-
Notifications
You must be signed in to change notification settings - Fork 967
feat(desktop): redesign environment variables table #1420
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
e1669f1
a83e5b2
a782d4a
935dac5
7eaa4b1
81110b9
648b287
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -250,6 +250,7 @@ jobs: | |
| STRIPE_PRO_MONTHLY_PRICE_ID: ${{ secrets.STRIPE_PRO_MONTHLY_PRICE_ID }} | ||
| STRIPE_PRO_YEARLY_PRICE_ID: ${{ secrets.STRIPE_PRO_YEARLY_PRICE_ID }} | ||
| SLACK_BILLING_WEBHOOK_URL: ${{ secrets.SLACK_BILLING_WEBHOOK_URL }} | ||
| SECRETS_ENCRYPTION_KEY: ${{ secrets.SECRETS_ENCRYPTION_KEY }} | ||
| run: | | ||
| vercel pull --yes --environment=preview --token=$VERCEL_TOKEN | ||
| vercel build --token=$VERCEL_TOKEN | ||
|
|
@@ -294,7 +295,8 @@ jobs: | |
| --env STRIPE_WEBHOOK_SECRET=$STRIPE_WEBHOOK_SECRET \ | ||
| --env STRIPE_PRO_MONTHLY_PRICE_ID=$STRIPE_PRO_MONTHLY_PRICE_ID \ | ||
| --env STRIPE_PRO_YEARLY_PRICE_ID=$STRIPE_PRO_YEARLY_PRICE_ID \ | ||
| --env SLACK_BILLING_WEBHOOK_URL=$SLACK_BILLING_WEBHOOK_URL) | ||
| --env SLACK_BILLING_WEBHOOK_URL=$SLACK_BILLING_WEBHOOK_URL \ | ||
| --env SECRETS_ENCRYPTION_KEY=$SECRETS_ENCRYPTION_KEY) | ||
| vercel alias $VERCEL_URL ${{ env.API_ALIAS }} --scope=$VERCEL_ORG_ID --token=$VERCEL_TOKEN | ||
| echo "vercel_url=$VERCEL_URL" >> $GITHUB_OUTPUT | ||
|
|
||
|
|
@@ -379,6 +381,7 @@ jobs: | |
| STRIPE_PRO_MONTHLY_PRICE_ID: ${{ secrets.STRIPE_PRO_MONTHLY_PRICE_ID }} | ||
| STRIPE_PRO_YEARLY_PRICE_ID: ${{ secrets.STRIPE_PRO_YEARLY_PRICE_ID }} | ||
| SLACK_BILLING_WEBHOOK_URL: ${{ secrets.SLACK_BILLING_WEBHOOK_URL }} | ||
| SECRETS_ENCRYPTION_KEY: ${{ secrets.SECRETS_ENCRYPTION_KEY }} | ||
| run: | | ||
| vercel pull --yes --environment=preview --token=$VERCEL_TOKEN | ||
| vercel build --token=$VERCEL_TOKEN | ||
|
|
@@ -404,7 +407,8 @@ jobs: | |
| --env STRIPE_WEBHOOK_SECRET=$STRIPE_WEBHOOK_SECRET \ | ||
| --env STRIPE_PRO_MONTHLY_PRICE_ID=$STRIPE_PRO_MONTHLY_PRICE_ID \ | ||
| --env STRIPE_PRO_YEARLY_PRICE_ID=$STRIPE_PRO_YEARLY_PRICE_ID \ | ||
| --env SLACK_BILLING_WEBHOOK_URL=$SLACK_BILLING_WEBHOOK_URL) | ||
| --env SLACK_BILLING_WEBHOOK_URL=$SLACK_BILLING_WEBHOOK_URL \ | ||
| --env SECRETS_ENCRYPTION_KEY=$SECRETS_ENCRYPTION_KEY) | ||
| vercel alias $VERCEL_URL ${{ env.WEB_ALIAS }} --scope=$VERCEL_ORG_ID --token=$VERCEL_TOKEN | ||
| echo "vercel_url=$VERCEL_URL" >> $GITHUB_OUTPUT | ||
|
|
||
|
|
@@ -474,6 +478,7 @@ jobs: | |
| STRIPE_PRO_MONTHLY_PRICE_ID: ${{ secrets.STRIPE_PRO_MONTHLY_PRICE_ID }} | ||
| STRIPE_PRO_YEARLY_PRICE_ID: ${{ secrets.STRIPE_PRO_YEARLY_PRICE_ID }} | ||
| SLACK_BILLING_WEBHOOK_URL: ${{ secrets.SLACK_BILLING_WEBHOOK_URL }} | ||
| SECRETS_ENCRYPTION_KEY: ${{ secrets.SECRETS_ENCRYPTION_KEY }} | ||
| run: | | ||
| vercel pull --yes --environment=preview --token=$VERCEL_TOKEN | ||
| vercel build --token=$VERCEL_TOKEN | ||
|
|
@@ -496,7 +501,8 @@ jobs: | |
| --env STRIPE_WEBHOOK_SECRET=$STRIPE_WEBHOOK_SECRET \ | ||
| --env STRIPE_PRO_MONTHLY_PRICE_ID=$STRIPE_PRO_MONTHLY_PRICE_ID \ | ||
| --env STRIPE_PRO_YEARLY_PRICE_ID=$STRIPE_PRO_YEARLY_PRICE_ID \ | ||
| --env SLACK_BILLING_WEBHOOK_URL=$SLACK_BILLING_WEBHOOK_URL) | ||
| --env SLACK_BILLING_WEBHOOK_URL=$SLACK_BILLING_WEBHOOK_URL \ | ||
| --env SECRETS_ENCRYPTION_KEY=$SECRETS_ENCRYPTION_KEY) | ||
| vercel alias $VERCEL_URL ${{ env.MARKETING_ALIAS }} --scope=$VERCEL_ORG_ID --token=$VERCEL_TOKEN | ||
| echo "vercel_url=$VERCEL_URL" >> $GITHUB_OUTPUT | ||
|
|
||
|
|
@@ -581,6 +587,7 @@ jobs: | |
| STRIPE_PRO_MONTHLY_PRICE_ID: ${{ secrets.STRIPE_PRO_MONTHLY_PRICE_ID }} | ||
| STRIPE_PRO_YEARLY_PRICE_ID: ${{ secrets.STRIPE_PRO_YEARLY_PRICE_ID }} | ||
| SLACK_BILLING_WEBHOOK_URL: ${{ secrets.SLACK_BILLING_WEBHOOK_URL }} | ||
| SECRETS_ENCRYPTION_KEY: ${{ secrets.SECRETS_ENCRYPTION_KEY }} | ||
| run: | | ||
| vercel pull --yes --environment=preview --token=$VERCEL_TOKEN | ||
| vercel build --token=$VERCEL_TOKEN | ||
|
|
@@ -607,7 +614,8 @@ jobs: | |
| --env STRIPE_WEBHOOK_SECRET=$STRIPE_WEBHOOK_SECRET \ | ||
| --env STRIPE_PRO_MONTHLY_PRICE_ID=$STRIPE_PRO_MONTHLY_PRICE_ID \ | ||
| --env STRIPE_PRO_YEARLY_PRICE_ID=$STRIPE_PRO_YEARLY_PRICE_ID \ | ||
| --env SLACK_BILLING_WEBHOOK_URL=$SLACK_BILLING_WEBHOOK_URL) | ||
| --env SLACK_BILLING_WEBHOOK_URL=$SLACK_BILLING_WEBHOOK_URL \ | ||
| --env SECRETS_ENCRYPTION_KEY=$SECRETS_ENCRYPTION_KEY) | ||
| vercel alias $VERCEL_URL ${{ env.ADMIN_ALIAS }} --scope=$VERCEL_ORG_ID --token=$VERCEL_TOKEN | ||
| echo "vercel_url=$VERCEL_URL" >> $GITHUB_OUTPUT | ||
|
|
||
|
|
@@ -665,14 +673,16 @@ jobs: | |
| NEXT_PUBLIC_SENTRY_DSN_DOCS: ${{ secrets.NEXT_PUBLIC_SENTRY_DSN_DOCS }} | ||
| SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} | ||
| NEXT_PUBLIC_SENTRY_ENVIRONMENT: ${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }} | ||
| SECRETS_ENCRYPTION_KEY: ${{ secrets.SECRETS_ENCRYPTION_KEY }} | ||
| run: | | ||
| vercel pull --yes --environment=preview --token=$VERCEL_TOKEN | ||
| vercel build --token=$VERCEL_TOKEN | ||
| VERCEL_URL=$(vercel deploy --prebuilt --token=$VERCEL_TOKEN \ | ||
| --env NEXT_PUBLIC_POSTHOG_KEY=$NEXT_PUBLIC_POSTHOG_KEY \ | ||
| --env NEXT_PUBLIC_POSTHOG_HOST=$NEXT_PUBLIC_POSTHOG_HOST \ | ||
| --env NEXT_PUBLIC_SENTRY_DSN_DOCS=$NEXT_PUBLIC_SENTRY_DSN_DOCS \ | ||
| --env NEXT_PUBLIC_SENTRY_ENVIRONMENT=$NEXT_PUBLIC_SENTRY_ENVIRONMENT) | ||
| --env NEXT_PUBLIC_SENTRY_ENVIRONMENT=$NEXT_PUBLIC_SENTRY_ENVIRONMENT \ | ||
| --env SECRETS_ENCRYPTION_KEY=$SECRETS_ENCRYPTION_KEY) | ||
|
Comment on lines
+676
to
+685
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
The Docs site is a static documentation deployment — it has no server-side secrets management logic. Passing Consider removing 🤖 Prompt for AI Agents |
||
| vercel alias $VERCEL_URL ${{ env.DOCS_ALIAS }} --scope=$VERCEL_ORG_ID --token=$VERCEL_TOKEN | ||
| echo "vercel_url=$VERCEL_URL" >> $GITHUB_OUTPUT | ||
|
|
||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -110,6 +110,7 @@ jobs: | |
| STRIPE_PRO_MONTHLY_PRICE_ID: ${{ secrets.STRIPE_PRO_MONTHLY_PRICE_ID }} | ||
| STRIPE_PRO_YEARLY_PRICE_ID: ${{ secrets.STRIPE_PRO_YEARLY_PRICE_ID }} | ||
| SLACK_BILLING_WEBHOOK_URL: ${{ secrets.SLACK_BILLING_WEBHOOK_URL }} | ||
| SECRETS_ENCRYPTION_KEY: ${{ secrets.SECRETS_ENCRYPTION_KEY }} | ||
| run: | | ||
| vercel pull --yes --environment=production --token=$VERCEL_TOKEN | ||
| vercel build --prod --token=$VERCEL_TOKEN | ||
|
|
@@ -154,7 +155,8 @@ jobs: | |
| --env STRIPE_WEBHOOK_SECRET=$STRIPE_WEBHOOK_SECRET \ | ||
| --env STRIPE_PRO_MONTHLY_PRICE_ID=$STRIPE_PRO_MONTHLY_PRICE_ID \ | ||
| --env STRIPE_PRO_YEARLY_PRICE_ID=$STRIPE_PRO_YEARLY_PRICE_ID \ | ||
| --env SLACK_BILLING_WEBHOOK_URL=$SLACK_BILLING_WEBHOOK_URL | ||
| --env SLACK_BILLING_WEBHOOK_URL=$SLACK_BILLING_WEBHOOK_URL \ | ||
| --env SECRETS_ENCRYPTION_KEY=$SECRETS_ENCRYPTION_KEY | ||
|
|
||
| deploy-web: | ||
| name: Deploy Web to Vercel | ||
|
|
@@ -211,6 +213,7 @@ jobs: | |
| STRIPE_PRO_MONTHLY_PRICE_ID: ${{ secrets.STRIPE_PRO_MONTHLY_PRICE_ID }} | ||
| STRIPE_PRO_YEARLY_PRICE_ID: ${{ secrets.STRIPE_PRO_YEARLY_PRICE_ID }} | ||
| SLACK_BILLING_WEBHOOK_URL: ${{ secrets.SLACK_BILLING_WEBHOOK_URL }} | ||
| SECRETS_ENCRYPTION_KEY: ${{ secrets.SECRETS_ENCRYPTION_KEY }} | ||
| run: | | ||
| vercel pull --yes --environment=production --token=$VERCEL_TOKEN | ||
| vercel build --prod --token=$VERCEL_TOKEN | ||
|
|
@@ -236,7 +239,8 @@ jobs: | |
| --env STRIPE_WEBHOOK_SECRET=$STRIPE_WEBHOOK_SECRET \ | ||
| --env STRIPE_PRO_MONTHLY_PRICE_ID=$STRIPE_PRO_MONTHLY_PRICE_ID \ | ||
| --env STRIPE_PRO_YEARLY_PRICE_ID=$STRIPE_PRO_YEARLY_PRICE_ID \ | ||
| --env SLACK_BILLING_WEBHOOK_URL=$SLACK_BILLING_WEBHOOK_URL | ||
| --env SLACK_BILLING_WEBHOOK_URL=$SLACK_BILLING_WEBHOOK_URL \ | ||
| --env SECRETS_ENCRYPTION_KEY=$SECRETS_ENCRYPTION_KEY | ||
|
|
||
| deploy-marketing: | ||
| name: Deploy Marketing to Vercel | ||
|
|
@@ -290,6 +294,7 @@ jobs: | |
| STRIPE_PRO_MONTHLY_PRICE_ID: ${{ secrets.STRIPE_PRO_MONTHLY_PRICE_ID }} | ||
| STRIPE_PRO_YEARLY_PRICE_ID: ${{ secrets.STRIPE_PRO_YEARLY_PRICE_ID }} | ||
| SLACK_BILLING_WEBHOOK_URL: ${{ secrets.SLACK_BILLING_WEBHOOK_URL }} | ||
| SECRETS_ENCRYPTION_KEY: ${{ secrets.SECRETS_ENCRYPTION_KEY }} | ||
| run: | | ||
| vercel pull --yes --environment=production --token=$VERCEL_TOKEN | ||
| vercel build --prod --token=$VERCEL_TOKEN | ||
|
|
@@ -312,7 +317,8 @@ jobs: | |
| --env STRIPE_WEBHOOK_SECRET=$STRIPE_WEBHOOK_SECRET \ | ||
| --env STRIPE_PRO_MONTHLY_PRICE_ID=$STRIPE_PRO_MONTHLY_PRICE_ID \ | ||
| --env STRIPE_PRO_YEARLY_PRICE_ID=$STRIPE_PRO_YEARLY_PRICE_ID \ | ||
| --env SLACK_BILLING_WEBHOOK_URL=$SLACK_BILLING_WEBHOOK_URL | ||
| --env SLACK_BILLING_WEBHOOK_URL=$SLACK_BILLING_WEBHOOK_URL \ | ||
| --env SECRETS_ENCRYPTION_KEY=$SECRETS_ENCRYPTION_KEY | ||
|
|
||
| deploy-admin: | ||
| name: Deploy Admin to Vercel | ||
|
|
@@ -370,6 +376,7 @@ jobs: | |
| STRIPE_PRO_MONTHLY_PRICE_ID: ${{ secrets.STRIPE_PRO_MONTHLY_PRICE_ID }} | ||
| STRIPE_PRO_YEARLY_PRICE_ID: ${{ secrets.STRIPE_PRO_YEARLY_PRICE_ID }} | ||
| SLACK_BILLING_WEBHOOK_URL: ${{ secrets.SLACK_BILLING_WEBHOOK_URL }} | ||
| SECRETS_ENCRYPTION_KEY: ${{ secrets.SECRETS_ENCRYPTION_KEY }} | ||
| run: | | ||
| vercel pull --yes --environment=production --token=$VERCEL_TOKEN | ||
| vercel build --prod --token=$VERCEL_TOKEN | ||
|
|
@@ -396,7 +403,8 @@ jobs: | |
| --env STRIPE_WEBHOOK_SECRET=$STRIPE_WEBHOOK_SECRET \ | ||
| --env STRIPE_PRO_MONTHLY_PRICE_ID=$STRIPE_PRO_MONTHLY_PRICE_ID \ | ||
| --env STRIPE_PRO_YEARLY_PRICE_ID=$STRIPE_PRO_YEARLY_PRICE_ID \ | ||
| --env SLACK_BILLING_WEBHOOK_URL=$SLACK_BILLING_WEBHOOK_URL | ||
| --env SLACK_BILLING_WEBHOOK_URL=$SLACK_BILLING_WEBHOOK_URL \ | ||
| --env SECRETS_ENCRYPTION_KEY=$SECRETS_ENCRYPTION_KEY | ||
|
|
||
| deploy-streams: | ||
| name: Deploy Streams to Fly.io | ||
|
|
@@ -491,11 +499,13 @@ jobs: | |
| NEXT_PUBLIC_SENTRY_DSN_DOCS: ${{ secrets.NEXT_PUBLIC_SENTRY_DSN_DOCS }} | ||
| SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} | ||
| NEXT_PUBLIC_SENTRY_ENVIRONMENT: ${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }} | ||
| SECRETS_ENCRYPTION_KEY: ${{ secrets.SECRETS_ENCRYPTION_KEY }} | ||
| run: | | ||
| vercel pull --yes --environment=production --token=$VERCEL_TOKEN | ||
| vercel build --prod --token=$VERCEL_TOKEN | ||
| vercel deploy --prod --prebuilt --token=$VERCEL_TOKEN \ | ||
| --env NEXT_PUBLIC_POSTHOG_KEY=$NEXT_PUBLIC_POSTHOG_KEY \ | ||
| --env NEXT_PUBLIC_POSTHOG_HOST=$NEXT_PUBLIC_POSTHOG_HOST \ | ||
| --env NEXT_PUBLIC_SENTRY_DSN_DOCS=$NEXT_PUBLIC_SENTRY_DSN_DOCS \ | ||
| --env NEXT_PUBLIC_SENTRY_ENVIRONMENT=$NEXT_PUBLIC_SENTRY_ENVIRONMENT | ||
| --env NEXT_PUBLIC_SENTRY_ENVIRONMENT=$NEXT_PUBLIC_SENTRY_ENVIRONMENT \ | ||
| --env SECRETS_ENCRYPTION_KEY=$SECRETS_ENCRYPTION_KEY | ||
|
Comment on lines
+502
to
+511
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Same least-privilege concern: Same issue as flagged in the preview workflow — Docs and Marketing don't need 🤖 Prompt for AI Agents |
||
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -40,6 +40,7 @@ export const env = createEnv({ | |||||
| STRIPE_PRO_MONTHLY_PRICE_ID: z.string(), | ||||||
| STRIPE_PRO_YEARLY_PRICE_ID: z.string(), | ||||||
| SLACK_BILLING_WEBHOOK_URL: z.string().url(), | ||||||
| SECRETS_ENCRYPTION_KEY: z.string().min(1), | ||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🏁 Script executed: find . -name "crypto.ts" -o -name "crypto.js" | head -20Repository: superset-sh/superset Length of output: 97 🏁 Script executed: rg "SECRETS_ENCRYPTION_KEY" -A 3 -B 3Repository: superset-sh/superset Length of output: 1498 🏁 Script executed: rg "AES.*256.*GCM|createCipheriv|createDecipheriv" -A 2 -B 2 --type tsRepository: superset-sh/superset Length of output: 2732 🏁 Script executed: python3 <<'EOF'
import base64
# 32 bytes as base64
test_bytes = b'x' * 32
encoded = base64.b64encode(test_bytes).decode('ascii')
print(f"32 bytes in base64: {len(encoded)} characters")
print(f"Example: {encoded}")
EOFRepository: superset-sh/superset Length of output: 151
Since the key is base64-encoded and must decode to exactly 32 bytes, the minimum length should be 44 characters (32 bytes base64-encoded), not 32. A string like "abc" would currently pass Additionally, the same issue exists in Suggested fix- SECRETS_ENCRYPTION_KEY: z.string().min(1),
+ SECRETS_ENCRYPTION_KEY: z.string().min(44),Apply the same fix to both 📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||
| SENTRY_AUTH_TOKEN: z.string().optional(), | ||||||
| }, | ||||||
| client: { | ||||||
|
|
||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -1001,6 +1001,17 @@ export const createProjectsRouter = (getWindow: () => BrowserWindow | null) => { | |
| return { success: true, terminalWarning }; | ||
| }), | ||
|
|
||
| linkToNeon: publicProcedure | ||
| .input(z.object({ id: z.string(), neonProjectId: z.string() })) | ||
| .mutation(({ input }) => { | ||
| localDb | ||
| .update(projects) | ||
| .set({ neonProjectId: input.neonProjectId }) | ||
| .where(eq(projects.id, input.id)) | ||
| .run(); | ||
| return { success: true }; | ||
| }), | ||
|
Comment on lines
+1004
to
+1013
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Missing project existence check — silently succeeds for invalid IDs. Every other mutation in this router that updates by Also, Proposed fix linkToNeon: publicProcedure
- .input(z.object({ id: z.string(), neonProjectId: z.string() }))
+ .input(z.object({ id: z.string(), neonProjectId: z.string().min(1) }))
.mutation(({ input }) => {
+ const project = localDb
+ .select()
+ .from(projects)
+ .where(eq(projects.id, input.id))
+ .get();
+
+ if (!project) {
+ throw new TRPCError({
+ code: "NOT_FOUND",
+ message: `Project ${input.id} not found`,
+ });
+ }
+
localDb
.update(projects)
.set({ neonProjectId: input.neonProjectId })
.where(eq(projects.id, input.id))
.run();
return { success: true };
}),As per coding guidelines, "Use appropriate TRPCError codes consistently: NOT_FOUND (resource doesn't exist)" and "Follow existing patterns in the codebase and match the codebase style rather than introducing novel patterns". 🤖 Prompt for AI Agents |
||
|
|
||
| getGitHubAvatar: publicProcedure | ||
| .input(z.object({ id: z.string() })) | ||
| .query(async ({ input }) => { | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: superset-sh/superset
Length of output: 346
🏁 Script executed:
Repository: superset-sh/superset
Length of output: 4734
Remove
SECRETS_ENCRYPTION_KEYfrom Admin app deployment environment.The Admin app's env schema (
apps/admin/src/env.ts) does not includeSECRETS_ENCRYPTION_KEY, and no code in the Admin app references it. The key is only used by the API app's secrets management router. Passing unused secrets violates the least-privilege principle.🤖 Prompt for AI Agents