Delete apps (cascades to related entities)
-- [x] List all apps on dashboard
-- [x] View app details
-- [x] Per-app SSH keypair generation (Ed25519)
-- [x] Per-app webhook secret (UUID)
-
-### Container Configuration
-- [x] Environment variables (add, delete per app)
-- [x] Docker labels (add, delete per app)
-- [x] Volume mounts (add, delete per app, with read-only option)
-- [x] Docker network configuration per app
-- [ ] Edit existing environment variables
-- [ ] Edit existing labels
-- [ ] Edit existing volume mounts
-- [ ] CPU/memory resource limits
-
-### Deployment Pipeline
-- [x] Manual deploy trigger from UI
-- [x] Repository cloning via Docker git container
-- [x] SSH key authentication for private repos
-- [x] Docker image building with configurable Dockerfile
-- [x] Container creation with env vars, labels, volumes
-- [x] Old container removal before new deployment
-- [x] Deployment status tracking (building, deploying, success, failed)
-- [x] Deployment logs storage
-- [x] View deployment history per app
-- [x] Container logs viewing
-- [ ] Deployment rollback to previous image
-- [x] Deployment cancellation
-
-### Manual Container Controls
-- [x] Restart container
-- [x] Stop container
-- [x] Start stopped container
-
-### Webhook Integration
-- [x] Gitea webhook endpoint (`/webhook/:secret`)
-- [x] Push event parsing
-- [x] Branch extraction from refs
-- [x] Branch matching (only deploy configured branch)
-- [x] Webhook event audit log
-- [x] Automatic deployment on matching webhook
-- [ ] Webhook event history UI
-- [ ] GitHub webhook support
-- [ ] GitLab webhook support
-
-### Health Monitoring
-- [x] Health check endpoint (`/health`)
-- [x] Application uptime tracking
-- [x] Docker container health status checking
-- [x] Post-deployment health verification (60s delay)
-- [ ] Custom health check commands per app
-
-### Notifications
-- [x] ntfy integration (HTTP POST)
-- [x] Slack-compatible webhook integration
-- [x] Build start/success/failure notifications
-- [x] Deploy success/failure notifications
-- [x] Priority mapping for notification urgency
-
-### Observability
-- [x] Request logging middleware
-- [x] Request ID generation
-- [x] Sentry error reporting (optional)
-- [x] Prometheus metrics endpoint (optional, with basic auth)
-- [ ] Structured logging for all operations
-- [ ] Deployment count/duration metrics
-- [ ] Container health status metrics
-- [ ] Webhook event metrics
-- [ ] Audit log table for user actions
-
-### API
-- [ ] JSON API (`/api/v1/*`)
-- [ ] List apps endpoint
-- [ ] Get app details endpoint
-- [ ] Create app endpoint
-- [ ] Delete app endpoint
-- [ ] Trigger deploy endpoint
-- [ ] List deployments endpoint
-- [ ] API documentation
-
-### UI Features
-- [x] Server-rendered HTML templates
-- [x] Dashboard with app list
-- [x] App creation form
-- [x] App detail view with all configurations
-- [x] App edit form
-- [x] Deployment history page
-- [x] Login page
-- [x] Setup page
-- [ ] Container logs page
-- [ ] Webhook event history page
-- [ ] Settings page (webhook secret, SSH public key)
-- [ ] Real-time deployment log streaming (WebSocket/SSE)
-
-### Future Considerations
-- [ ] Multi-user support with roles
-- [ ] Private Docker registry authentication
-- [ ] Scheduled deployments
-- [ ] Backup/restore of app configurations
-
----
-
-## Phase 1: Critical (Application Cannot Start)
-
-### 1.1 Server Startup Infrastructure
-- [x] Implement `Server.Run()` in `internal/server/server.go`
-  - Start HTTP server with configured address/port
-  - Handle TLS if configured
-  - Block until shutdown signal received
-- [x] Implement `Server.Shutdown()` in `internal/server/server.go`
-  - Graceful shutdown with context timeout
-  - Close database connections
-  - Stop running containers gracefully (optional)
-- [x] Implement `SetupRoutes()` in `internal/server/routes.go`
-  - Wire up chi router with all handlers
-  - Apply middleware (logging, auth, CORS, metrics)
-  - Define public vs protected route groups
-  - Serve static assets and templates
-
-### 1.2 Route Configuration
-```
-Public Routes:
-  GET  /health
-  GET  /setup, POST /setup
-  GET  /login, POST /login
-  POST /webhook/:secret
-
-Protected Routes (require auth):
-  GET  /logout
-  GET  /dashboard
-  GET  /apps/new, POST /apps
-  GET  /apps/:id, POST /apps/:id, DELETE /apps/:id
-  GET  /apps/:id/edit, POST /apps/:id/edit
-  GET  /apps/:id/deployments
-  GET  /apps/:id/logs
-  POST /apps/:id/env-vars, DELETE /apps/:id/env-vars/:id
-  POST /apps/:id/labels, DELETE /apps/:id/labels/:id
-  POST /apps/:id/volumes, DELETE /apps/:id/volumes/:id
-  POST /apps/:id/deploy
-```
-
-## Phase 2: High Priority (Core Functionality Gaps)
-
-### 2.1 Container Logs
-- [x] Implement `HandleAppLogs()` in `internal/handlers/app.go`
-  - Fetch logs via Docker API (`ContainerLogs`)
-  - Support tail parameter (last N lines)
-  - Stream logs with SSE or chunked response
-- [x] Add Docker client method `GetContainerLogs(containerID, tail int) (io.Reader, error)`
-
-### 2.2 Manual Container Controls
-- [x] Add `POST /apps/:id/restart` endpoint
-  - Stop and start container
-  - Record restart in deployment log
-- [x] Add `POST /apps/:id/stop` endpoint
-  - Stop container without deleting
-  - Update app status
-- [x] Add `POST /apps/:id/start` endpoint
-  - Start stopped container
-  - Run health check
-
-## Phase 3: Medium Priority (UX Improvements)
-
-### 3.1 Edit Operations for Related Entities
-- [ ] Add `PUT /apps/:id/env-vars/:id` endpoint
-  - Update existing environment variable value
-  - Trigger container restart with new env
-- [ ] Add `PUT /apps/:id/labels/:id` endpoint
-  - Update existing Docker label
-- [ ] Add `PUT /apps/:id/volumes/:id` endpoint
-  - Update volume mount paths
-  - Validate paths before saving
-
-### 3.2 Deployment Rollback
-- [ ] Add `previous_image_id` column to apps table
-  - Store last successful image ID before new deploy
-- [ ] Add `POST /apps/:id/rollback` endpoint
-  - Stop current container
-  - Start container with previous image
-  - Create deployment record for rollback
-- [ ] Update deploy service to save previous image before building new one
-
-### 3.3 Deployment Cancellation
-- [x] Add cancellation context to deploy service
-- [x] Add `POST /apps/:id/deployments/:id/cancel` endpoint
-- [x] Handle cleanup of partial builds/containers
-
-## Phase 4: Lower Priority (Nice to Have)
-
-### 4.1 JSON API
-- [ ] Add `/api/v1` route group with JSON responses
-- [ ] Implement API endpoints mirroring web routes:
-  - `GET /api/v1/apps` - list apps
-  - `POST /api/v1/apps` - create app
-  - `GET /api/v1/apps/:id` - get app details
-  - `DELETE /api/v1/apps/:id` - delete app
-  - `POST /api/v1/apps/:id/deploy` - trigger deploy
-  - `GET /api/v1/apps/:id/deployments` - list deployments
-- [ ] Add API token authentication (separate from session auth)
-- [ ] Document API in README
-
-### 4.2 Resource Limits
-- [ ] Add `cpu_limit` and `memory_limit` columns to apps table
-- [ ] Add fields to app edit form
-- [ ] Pass limits to Docker container create
-
-### 4.3 UI Improvements
-- [ ] Add webhook event history page
-  - Show received webhooks per app
-  - Display match/no-match status
-- [ ] Add settings page
-  - View/regenerate webhook secret
-  - View SSH public key
-- [ ] Add real-time deployment log streaming
-  - WebSocket or SSE for live build output
-
-### 4.4 Observability
-- [ ] Add structured logging for all operations
-- [ ] Add Prometheus metrics for:
-  - Deployment count/duration
-  - Container health status
-  - Webhook events received
-- [ ] Add audit log table for user actions
-
-## Phase 5: Future Considerations
-
-- [ ] Multi-user support with roles
-- [ ] Private Docker registry authentication
-- [ ] Custom health check commands per app
-- [ ] Scheduled deployments
-- [ ] Backup/restore of app configurations
-- [ ] GitHub/GitLab webhook support (in addition to Gitea)
-
----
-
-## Implementation Notes
-
-### Server.Run() Example
-```go
-func (s *Server) Run() error {
-    s.SetupRoutes()
-
-    srv := &http.Server{
-        Addr:    s.config.ListenAddr,
-        Handler: s.router,
-    }
-
-    go func() {
-        <-s.shutdownCh
-        ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-        defer cancel()
-        srv.Shutdown(ctx)
-    }()
-
-    return srv.ListenAndServe()
-}
-```
-
-### SetupRoutes() Structure
-```go
-func (s *Server) SetupRoutes() {
-    r := chi.NewRouter()
-
-    // Global middleware
-    r.Use(s.middleware.RequestID)
-    r.Use(s.middleware.Logger)
-    r.Use(s.middleware.Recoverer)
-
-    // Public routes
-    r.Get("/health", s.handlers.HandleHealthCheck())
-    r.Get("/login", s.handlers.HandleLoginPage())
-    // ...
-
-    // Protected routes
-    r.Group(func(r chi.Router) {
-        r.Use(s.middleware.SessionAuth)
-        r.Get("/dashboard", s.handlers.HandleDashboard())
-        // ...
-    })
-
-    s.router = r
-}
-```

internal/config/config.go

@@ -51,7 +51,8 @@ type Config struct {
 	MaintenanceMode bool
 	MetricsUsername string
 	MetricsPassword string
-	SessionSecret   string
+	SessionSecret   string `json:"-"`
+	CORSOrigins     string
 	params          *Params
 	log             *slog.Logger
 }
@@ -102,6 +103,7 @@ func setupViper(name string) {
 	viper.SetDefault("METRICS_USERNAME", "")
 	viper.SetDefault("METRICS_PASSWORD", "")
 	viper.SetDefault("SESSION_SECRET", "")
+	viper.SetDefault("CORS_ORIGINS", "")
 }
 
 func buildConfig(log *slog.Logger, params *Params) (*Config, error) {
@@ -136,6 +138,7 @@ func buildConfig(log *slog.Logger, params *Params) (*Config, error) {
 		MetricsUsername: viper.GetString("METRICS_USERNAME"),
 		MetricsPassword: viper.GetString("METRICS_PASSWORD"),
 		SessionSecret:   viper.GetString("SESSION_SECRET"),
+		CORSOrigins:     viper.GetString("CORS_ORIGINS"),
 		params:          params,
 		log:             log,
 	}

internal/docker/client.go

@@ -17,6 +17,7 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/client"
@@ -479,6 +480,20 @@ func (c *Client) CloneRepo(
 	return c.performClone(ctx, cfg)
 }
 
+// RemoveImage removes a Docker image by ID or tag.
+// It returns nil if the image was successfully removed or does not exist.
+func (c *Client) RemoveImage(ctx context.Context, imageID string) error {
+	_, err := c.docker.ImageRemove(ctx, imageID, image.RemoveOptions{
+		Force:         true,
+		PruneChildren: true,
+	})
+	if err != nil && !client.IsErrNotFound(err) {
+		return fmt.Errorf("failed to remove image %s: %w", imageID, err)
+	}
+
+	return nil
+}
+
 func (c *Client) performBuild(
 	ctx context.Context,
 	opts BuildImageOptions,

internal/handlers/api.go

@@ -0,0 +1,375 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+
+	"github.com/go-chi/chi/v5"
+
+	"git.eeqj.de/sneak/upaas/internal/models"
+	"git.eeqj.de/sneak/upaas/internal/service/app"
+)
+
+// apiAppResponse is the JSON representation of an app.
+type apiAppResponse struct {
+	ID             string `json:"id"`
+	Name           string `json:"name"`
+	RepoURL        string `json:"repoUrl"`
+	Branch         string `json:"branch"`
+	DockerfilePath string `json:"dockerfilePath"`
+	Status         string `json:"status"`
+	WebhookSecret  string `json:"webhookSecret"`
+	SSHPublicKey   string `json:"sshPublicKey"`
+	CreatedAt      string `json:"createdAt"`
+	UpdatedAt      string `json:"updatedAt"`
+}
+
+// apiDeploymentResponse is the JSON representation of a deployment.
+type apiDeploymentResponse struct {
+	ID         int64  `json:"id"`
+	AppID      string `json:"appId"`
+	CommitSHA  string `json:"commitSha,omitempty"`
+	Status     string `json:"status"`
+	Duration   string `json:"duration,omitempty"`
+	StartedAt  string `json:"startedAt"`
+	FinishedAt string `json:"finishedAt,omitempty"`
+}
+
+func appToAPI(a *models.App) apiAppResponse {
+	return apiAppResponse{
+		ID:             a.ID,
+		Name:           a.Name,
+		RepoURL:        a.RepoURL,
+		Branch:         a.Branch,
+		DockerfilePath: a.DockerfilePath,
+		Status:         string(a.Status),
+		WebhookSecret:  a.WebhookSecret,
+		SSHPublicKey:   a.SSHPublicKey,
+		CreatedAt:      a.CreatedAt.Format("2006-01-02T15:04:05Z"),
+		UpdatedAt:      a.UpdatedAt.Format("2006-01-02T15:04:05Z"),
+	}
+}
+
+func deploymentToAPI(d *models.Deployment) apiDeploymentResponse {
+	resp := apiDeploymentResponse{
+		ID:        d.ID,
+		AppID:     d.AppID,
+		Status:    string(d.Status),
+		Duration:  d.Duration(),
+		StartedAt: d.StartedAt.Format("2006-01-02T15:04:05Z"),
+	}
+
+	if d.CommitSHA.Valid {
+		resp.CommitSHA = d.CommitSHA.String
+	}
+
+	if d.FinishedAt.Valid {
+		resp.FinishedAt = d.FinishedAt.Time.Format("2006-01-02T15:04:05Z")
+	}
+
+	return resp
+}
+
+// HandleAPILoginPOST returns a handler that authenticates via JSON credentials
+// and sets a session cookie.
+func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
+	type loginResponse struct {
+		UserID   int64  `json:"userId"`
+		Username string `json:"username"`
+	}
+
+	return func(writer http.ResponseWriter, request *http.Request) {
+		var req map[string]string
+
+		decodeErr := json.NewDecoder(request.Body).Decode(&req)
+		if decodeErr != nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "invalid JSON body"},
+				http.StatusBadRequest)
+
+			return
+		}
+
+		username := req["username"]
+		credential := req["password"]
+
+		if username == "" || credential == "" {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "username and password are required"},
+				http.StatusBadRequest)
+
+			return
+		}
+
+		user, authErr := h.auth.Authenticate(request.Context(), username, credential)
+		if authErr != nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "invalid credentials"},
+				http.StatusUnauthorized)
+
+			return
+		}
+
+		sessionErr := h.auth.CreateSession(writer, request, user)
+		if sessionErr != nil {
+			h.log.Error("api: failed to create session", "error", sessionErr)
+			h.respondJSON(writer, request,
+				map[string]string{"error": "failed to create session"},
+				http.StatusInternalServerError)
+
+			return
+		}
+
+		h.respondJSON(writer, request, loginResponse{
+			UserID:   user.ID,
+			Username: user.Username,
+		}, http.StatusOK)
+	}
+}
+
+// HandleAPIListApps returns a handler that lists all apps as JSON.
+func (h *Handlers) HandleAPIListApps() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		apps, err := h.appService.ListApps(request.Context())
+		if err != nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "failed to list apps"},
+				http.StatusInternalServerError)
+
+			return
+		}
+
+		result := make([]apiAppResponse, 0, len(apps))
+		for _, a := range apps {
+			result = append(result, appToAPI(a))
+		}
+
+		h.respondJSON(writer, request, result, http.StatusOK)
+	}
+}
+
+// HandleAPIGetApp returns a handler that gets a single app by ID.
+func (h *Handlers) HandleAPIGetApp() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+
+		application, err := h.appService.GetApp(request.Context(), appID)
+		if err != nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "internal server error"},
+				http.StatusInternalServerError)
+
+			return
+		}
+
+		if application == nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "app not found"},
+				http.StatusNotFound)
+
+			return
+		}
+
+		h.respondJSON(writer, request, appToAPI(application), http.StatusOK)
+	}
+}
+
+// HandleAPICreateApp returns a handler that creates a new app.
+func (h *Handlers) HandleAPICreateApp() http.HandlerFunc {
+	type createRequest struct {
+		Name           string `json:"name"`
+		RepoURL        string `json:"repoUrl"`
+		Branch         string `json:"branch"`
+		DockerfilePath string `json:"dockerfilePath"`
+		DockerNetwork  string `json:"dockerNetwork"`
+		NtfyTopic      string `json:"ntfyTopic"`
+		SlackWebhook   string `json:"slackWebhook"`
+	}
+
+	return func(writer http.ResponseWriter, request *http.Request) {
+		var req createRequest
+
+		decodeErr := json.NewDecoder(request.Body).Decode(&req)
+		if decodeErr != nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "invalid JSON body"},
+				http.StatusBadRequest)
+
+			return
+		}
+
+		if req.Name == "" || req.RepoURL == "" {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "name and repo_url are required"},
+				http.StatusBadRequest)
+
+			return
+		}
+
+		nameErr := validateAppName(req.Name)
+		if nameErr != nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "invalid app name: " + nameErr.Error()},
+				http.StatusBadRequest)
+
+			return
+		}
+
+		createdApp, createErr := h.appService.CreateApp(request.Context(), app.CreateAppInput{
+			Name:           req.Name,
+			RepoURL:        req.RepoURL,
+			Branch:         req.Branch,
+			DockerfilePath: req.DockerfilePath,
+			DockerNetwork:  req.DockerNetwork,
+			NtfyTopic:      req.NtfyTopic,
+			SlackWebhook:   req.SlackWebhook,
+		})
+		if createErr != nil {
+			h.log.Error("api: failed to create app", "error", createErr)
+			h.respondJSON(writer, request,
+				map[string]string{"error": "failed to create app"},
+				http.StatusInternalServerError)
+
+			return
+		}
+
+		h.respondJSON(writer, request, appToAPI(createdApp), http.StatusCreated)
+	}
+}
+
+// HandleAPIDeleteApp returns a handler that deletes an app.
+func (h *Handlers) HandleAPIDeleteApp() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+
+		application, err := h.appService.GetApp(request.Context(), appID)
+		if err != nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "internal server error"},
+				http.StatusInternalServerError)
+
+			return
+		}
+
+		if application == nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "app not found"},
+				http.StatusNotFound)
+
+			return
+		}
+
+		deleteErr := h.appService.DeleteApp(request.Context(), application)
+		if deleteErr != nil {
+			h.log.Error("api: failed to delete app", "error", deleteErr)
+			h.respondJSON(writer, request,
+				map[string]string{"error": "failed to delete app"},
+				http.StatusInternalServerError)
+
+			return
+		}
+
+		h.respondJSON(writer, request,
+			map[string]string{"status": "deleted"}, http.StatusOK)
+	}
+}
+
+// deploymentsPageLimit is the default number of deployments per page.
+const deploymentsPageLimit = 20
+
+// HandleAPIListDeployments returns a handler that lists deployments for an app.
+func (h *Handlers) HandleAPIListDeployments() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+
+		application, err := h.appService.GetApp(request.Context(), appID)
+		if err != nil || application == nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "app not found"},
+				http.StatusNotFound)
+
+			return
+		}
+
+		limit := deploymentsPageLimit
+
+		if l := request.URL.Query().Get("limit"); l != "" {
+			parsed, parseErr := strconv.Atoi(l)
+			if parseErr == nil && parsed > 0 {
+				limit = parsed
+			}
+		}
+
+		deployments, deployErr := application.GetDeployments(
+			request.Context(), limit,
+		)
+		if deployErr != nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "failed to list deployments"},
+				http.StatusInternalServerError)
+
+			return
+		}
+
+		result := make([]apiDeploymentResponse, 0, len(deployments))
+		for _, d := range deployments {
+			result = append(result, deploymentToAPI(d))
+		}
+
+		h.respondJSON(writer, request, result, http.StatusOK)
+	}
+}
+
+// HandleAPITriggerDeploy returns a handler that triggers a deployment for an app.
+func (h *Handlers) HandleAPITriggerDeploy() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+
+		application, err := h.appService.GetApp(request.Context(), appID)
+		if err != nil || application == nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "app not found"},
+				http.StatusNotFound)
+
+			return
+		}
+
+		deployErr := h.deploy.Deploy(request.Context(), application, nil, true)
+		if deployErr != nil {
+			h.log.Error("api: failed to trigger deploy", "error", deployErr)
+			h.respondJSON(writer, request,
+				map[string]string{"error": deployErr.Error()},
+				http.StatusConflict)
+
+			return
+		}
+
+		h.respondJSON(writer, request,
+			map[string]string{"status": "deploying"}, http.StatusAccepted)
+	}
+}
+
+// HandleAPIWhoAmI returns a handler that shows the current authenticated user.
+func (h *Handlers) HandleAPIWhoAmI() http.HandlerFunc {
+	type whoAmIResponse struct {
+		UserID   int64  `json:"userId"`
+		Username string `json:"username"`
+	}
+
+	return func(writer http.ResponseWriter, request *http.Request) {
+		user, err := h.auth.GetCurrentUser(request.Context(), request)
+		if err != nil || user == nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "unauthorized"},
+				http.StatusUnauthorized)
+
+			return
+		}
+
+		h.respondJSON(writer, request, whoAmIResponse{
+			UserID:   user.ID,
+			Username: user.Username,
+		}, http.StatusOK)
+	}
+}

internal/handlers/api_test.go

@@ -0,0 +1,299 @@
+package handlers_test
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// apiRouter builds a chi router with the API routes using session auth middleware.
+func apiRouter(tc *testContext) http.Handler {
+	r := chi.NewRouter()
+
+	r.Route("/api/v1", func(apiR chi.Router) {
+		apiR.Post("/login", tc.handlers.HandleAPILoginPOST())
+
+		apiR.Group(func(apiR chi.Router) {
+			apiR.Use(tc.middleware.APISessionAuth())
+			apiR.Get("/whoami", tc.handlers.HandleAPIWhoAmI())
+			apiR.Get("/apps", tc.handlers.HandleAPIListApps())
+			apiR.Post("/apps", tc.handlers.HandleAPICreateApp())
+			apiR.Get("/apps/{id}", tc.handlers.HandleAPIGetApp())
+			apiR.Delete("/apps/{id}", tc.handlers.HandleAPIDeleteApp())
+			apiR.Post("/apps/{id}/deploy", tc.handlers.HandleAPITriggerDeploy())
+			apiR.Get("/apps/{id}/deployments", tc.handlers.HandleAPIListDeployments())
+		})
+	})
+
+	return r
+}
+
+// setupAPITest creates a test context with a user and returns session cookies.
+func setupAPITest(t *testing.T) (*testContext, []*http.Cookie) {
+	t.Helper()
+
+	tc := setupTestHandlers(t)
+
+	// Create a user.
+	_, err := tc.authSvc.CreateUser(t.Context(), "admin", "password123")
+	require.NoError(t, err)
+
+	// Login via the API to get session cookies.
+	r := apiRouter(tc)
+
+	loginBody := `{"username":"admin","password":"password123"}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(loginBody))
+	req.Header.Set("Content-Type", "application/json")
+
+	rr := httptest.NewRecorder()
+	r.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	cookies := rr.Result().Cookies()
+	require.NotEmpty(t, cookies, "login should return session cookies")
+
+	return tc, cookies
+}
+
+// apiRequest makes an authenticated API request using session cookies.
+func apiRequest(
+	t *testing.T,
+	tc *testContext,
+	cookies []*http.Cookie,
+	method, path string,
+	body string,
+) *httptest.ResponseRecorder {
+	t.Helper()
+
+	var req *http.Request
+	if body != "" {
+		req = httptest.NewRequest(method, path, strings.NewReader(body))
+		req.Header.Set("Content-Type", "application/json")
+	} else {
+		req = httptest.NewRequest(method, path, nil)
+	}
+
+	for _, c := range cookies {
+		req.AddCookie(c)
+	}
+
+	rr := httptest.NewRecorder()
+
+	r := apiRouter(tc)
+	r.ServeHTTP(rr, req)
+
+	return rr
+}
+
+func TestAPILoginSuccess(t *testing.T) {
+	t.Parallel()
+
+	tc := setupTestHandlers(t)
+
+	_, err := tc.authSvc.CreateUser(t.Context(), "admin", "password123")
+	require.NoError(t, err)
+
+	r := apiRouter(tc)
+
+	body := `{"username":"admin","password":"password123"}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	rr := httptest.NewRecorder()
+	r.ServeHTTP(rr, req)
+
+	assert.Equal(t, http.StatusOK, rr.Code)
+
+	var resp map[string]any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &resp))
+	assert.Equal(t, "admin", resp["username"])
+
+	// Should have a Set-Cookie header.
+	assert.NotEmpty(t, rr.Result().Cookies())
+}
+
+func TestAPILoginInvalidCredentials(t *testing.T) {
+	t.Parallel()
+
+	tc := setupTestHandlers(t)
+
+	_, err := tc.authSvc.CreateUser(t.Context(), "admin", "password123")
+	require.NoError(t, err)
+
+	r := apiRouter(tc)
+
+	body := `{"username":"admin","password":"wrong"}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	rr := httptest.NewRecorder()
+	r.ServeHTTP(rr, req)
+
+	assert.Equal(t, http.StatusUnauthorized, rr.Code)
+}
+
+func TestAPILoginMissingFields(t *testing.T) {
+	t.Parallel()
+
+	tc := setupTestHandlers(t)
+
+	r := apiRouter(tc)
+
+	body := `{"username":"","password":""}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	rr := httptest.NewRecorder()
+	r.ServeHTTP(rr, req)
+
+	assert.Equal(t, http.StatusBadRequest, rr.Code)
+}
+
+func TestAPIRejectsUnauthenticated(t *testing.T) {
+	t.Parallel()
+
+	tc := setupTestHandlers(t)
+
+	r := apiRouter(tc)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/apps", nil)
+	rr := httptest.NewRecorder()
+	r.ServeHTTP(rr, req)
+
+	assert.Equal(t, http.StatusUnauthorized, rr.Code)
+}
+
+func TestAPIWhoAmI(t *testing.T) {
+	t.Parallel()
+
+	tc, cookies := setupAPITest(t)
+
+	rr := apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/whoami", "")
+	assert.Equal(t, http.StatusOK, rr.Code)
+
+	var resp map[string]any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &resp))
+	assert.Equal(t, "admin", resp["username"])
+}
+
+func TestAPIListAppsEmpty(t *testing.T) {
+	t.Parallel()
+
+	tc, cookies := setupAPITest(t)
+
+	rr := apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps", "")
+	assert.Equal(t, http.StatusOK, rr.Code)
+
+	var apps []any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &apps))
+	assert.Empty(t, apps)
+}
+
+func TestAPICreateApp(t *testing.T) {
+	t.Parallel()
+
+	tc, cookies := setupAPITest(t)
+
+	body := `{"name":"test-app","repoUrl":"https://github.com/example/repo"}`
+	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
+	assert.Equal(t, http.StatusCreated, rr.Code)
+
+	var app map[string]any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &app))
+	assert.Equal(t, "test-app", app["name"])
+	assert.Equal(t, "pending", app["status"])
+}
+
+func TestAPICreateAppValidation(t *testing.T) {
+	t.Parallel()
+
+	tc, cookies := setupAPITest(t)
+
+	body := `{"name":"","repoUrl":""}`
+	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
+	assert.Equal(t, http.StatusBadRequest, rr.Code)
+}
+
+func TestAPIGetApp(t *testing.T) {
+	t.Parallel()
+
+	tc, cookies := setupAPITest(t)
+
+	body := `{"name":"my-app","repoUrl":"https://github.com/example/repo"}`
+	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
+	require.Equal(t, http.StatusCreated, rr.Code)
+
+	var created map[string]any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &created))
+
+	appID, ok := created["id"].(string)
+	require.True(t, ok)
+
+	rr = apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps/"+appID, "")
+	assert.Equal(t, http.StatusOK, rr.Code)
+
+	var app map[string]any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &app))
+	assert.Equal(t, "my-app", app["name"])
+}
+
+func TestAPIGetAppNotFound(t *testing.T) {
+	t.Parallel()
+
+	tc, cookies := setupAPITest(t)
+
+	rr := apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps/nonexistent", "")
+	assert.Equal(t, http.StatusNotFound, rr.Code)
+}
+
+func TestAPIDeleteApp(t *testing.T) {
+	t.Parallel()
+
+	tc, cookies := setupAPITest(t)
+
+	body := `{"name":"delete-me","repoUrl":"https://github.com/example/repo"}`
+	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
+	require.Equal(t, http.StatusCreated, rr.Code)
+
+	var created map[string]any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &created))
+
+	appID, ok := created["id"].(string)
+	require.True(t, ok)
+
+	rr = apiRequest(t, tc, cookies, http.MethodDelete, "/api/v1/apps/"+appID, "")
+	assert.Equal(t, http.StatusOK, rr.Code)
+
+	rr = apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps/"+appID, "")
+	assert.Equal(t, http.StatusNotFound, rr.Code)
+}
+
+func TestAPIListDeployments(t *testing.T) {
+	t.Parallel()
+
+	tc, cookies := setupAPITest(t)
+
+	body := `{"name":"deploy-app","repoUrl":"https://github.com/example/repo"}`
+	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
+	require.Equal(t, http.StatusCreated, rr.Code)
+
+	var created map[string]any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &created))
+
+	appID, ok := created["id"].(string)
+	require.True(t, ok)
+
+	rr = apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps/"+appID+"/deployments", "")
+	assert.Equal(t, http.StatusOK, rr.Code)
+
+	var deployments []any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &deployments))
+	assert.Empty(t, deployments)
+}

internal/handlers/app.go

@@ -499,7 +499,7 @@ func (h *Handlers) HandleAppLogs() http.HandlerFunc {
 			return
 		}
 
-		_, _ = writer.Write([]byte(logs))
+		_, _ = writer.Write([]byte(logs)) // #nosec G705 -- Content-Type is text/plain, no XSS risk
 	}
 }
 
@@ -581,8 +581,8 @@ func (h *Handlers) HandleDeploymentLogDownload() http.HandlerFunc {
 			return
 		}
 
-		// Check if file exists
+		// Check if file exists — logPath is constructed internally, not from user input
-		_, err := os.Stat(logPath)
+		_, err := os.Stat(logPath) // #nosec G703 -- path from internal GetLogFilePath, not user input
 		if os.IsNotExist(err) {
 			http.NotFound(writer, request)
 

internal/handlers/handlers_test.go

@@ -24,6 +24,7 @@ import (
 	"git.eeqj.de/sneak/upaas/internal/handlers"
 	"git.eeqj.de/sneak/upaas/internal/healthcheck"
 	"git.eeqj.de/sneak/upaas/internal/logger"
+	"git.eeqj.de/sneak/upaas/internal/middleware"
 	"git.eeqj.de/sneak/upaas/internal/service/app"
 	"git.eeqj.de/sneak/upaas/internal/service/auth"
 	"git.eeqj.de/sneak/upaas/internal/service/deploy"
@@ -36,6 +37,7 @@ type testContext struct {
 	database   *database.Database
 	authSvc    *auth.Service
 	appSvc     *app.Service
+	middleware *middleware.Middleware
 }
 
 func createTestConfig(t *testing.T) *config.Config {
@@ -166,11 +168,20 @@ func setupTestHandlers(t *testing.T) *testContext {
 	)
 	require.NoError(t, handlerErr)
 
+	mw, mwErr := middleware.New(fx.Lifecycle(nil), middleware.Params{
+		Logger:  logInstance,
+		Globals: globalInstance,
+		Config:  cfg,
+		Auth:    authSvc,
+	})
+	require.NoError(t, mwErr)
+
 	return &testContext{
 		handlers:   handlersInstance,
 		database:   dbInstance,
 		authSvc:    authSvc,
 		appSvc:     appSvc,
+		middleware: mw,
 	}
 }
 

internal/middleware/cors_test.go

@@ -0,0 +1,81 @@
+package middleware //nolint:testpackage // tests internal CORS behavior
+
+import (
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"git.eeqj.de/sneak/upaas/internal/config"
+)
+
+//nolint:gosec // test credentials
+func newCORSTestMiddleware(corsOrigins string) *Middleware {
+	return &Middleware{
+		log: slog.Default(),
+		params: &Params{
+			Config: &config.Config{
+				CORSOrigins:   corsOrigins,
+				SessionSecret: "test-secret-32-bytes-long-enough",
+			},
+		},
+	}
+}
+
+func TestCORS_NoOriginsConfigured_NoCORSHeaders(t *testing.T) {
+	t.Parallel()
+
+	m := newCORSTestMiddleware("")
+	handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("Origin", "https://evil.com")
+
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"),
+		"expected no CORS headers when no origins configured")
+}
+
+func TestCORS_OriginsConfigured_AllowsMatchingOrigin(t *testing.T) {
+	t.Parallel()
+
+	m := newCORSTestMiddleware("https://app.example.com,https://other.example.com")
+	handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("Origin", "https://app.example.com")
+
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	assert.Equal(t, "https://app.example.com",
+		rec.Header().Get("Access-Control-Allow-Origin"))
+	assert.Equal(t, "true",
+		rec.Header().Get("Access-Control-Allow-Credentials"))
+}
+
+func TestCORS_OriginsConfigured_RejectsNonMatchingOrigin(t *testing.T) {
+	t.Parallel()
+
+	m := newCORSTestMiddleware("https://app.example.com")
+	handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("Origin", "https://evil.com")
+
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"),
+		"expected no CORS headers for non-matching origin")
+}

internal/middleware/middleware.go

@@ -177,17 +177,48 @@ func realIP(r *http.Request) string {
 }
 
 // CORS returns CORS middleware.
+// When UPAAS_CORS_ORIGINS is empty (default), no CORS headers are sent
+// (same-origin only). When configured, only the specified origins are
+// allowed and credentials (cookies) are permitted.
 func (m *Middleware) CORS() func(http.Handler) http.Handler {
+	origins := parseCORSOrigins(m.params.Config.CORSOrigins)
+
+	// No origins configured — no CORS headers (same-origin policy).
+	if len(origins) == 0 {
+		return func(next http.Handler) http.Handler {
+			return next
+		}
+	}
+
 	return cors.Handler(cors.Options{
-		AllowedOrigins:   []string{"*"},
+		AllowedOrigins:   origins,
 		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
 		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
 		ExposedHeaders:   []string{"Link"},
-		AllowCredentials: false,
+		AllowCredentials: true,
 		MaxAge:           corsMaxAge,
 	})
 }
 
+// parseCORSOrigins splits a comma-separated origin string into a slice,
+// trimming whitespace. Returns nil if the input is empty.
+func parseCORSOrigins(raw string) []string {
+	if raw == "" {
+		return nil
+	}
+
+	parts := strings.Split(raw, ",")
+	origins := make([]string, 0, len(parts))
+
+	for _, p := range parts {
+		if o := strings.TrimSpace(p); o != "" {
+			origins = append(origins, o)
+		}
+	}
+
+	return origins
+}
+
 // MetricsAuth returns basic auth middleware for metrics endpoint.
 func (m *Middleware) MetricsAuth() func(http.Handler) http.Handler {
 	if m.params.Config.MetricsUsername == "" {
@@ -339,6 +370,27 @@ func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
 	}
 }
 
+// APISessionAuth returns middleware that requires session authentication for API routes.
+// Unlike SessionAuth, it returns JSON 401 responses instead of redirecting to /login.
+func (m *Middleware) APISessionAuth() func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(
+			writer http.ResponseWriter,
+			request *http.Request,
+		) {
+			user, err := m.params.Auth.GetCurrentUser(request.Context(), request)
+			if err != nil || user == nil {
+				writer.Header().Set("Content-Type", "application/json")
+				http.Error(writer, `{"error":"unauthorized"}`, http.StatusUnauthorized)
+
+				return
+			}
+
+			next.ServeHTTP(writer, request)
+		})
+	}
+}
+
 // SetupRequired returns middleware that redirects to setup if no user exists.
 func (m *Middleware) SetupRequired() func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {

internal/server/routes.go

@@ -102,6 +102,26 @@ func (s *Server) SetupRoutes() {
 		})
 	})
 
+	// API v1 routes (cookie-based session auth, no CSRF)
+	s.router.Route("/api/v1", func(r chi.Router) {
+		// Login endpoint is public (returns session cookie)
+		r.With(s.mw.LoginRateLimit()).Post("/login", s.handlers.HandleAPILoginPOST())
+
+		// All other API routes require session auth
+		r.Group(func(r chi.Router) {
+			r.Use(s.mw.APISessionAuth())
+
+			r.Get("/whoami", s.handlers.HandleAPIWhoAmI())
+
+			r.Get("/apps", s.handlers.HandleAPIListApps())
+			r.Post("/apps", s.handlers.HandleAPICreateApp())
+			r.Get("/apps/{id}", s.handlers.HandleAPIGetApp())
+			r.Delete("/apps/{id}", s.handlers.HandleAPIDeleteApp())
+			r.Post("/apps/{id}/deploy", s.handlers.HandleAPITriggerDeploy())
+			r.Get("/apps/{id}/deployments", s.handlers.HandleAPIListDeployments())
+		})
+	})
+
 	// Metrics endpoint (optional, with basic auth)
 	if s.params.Config.MetricsUsername != "" {
 		s.router.Group(func(r chi.Router) {

internal/service/deploy/deploy.go

@@ -11,6 +11,7 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
+	"strings"
 	"sync"
 	"time"
 
@@ -472,7 +473,7 @@ func (svc *Service) runBuildAndDeploy(
 	// Build phase with timeout
 	imageID, err := svc.buildImageWithTimeout(deployCtx, app, deployment)
 	if err != nil {
-		cancelErr := svc.checkCancelled(deployCtx, bgCtx, app, deployment)
+		cancelErr := svc.checkCancelled(deployCtx, bgCtx, app, deployment, "")
 		if cancelErr != nil {
 			return cancelErr
 		}
@@ -485,7 +486,7 @@ func (svc *Service) runBuildAndDeploy(
 	// Deploy phase with timeout
 	err = svc.deployContainerWithTimeout(deployCtx, app, deployment, imageID)
 	if err != nil {
-		cancelErr := svc.checkCancelled(deployCtx, bgCtx, app, deployment)
+		cancelErr := svc.checkCancelled(deployCtx, bgCtx, app, deployment, imageID)
 		if cancelErr != nil {
 			return cancelErr
 		}
@@ -661,24 +662,77 @@ func (svc *Service) cancelActiveDeploy(appID string) {
 }
 
 // checkCancelled checks if the deploy context was cancelled (by a newer deploy)
-// and if so, marks the deployment as cancelled. Returns ErrDeployCancelled or nil.
+// and if so, marks the deployment as cancelled and cleans up orphan resources.
+// Returns ErrDeployCancelled or nil.
 func (svc *Service) checkCancelled(
 	deployCtx context.Context,
 	bgCtx context.Context,
 	app *models.App,
 	deployment *models.Deployment,
+	imageID string,
 ) error {
 	if !errors.Is(deployCtx.Err(), context.Canceled) {
 		return nil
 	}
 
-	svc.log.Info("deployment cancelled by newer deploy", "app", app.Name)
+	svc.log.Info("deployment cancelled", "app", app.Name)
+
+	svc.cleanupCancelledDeploy(bgCtx, app, deployment, imageID)
 
 	_ = deployment.MarkFinished(bgCtx, models.DeploymentStatusCancelled)
 
 	return ErrDeployCancelled
 }
 
+// cleanupCancelledDeploy removes orphan resources left by a cancelled deployment.
+func (svc *Service) cleanupCancelledDeploy(
+	ctx context.Context,
+	app *models.App,
+	deployment *models.Deployment,
+	imageID string,
+) {
+	// Clean up the intermediate Docker image if one was built
+	if imageID != "" {
+		removeErr := svc.docker.RemoveImage(ctx, imageID)
+		if removeErr != nil {
+			svc.log.Error("failed to remove image from cancelled deploy",
+				"error", removeErr, "app", app.Name, "image", imageID)
+			_ = deployment.AppendLog(ctx, "WARNING: failed to clean up image "+imageID+": "+removeErr.Error())
+		} else {
+			svc.log.Info("cleaned up image from cancelled deploy",
+				"app", app.Name, "image", imageID)
+			_ = deployment.AppendLog(ctx, "Cleaned up intermediate image: "+imageID)
+		}
+	}
+
+	// Clean up the build directory for this deployment
+	buildDir := svc.GetBuildDir(app.Name)
+
+	entries, err := os.ReadDir(buildDir)
+	if err != nil {
+		return
+	}
+
+	prefix := fmt.Sprintf("%d-", deployment.ID)
+
+	for _, entry := range entries {
+		if entry.IsDir() && strings.HasPrefix(entry.Name(), prefix) {
+			dirPath := filepath.Join(buildDir, entry.Name())
+
+			removeErr := os.RemoveAll(dirPath)
+			if removeErr != nil {
+				svc.log.Error("failed to remove build dir from cancelled deploy",
+					"error", removeErr, "path", dirPath)
+			} else {
+				svc.log.Info("cleaned up build dir from cancelled deploy",
+					"app", app.Name, "path", dirPath)
+
+				_ = deployment.AppendLog(ctx, "Cleaned up build directory")
+			}
+		}
+	}
+}
+
 func (svc *Service) fetchWebhookEvent(
 	ctx context.Context,
 	webhookEventID *int64,

internal/service/deploy/deploy_cleanup_test.go

@@ -0,0 +1,63 @@
+package deploy_test
+
+import (
+	"context"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"git.eeqj.de/sneak/upaas/internal/config"
+	"git.eeqj.de/sneak/upaas/internal/service/deploy"
+)
+
+func TestCleanupCancelledDeploy_RemovesBuildDir(t *testing.T) {
+	t.Parallel()
+
+	tmpDir := t.TempDir()
+	cfg := &config.Config{DataDir: tmpDir}
+
+	svc := deploy.NewTestServiceWithConfig(slog.Default(), cfg, nil)
+
+	// Create a fake build directory matching the deployment pattern
+	appName := "test-app"
+	buildDir := svc.GetBuildDirExported(appName)
+	require.NoError(t, os.MkdirAll(buildDir, 0o750))
+
+	// Create deployment-specific dir: <deploymentID>-<random>
+	deployDir := filepath.Join(buildDir, "42-abc123")
+	require.NoError(t, os.MkdirAll(deployDir, 0o750))
+
+	// Create a file inside to verify full removal
+	require.NoError(t, os.WriteFile(filepath.Join(deployDir, "work"), []byte("test"), 0o600))
+
+	// Also create a dir for a different deployment (should NOT be removed)
+	otherDir := filepath.Join(buildDir, "99-xyz789")
+	require.NoError(t, os.MkdirAll(otherDir, 0o750))
+
+	// Run cleanup for deployment 42
+	svc.CleanupCancelledDeploy(context.Background(), appName, 42, "")
+
+	// Deployment 42's dir should be gone
+	_, err := os.Stat(deployDir)
+	assert.True(t, os.IsNotExist(err), "deployment build dir should be removed")
+
+	// Deployment 99's dir should still exist
+	_, err = os.Stat(otherDir)
+	assert.NoError(t, err, "other deployment build dir should not be removed")
+}
+
+func TestCleanupCancelledDeploy_NoBuildDir(t *testing.T) {
+	t.Parallel()
+
+	tmpDir := t.TempDir()
+	cfg := &config.Config{DataDir: tmpDir}
+
+	svc := deploy.NewTestServiceWithConfig(slog.Default(), cfg, nil)
+
+	// Should not panic when build dir doesn't exist
+	svc.CleanupCancelledDeploy(context.Background(), "nonexistent-app", 1, "")
+}

internal/service/deploy/export_test.go

@@ -2,7 +2,14 @@ package deploy
 
 import (
 	"context"
+	"fmt"
 	"log/slog"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"git.eeqj.de/sneak/upaas/internal/config"
+	"git.eeqj.de/sneak/upaas/internal/docker"
 )
 
 // NewTestService creates a Service with minimal dependencies for testing.
@@ -31,3 +38,45 @@ func (svc *Service) TryLockApp(appID string) bool {
 func (svc *Service) UnlockApp(appID string) {
 	svc.unlockApp(appID)
 }
+
+// NewTestServiceWithConfig creates a Service with config and docker client for testing.
+func NewTestServiceWithConfig(log *slog.Logger, cfg *config.Config, dockerClient *docker.Client) *Service {
+	return &Service{
+		log:    log,
+		config: cfg,
+		docker: dockerClient,
+	}
+}
+
+// CleanupCancelledDeploy exposes the build directory cleanup portion of
+// cleanupCancelledDeploy for testing. It removes build directories matching
+// the deployment ID prefix.
+func (svc *Service) CleanupCancelledDeploy(
+	_ context.Context,
+	appName string,
+	deploymentID int64,
+	_ string,
+) {
+	// We can't create real models.App/Deployment in tests easily,
+	// so we test the build dir cleanup portion directly.
+	buildDir := svc.GetBuildDir(appName)
+
+	entries, err := os.ReadDir(buildDir)
+	if err != nil {
+		return
+	}
+
+	prefix := fmt.Sprintf("%d-", deploymentID)
+
+	for _, entry := range entries {
+		if entry.IsDir() && strings.HasPrefix(entry.Name(), prefix) {
+			dirPath := filepath.Join(buildDir, entry.Name())
+			_ = os.RemoveAll(dirPath)
+		}
+	}
+}
+
+// GetBuildDirExported exposes GetBuildDir for testing.
+func (svc *Service) GetBuildDirExported(appName string) string {
+	return svc.GetBuildDir(appName)
+}

internal/service/notify/notify.go

@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"log/slog"
 	"net/http"
+	"net/url"
 	"time"
 
 	"go.uber.org/fx"
@@ -247,10 +248,15 @@ func (svc *Service) sendNtfy(
 ) error {
 	svc.log.Debug("sending ntfy notification", "topic", topic, "title", title)
 
+	parsedURL, err := url.ParseRequestURI(topic)
+	if err != nil {
+		return fmt.Errorf("invalid ntfy topic URL: %w", err)
+	}
+
 	request, err := http.NewRequestWithContext(
 		ctx,
 		http.MethodPost,
-		topic,
+		parsedURL.String(),
 		bytes.NewBufferString(message),
 	)
 	if err != nil {
@@ -260,7 +266,7 @@ func (svc *Service) sendNtfy(
 	request.Header.Set("Title", title)
 	request.Header.Set("Priority", svc.ntfyPriority(priority))
 
-	resp, err := svc.client.Do(request)
+	resp, err := svc.client.Do(request) // #nosec G704 -- URL from validated config, not user input
 	if err != nil {
 		return fmt.Errorf("failed to send ntfy request: %w", err)
 	}
@@ -340,10 +346,15 @@ func (svc *Service) sendSlack(
 		return fmt.Errorf("failed to marshal slack payload: %w", err)
 	}
 
+	parsedWebhookURL, err := url.ParseRequestURI(webhookURL)
+	if err != nil {
+		return fmt.Errorf("invalid slack webhook URL: %w", err)
+	}
+
 	request, err := http.NewRequestWithContext(
 		ctx,
 		http.MethodPost,
-		webhookURL,
+		parsedWebhookURL.String(),
 		bytes.NewBuffer(body),
 	)
 	if err != nil {
@@ -352,7 +363,7 @@ func (svc *Service) sendSlack(
 
 	request.Header.Set("Content-Type", "application/json")
 
-	resp, err := svc.client.Do(request)
+	resp, err := svc.client.Do(request) // #nosec G704 -- URL from validated config, not user input
 	if err != nil {
 		return fmt.Errorf("failed to send slack request: %w", err)
 	}

internal/ssh/keygen.go

@@ -12,7 +12,7 @@ import (
 
 // KeyPair contains an SSH key pair.
 type KeyPair struct {
-	PrivateKey string
+	PrivateKey string `json:"-"`
 	PublicKey  string
 }