Skip to content

fix(destination): skip project variables with unusable keys - #218

Merged
levivannoort merged 1 commit into
mainfrom
fix/project-variable-key-validation
Aug 12, 2026
Merged

fix(destination): skip project variables with unusable keys#218
levivannoort merged 1 commit into
mainfrom
fix/project-variable-key-validation

Conversation

@levivannoort

Copy link
Copy Markdown
Contributor

What

Validates a project variable's key before writing it into the variables collection, and skips the resource with a reason when it cannot be used.

Why

createProjectVariable writes to the collection directly with createDocument, which bypasses the API's validation of the key. appwrite/appwrite#13181 makes the API reject keys that are not valid environment variable names (^[A-Za-z_]\w*$, max 255) — they become environment variable names at build and runtime, so anything else fails when the build environment is assembled.

That leaves this as the one remaining supported path that can still store an unusable key. A source project can hold one when it was stored before the rule existed, and once imported it fails at build time and can no longer be corrected through the API.

Changes

  • VARIABLE_KEY_PATTERN constant alongside the existing class constants.
  • createProjectVariable checks length and shape first and sets STATUS_SKIPPED with a reason, mirroring how an already-existing key is reported, so one bad key does not abort the whole import.
  • The key is read once into $key and reused by the existing duplicate lookup.

No new dependency: the check is a preg_match against the pattern plus UtopiaDatabase::LENGTH_KEY, rather than pulling in utopia-php/validators for a single rule.

ProjectVariable is the only variable resource in the library, so this covers the full surface.

Testing

Verified with php -l only. composer install fails here with "Could not authenticate against github.com", and this machine runs PHP 8.4 against the package's >=8.5 requirement, so the suite could not be installed or run locally — CI will be the first real run.

A test belongs here and I did not want to guess at it blind: tests/Migration/Unit/Destinations/AppwriteDatabaseStatusTest.php has an in-memory harness (MemoryAdapter + MockSource + a real transfer) that a createProjectVariable case should mirror — asserting an invalid key is skipped, no document is written, and a valid key alongside it still lands. Happy to add it if you'd prefer it in this PR.

Project variables are written straight into the variables collection
here, which bypasses the API's validation of the key. The API only
accepts keys that are valid environment variable names, since that is
what they become at build and runtime, so an import can still store a key
that fails at build time and cannot be fixed through the API afterwards.
A source project can hold such a key when it was stored before the rule
existed.

Check the key before creating the document and skip the resource with a
reason, matching how a duplicate key is already reported, so one bad key
does not abort the import.

Server-side rule: appwrite/appwrite#13181

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@greptile-apps

greptile-apps Bot commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

The PR prevents project variables with keys that cannot be used as environment-variable names from being written directly into Appwrite’s variables collection.

  • Adds a C-style identifier pattern for project-variable keys.
  • Rejects oversized or malformed keys as skipped resources before duplicate lookup and persistence.
  • Reuses the validated key for duplicate detection and document creation.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or independently actionable issue identified.

The validation operates on a guaranteed string, rejects malformed or oversized keys before any database access, and the existing import flow preserves and reports the skipped status while continuing the migration.

Important Files Changed

Filename Overview
src/Migration/Destinations/Appwrite.php Adds an early project-variable key guard that safely marks unusable variables as skipped while preserving the existing import and duplicate-handling flow.

Reviews (1): Last reviewed commit: "fix(destination): skip project variables..." | Re-trigger Greptile

@levivannoort
levivannoort merged commit 77b692b into main Aug 12, 2026
4 checks passed
@levivannoort
levivannoort deleted the fix/project-variable-key-validation branch August 12, 2026 09:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants