fix(webapp): preserve API key restrictions when reading env vars

Mono-RevId: c223e3c56d33e50c024789514cf218f46eded002

Author: carderne

apps/webapp/app/routes/api.v1.projects.$projectRef.envvars.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { prisma } from "~/db.server";
 import { env } from "~/env.server";
 import { authenticateApiKeyWithScope } from "~/services/apiAuth.server";
+import { environmentVariablesForApiKeyResponse } from "~/v3/environmentVariables/environmentVariablesForApiKeyResponse.server";
 import { resolveVariablesForEnvironment } from "~/v3/environmentVariables/environmentVariablesRepository.server";
 
 const ParamsSchema = z.object({
@@ -65,9 +66,6 @@ export async function loader({ request, params }: LoaderFunctionArgs) {
   );
 
   return json({
-    variables: variables.reduce((acc: Record<string, string>, variable) => {
-      acc[variable.key] = variable.value;
-      return acc;
-    }, {}),
+    variables: environmentVariablesForApiKeyResponse(variables, authenticationResult.apiKey),
   });
 }

apps/webapp/app/v3/environmentVariables/environmentVariablesForApiKeyResponse.server.ts

@@ -0,0 +1,18 @@
+type EnvironmentVariable = {
+  key: string;
+  value: string;
+};
+
+/**
+ * Preserve the resolved runtime variables while ensuring an API-key caller
+ * only receives the credential it already presented.
+ */
+export function environmentVariablesForApiKeyResponse(
+  variables: EnvironmentVariable[],
+  presentedApiKey: string
+): Record<string, string> {
+  return variables.reduce<Record<string, string>>((acc, variable) => {
+    acc[variable.key] = variable.key === "TRIGGER_SECRET_KEY" ? presentedApiKey : variable.value;
+    return acc;
+  }, {});
+}

apps/webapp/app/v3/environmentVariables/environmentVariablesForApiKeyResponse.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from "vitest";
+import { environmentVariablesForApiKeyResponse } from "./environmentVariablesForApiKeyResponse.server";
+
+describe("environmentVariablesForApiKeyResponse", () => {
+  it("replaces the resolved root key with the presented API key", () => {
+    expect(
+      environmentVariablesForApiKeyResponse(
+        [
+          { key: "USER_VARIABLE", value: "value" },
+          { key: "TRIGGER_SECRET_KEY", value: "tr_prod_root" },
+          { key: "TRIGGER_API_URL", value: "https://example.com" },
+        ],
+        "tr_prod_sk_presented"
+      )
+    ).toEqual({
+      USER_VARIABLE: "value",
+      TRIGGER_SECRET_KEY: "tr_prod_sk_presented",
+      TRIGGER_API_URL: "https://example.com",
+    });
+  });
+});

apps/webapp/vitest.config.ts

@@ -5,12 +5,12 @@ import tsconfigPaths from "vite-tsconfig-paths";
 export default defineConfig({
   test: {
     sequence: { sequencer: DurationShardingSequencer },
-    // Webapp tests live under test/**; the run-ops migration family
-    // colocates its *.server.test.ts next to source under app/v3/runOpsMigration/.
+    // Webapp tests live under test/**; selected test families colocate next to source.
     // The run-store seam test colocates next to its source at app/v3/runStore.server.test.ts.
     // Pure unit tests for runEngine concerns colocate next to their source file.
     include: [
       "test/**/*.test.ts",
+      "app/v3/environmentVariables/**/*.test.ts",
       "app/v3/runOpsMigration/**/*.test.ts",
       "app/v3/runStore.server.test.ts",
       "app/v3/validateMinimumCronInterval.test.ts",