From 9395c415b337d891329bc2c7a642161deb6d837d Mon Sep 17 00:00:00 2001 From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com> Date: Sat, 24 Oct 2026 18:12:23 +0200 Subject: [PATCH] fix(env): keep preview copies of locked variables locked Co-Authored-By: Claude Opus 5.5 --- app/Models/EnvironmentVariable.php | 1 + .../EnvironmentVariableValueHidingTest.php | 26 +++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/app/Models/EnvironmentVariable.php b/app/Models/EnvironmentVariable.php index 81ac70023c..c36934e539 100644 --- a/app/Models/EnvironmentVariable.php +++ b/app/Models/EnvironmentVariable.php @@ -134,6 +134,7 @@ class EnvironmentVariable extends BaseModel 'is_runtime' => $environment_variable->is_runtime ?? false, 'is_buildtime' => $environment_variable->is_buildtime ?? false, 'is_required' => $environment_variable->is_required ?? false, + 'is_shown_once' => $environment_variable->is_shown_once ?? false, 'comment' => $environment_variable->comment, 'resourceable_type' => Application::class, 'resourceable_id' => $environment_variable->resourceable_id, diff --git a/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php b/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php index 2102223333..6a5297997a 100644 --- a/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php +++ b/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php @@ -246,6 +246,32 @@ test('API hides locked env value with root token', function () { expect($locked)->not->toHaveKey('real_value'); }); +test('API hides the value of the automatic preview copy of a locked env', function () { + session(['currentTeam' => $this->team]); + $token = $this->admin->createToken('admin-sensitive-preview', ['read', 'read:sensitive', 'write']); + $headers = ['Authorization' => 'Bearer '.$token->plainTextToken]; + + $this->withHeaders($headers)->postJson("/api/v1/applications/{$this->application->uuid}/envs", [ + 'key' => 'API_LOCKED_VAR', + 'value' => 'api-secret-value', + 'is_shown_once' => true, + ])->assertCreated(); + + $envs = collect($this->withHeaders($headers) + ->getJson("/api/v1/applications/{$this->application->uuid}/envs") + ->assertOk() + ->json()) + ->where('key', 'API_LOCKED_VAR'); + + expect($envs)->toHaveCount(2); + expect($envs->pluck('is_preview')->sort()->values()->all())->toBe([false, true]); + $envs->each(function (array $env) { + expect($env['is_shown_once'])->toBeTruthy(); + expect($env)->not->toHaveKey('value'); + expect($env)->not->toHaveKey('real_value'); + }); +}); + // --- API: member role hides env values --- test('API hides env values for member even with read:sensitive token', function () {