Server Panel Bug Report

Overall health

• Panel is reachable.
• API health endpoint returns OK: {"status":"ok","version":"1.0.14"}.
• Login page renders correctly with no browser console errors.
• Frontend unit tests passed: 1365/1365.
• Main services are running: Apache, Redis, PHP-FPM panel pool, queue worker, frontend service.

Bug 1 — Frontend Next.js cache permission issue

Problem: The Next.js frontend service runs as user panel, but parts of /var/www/panel/frontend/.next are owned by root.

Evidence:

EACCES: permission denied, mkdir /var/www/panel/frontend/.next/standalone/.next/cache

Manual write test as panel also failed:

sudo -u panel mkdir -p /var/www/panel/frontend/.next/standalone/.next/cache/test-write
mkdir: Permission denied

Impact: The panel may still load, but Next.js cannot write runtime/prerender cache. This can cause repeated log errors, unstable behavior after restart, or page/cache failures.

Quick server fix:

sudo chown -R panel:panel /var/www/panel/frontend/.next
sudo systemctl restart panel-frontend

Permanent fix: Ensure frontend build/deploy/update runs as panel, or run ownership correction after build:

chown -R panel:panel /var/www/panel/frontend/.next

Issue 2 — Panel update check should use fresh release data when starting update

Live server state:

• Installed version: 1.0.14
• Latest release: 1.0.17

So on this live server, starting an update is currently correct.

Test failure found: Backend temp-clone Pest suite failed in PanelUpdateApplyTest. The test expected HTTP 422 for “already latest/no update”, but got 202.

Likely cause: When starting an update, code uses cached latest release data:

$latest = $this->releases->latest();

Suggested safer fix:

$latest = $this->releases->latest(fresh: true);

Reason: A mutating update action should re-check the release host fresh instead of trusting cached availability data.

Full authenticated panel E2E still needs admin access

Public/server tests were completed. Full section-by-section UI testing needs either:

1. Admin login credentials, or
2. Permission to create a temporary admin user, test all sections, then delete it.