From ca203bc9facad2b54a2cb03c128e4b8ab1da0122 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 6 Oct 2026 06:59:22 +0200
Subject: [PATCH 1/4] fix(ui): keep the light custom theme rule for white
 surfaces

A comment in app.css contained "*/", which ended the comment early.
The minifier then dropped the next rule, so white panels in the light
custom theme were not tinted.
---
 resources/css/app.css | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/resources/css/app.css b/resources/css/app.css
index ccdac0ed10..4f42de4775 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -1425,7 +1425,7 @@ html[data-theme="custom"] [class~="dark:hover:text-coollabs"]:hover {
 }
 
 /* Light custom theme reaches raw neutral utilities too. Dark mode tints
-   everything through the pervasive dark:bg-*/dark:border-* utilities (which
+   everything through the pervasive dark:bg-* and dark:border-* utilities (which
    resolve to --color-* vars the block overrides); light mode has no equivalent,
    so components fall back to hardcoded neutrals. Remap the dominant light
    surface/border utilities to the tinted custom vars so the color reaches the

From e1f9e6fb3922d489a8569874f73ad559d87a23a5 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 6 Oct 2026 06:59:22 +0200
Subject: [PATCH 2/4] fix(ui): deny members on cloud tokens and OAuth settings
 without a 500

- /security/cloud-tokens returns 403 for members instead of crashing
  on a null token list
- /settings/oauth redirects non-admins to the dashboard; it used the
  missing route "home" and a wrong redirect return type
---
 app/Livewire/Security/CloudProviderTokens.php | 14 ++--
 app/Livewire/SettingsOauth.php                |  6 +-
 .../MemberRestrictedSettingsPagesTest.php     | 66 +++++++++++++++++++
 3 files changed, 75 insertions(+), 11 deletions(-)
 create mode 100644 tests/Feature/MemberRestrictedSettingsPagesTest.php

diff --git a/app/Livewire/Security/CloudProviderTokens.php b/app/Livewire/Security/CloudProviderTokens.php
index 12cc95c74b..d16c729fca 100644
--- a/app/Livewire/Security/CloudProviderTokens.php
+++ b/app/Livewire/Security/CloudProviderTokens.php
@@ -13,14 +13,10 @@ class CloudProviderTokens extends Component
 
     public $tokens;
 
-    public function mount()
+    public function mount(): void
     {
-        try {
-            $this->authorize('viewAny', CloudProviderToken::class);
-            $this->loadTokens();
-        } catch (\Throwable $e) {
-            return handleError($e, $this);
-        }
+        $this->authorize('viewAny', CloudProviderToken::class);
+        $this->loadTokens();
     }
 
     public function getListeners()
@@ -153,6 +149,8 @@ class CloudProviderTokens extends Component
 
     public function render()
     {
-        return view('livewire.security.cloud-provider-tokens');
+        return view('livewire.security.cloud-provider-tokens', [
+            'tokens' => $this->tokens ?? collect(),
+        ]);
     }
 }
diff --git a/app/Livewire/SettingsOauth.php b/app/Livewire/SettingsOauth.php
index 6287bd00ca..d70dd6421e 100644
--- a/app/Livewire/SettingsOauth.php
+++ b/app/Livewire/SettingsOauth.php
@@ -5,9 +5,9 @@ namespace App\Livewire;
 use App\Models\InstanceSettings;
 use App\Models\OauthSetting;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Illuminate\Http\RedirectResponse;
 use Illuminate\Validation\ValidationException;
 use Livewire\Component;
+use Livewire\Features\SupportRedirects\Redirector;
 
 class SettingsOauth extends Component
 {
@@ -57,10 +57,10 @@ class SettingsOauth extends Component
         return $rules;
     }
 
-    public function mount(?string $provider = null): ?RedirectResponse
+    public function mount(?string $provider = null): ?Redirector
     {
         if (! isInstanceAdmin()) {
-            return redirect()->route('home');
+            return redirect()->route('dashboard');
         }
 
         $this->settings = instanceSettings();
diff --git a/tests/Feature/MemberRestrictedSettingsPagesTest.php b/tests/Feature/MemberRestrictedSettingsPagesTest.php
new file mode 100644
index 0000000000..3b6f8f2c4d
--- /dev/null
+++ b/tests/Feature/MemberRestrictedSettingsPagesTest.php
@@ -0,0 +1,66 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\OauthSetting;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Once;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    config()->set('app.maintenance.store', 'array');
+
+    InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+    OauthSetting::create(['provider' => 'authentik']);
+
+    $this->rootTeam = Team::forceCreate(['id' => 0, 'name' => 'Root Team', 'personal_team' => false, 'show_boarding' => false]);
+});
+
+function actingAsRootTeamMemberWithRole(string $role): User
+{
+    $team = Team::find(0);
+    $user = User::factory()->create(['email_verified_at' => now()]);
+    $user->teams()->detach();
+    $user->teams()->attach($team, ['role' => $role]);
+    Team::query()->update(['show_boarding' => false]);
+    Cache::flush();
+
+    session(['currentTeam' => $team]);
+    test()->actingAs($user);
+
+    return $user;
+}
+
+it('forbids team members from the cloud tokens page', function () {
+    actingAsRootTeamMemberWithRole('member');
+
+    $this->get(route('security.cloud-tokens'))->assertForbidden();
+});
+
+it('shows the cloud tokens page to team admins and owners', function (string $role) {
+    actingAsRootTeamMemberWithRole($role);
+
+    $this->get(route('security.cloud-tokens'))
+        ->assertSuccessful()
+        ->assertSee('No cloud tokens');
+})->with(['admin', 'owner']);
+
+it('redirects team members from the oauth settings page to the dashboard', function (string $routeName, array $parameters) {
+    actingAsRootTeamMemberWithRole('member');
+
+    $this->get(route($routeName, $parameters))->assertRedirect(route('dashboard'));
+})->with([
+    'oauth settings' => ['settings.oauth', []],
+    'oauth provider settings' => ['settings.oauth.provider', ['provider' => 'authentik']],
+]);
+
+it('shows the oauth settings page to instance admins', function (string $role) {
+    actingAsRootTeamMemberWithRole($role);
+
+    $this->get(route('settings.oauth'))->assertSuccessful()->assertSee('Authentik');
+})->with(['admin', 'owner']);

From 88ba00db2bcf0fdef48a05d46f76d078f625c981 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 6 Oct 2026 06:59:22 +0200
Subject: [PATCH 3/4] fix(ui): pass values to Alpine correctly in component
 attributes

Blade does not compile @js() inside component tag attributes, so Alpine
got the literal text and threw an expression error.

- The environment variable editor closes again after an update
- The change email button in the profile gets a valid disabled state
---
 resources/views/livewire/profile/index.blade.php                | 2 +-
 .../livewire/project/shared/environment-variable/show.blade.php | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/resources/views/livewire/profile/index.blade.php b/resources/views/livewire/profile/index.blade.php
index c92c3d970e..1c77a2d70e 100644
--- a/resources/views/livewire/profile/index.blade.php
+++ b/resources/views/livewire/profile/index.blade.php
@@ -134,7 +134,7 @@
                     <div class="flex items-end gap-2">
                         <x-forms.input id="email" label="Email" readonly />
                         <x-forms.button @click="openEmailModal()" type="button"
-                            :disabled="$uses_sso" x-bind:disabled="emailModalOpen || @js($uses_sso)">
+                            :disabled="$uses_sso" x-bind:disabled="emailModalOpen || {{ $uses_sso ? 'true' : 'false' }}">
                             Change
                         </x-forms.button>
                     </div>
diff --git a/resources/views/livewire/project/shared/environment-variable/show.blade.php b/resources/views/livewire/project/shared/environment-variable/show.blade.php
index a79c5e5d69..d53719aca0 100644
--- a/resources/views/livewire/project/shared/environment-variable/show.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/show.blade.php
@@ -90,7 +90,7 @@
             {{-- Open modal immediately (Alpine); decrypt value in a follow-up Livewire request. --}}
             <x-modal-input title="Edit environment variable" :closeOutside="false" :wireIgnore="false"
                 wireOpen="editorOpen"
-                @environment-variable-updated.window="if ($event.detail.envId === @js($env->id)) modalOpen = false">
+                @environment-variable-updated.window="if ($event.detail.envId === {{ (int) $env->id }}) modalOpen = false">
                 <x-slot:content>
                     <button type="button" wire:click="loadValues" data-env-settings-trigger class="icon-button shrink-0"
                         title="Edit environment variable" aria-label="Edit environment variable">

From 86d84e21c0b23e985a2c963bf75268a3b3690679 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 6 Oct 2026 06:59:22 +0200
Subject: [PATCH 4/4] perf(databases): load Redis-family passwords once for
 database lists

Connection URLs of KeyDB, Dragonfly and Redis queried their password
variables once per database, so the database list API ran extra queries
for every database.

- Read REDIS_PASSWORD and REDIS_USERNAME from the loaded relation
- Load the variables once per type in the database list and the
  environment details API
---
 .../Controllers/Api/DatabasesController.php   |  13 ++
 .../Controllers/Api/ProjectController.php     |   4 +-
 app/Models/StandaloneDragonfly.php            |  15 +-
 app/Models/StandaloneKeydb.php                |  15 +-
 app/Models/StandaloneRedis.php                |  21 ++-
 .../RedisFamilyDatabaseListQueryCountTest.php | 144 ++++++++++++++++++
 6 files changed, 206 insertions(+), 6 deletions(-)
 create mode 100644 tests/Feature/Api/RedisFamilyDatabaseListQueryCountTest.php

diff --git a/app/Http/Controllers/Api/DatabasesController.php b/app/Http/Controllers/Api/DatabasesController.php
index 06870f160b..10a213e5f3 100644
--- a/app/Http/Controllers/Api/DatabasesController.php
+++ b/app/Http/Controllers/Api/DatabasesController.php
@@ -20,11 +20,15 @@ use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
 use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
 use App\Models\StandaloneSqlite;
 use App\Models\SwarmDocker;
 use App\Support\ResourceStartActivity;
 use App\Support\ValidationPatterns;
+use Illuminate\Database\Eloquent\Collection as EloquentCollection;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -275,6 +279,14 @@ class DatabasesController extends Controller
             $databases = $databases->merge($project->databases($databaseRelations));
         }
 
+        if ($request->attributes->get('can_read_sensitive', false) === true) {
+            // Their connection URLs read REDIS_PASSWORD; load the variables once per type instead of per database.
+            $databases
+                ->filter(fn ($database) => $database instanceof StandaloneRedis || $database instanceof StandaloneKeydb || $database instanceof StandaloneDragonfly)
+                ->groupBy(fn ($database) => $database::class)
+                ->each(fn ($group) => (new EloquentCollection($group->all()))->load('runtime_environment_variables'));
+        }
+
         $databaseIds = $databases->pluck('id')->toArray();
 
         $backupConfigs = ScheduledDatabaseBackup::ownedByCurrentTeamAPI($teamId)->with('latest_log')
@@ -284,6 +296,7 @@ class DatabasesController extends Controller
 
         $databases = $databases->map(function ($database) use ($backupConfigs) {
             $database->backup_configs = $backupConfigs->get($database->getMorphClass().':'.$database->id, collect())->values();
+            $database->makeHidden('runtime_environment_variables');
 
             return $this->removeSensitiveData($database);
         });
diff --git a/app/Http/Controllers/Api/ProjectController.php b/app/Http/Controllers/Api/ProjectController.php
index 16eff1ba18..ad515f3fc7 100644
--- a/app/Http/Controllers/Api/ProjectController.php
+++ b/app/Http/Controllers/Api/ProjectController.php
@@ -167,10 +167,12 @@ class ProjectController extends Controller
         if (! $environment) {
             return response()->json(['message' => 'Environment not found.'], 404);
         }
-        $environment = $environment->load(['applications', 'postgresqls', 'redis', 'mongodbs', 'mysqls', 'mariadbs', 'services']);
+        // Redis connection URLs read REDIS_PASSWORD and REDIS_USERNAME; load the variables once, not per database.
+        $environment = $environment->load(['applications', 'postgresqls', 'redis.runtime_environment_variables', 'mongodbs', 'mysqls', 'mariadbs', 'services']);
         collect(['applications', 'postgresqls', 'redis', 'mongodbs', 'mysqls', 'mariadbs', 'services'])
             ->flatMap(fn (string $relation) => $environment->{$relation})
             ->each(fn ($resource) => exposeSensitiveFields($resource));
+        $environment->redis->each(fn ($redis) => $redis->makeHidden('runtime_environment_variables'));
 
         return response()->json(serializeApiResponse($environment));
     }
diff --git a/app/Models/StandaloneDragonfly.php b/app/Models/StandaloneDragonfly.php
index 15dea750f8..98f9ff5afc 100644
--- a/app/Models/StandaloneDragonfly.php
+++ b/app/Models/StandaloneDragonfly.php
@@ -369,6 +369,19 @@ class StandaloneDragonfly extends BaseModel
         return $this->morphMany(EnvironmentVariable::class, 'resourceable');
     }
 
+    /**
+     * Uses the loaded runtime_environment_variables relation when present, so lists that eager
+     * load it do not run a query per database.
+     */
+    private function runtimeEnvironmentVariable(string $key): ?EnvironmentVariable
+    {
+        if ($this->relationLoaded('runtime_environment_variables')) {
+            return $this->runtime_environment_variables->firstWhere('key', $key);
+        }
+
+        return $this->runtime_environment_variables()->where('key', $key)->first();
+    }
+
     /**
      * The REDIS_PASSWORD variable that sets the server password instead of the stored password.
      * Databases created before this release (legacy_password_quoting) keep their v4.3.23 server
@@ -376,7 +389,7 @@ class StandaloneDragonfly extends BaseModel
      */
     public function serverPasswordEnvironmentVariable(): ?EnvironmentVariable
     {
-        $environmentVariable = $this->runtime_environment_variables()->where('key', 'REDIS_PASSWORD')->first();
+        $environmentVariable = $this->runtimeEnvironmentVariable('REDIS_PASSWORD');
 
         if (! $environmentVariable) {
             return null;
diff --git a/app/Models/StandaloneKeydb.php b/app/Models/StandaloneKeydb.php
index 35818a8742..bc1e045335 100644
--- a/app/Models/StandaloneKeydb.php
+++ b/app/Models/StandaloneKeydb.php
@@ -370,6 +370,19 @@ class StandaloneKeydb extends BaseModel
         return $this->morphMany(EnvironmentVariable::class, 'resourceable');
     }
 
+    /**
+     * Uses the loaded runtime_environment_variables relation when present, so lists that eager
+     * load it do not run a query per database.
+     */
+    private function runtimeEnvironmentVariable(string $key): ?EnvironmentVariable
+    {
+        if ($this->relationLoaded('runtime_environment_variables')) {
+            return $this->runtime_environment_variables->firstWhere('key', $key);
+        }
+
+        return $this->runtime_environment_variables()->where('key', $key)->first();
+    }
+
     /**
      * The REDIS_PASSWORD variable that sets the server password instead of the stored password.
      * Databases created before this release (legacy_password_quoting) keep their v4.3.23 server
@@ -377,7 +390,7 @@ class StandaloneKeydb extends BaseModel
      */
     public function serverPasswordEnvironmentVariable(): ?EnvironmentVariable
     {
-        $environmentVariable = $this->runtime_environment_variables()->where('key', 'REDIS_PASSWORD')->first();
+        $environmentVariable = $this->runtimeEnvironmentVariable('REDIS_PASSWORD');
 
         if (! $environmentVariable) {
             return null;
diff --git a/app/Models/StandaloneRedis.php b/app/Models/StandaloneRedis.php
index 2e6f158cf1..b8bdbef49b 100644
--- a/app/Models/StandaloneRedis.php
+++ b/app/Models/StandaloneRedis.php
@@ -384,6 +384,19 @@ class StandaloneRedis extends BaseModel
         return $this->morphMany(EnvironmentVariable::class, 'resourceable');
     }
 
+    /**
+     * Uses the loaded runtime_environment_variables relation when present, so lists that eager
+     * load it do not run a query per database.
+     */
+    private function runtimeEnvironmentVariable(string $key): ?EnvironmentVariable
+    {
+        if ($this->relationLoaded('runtime_environment_variables')) {
+            return $this->runtime_environment_variables->firstWhere('key', $key);
+        }
+
+        return $this->runtime_environment_variables()->where('key', $key)->first();
+    }
+
     /**
      * The REDIS_PASSWORD variable whose resolved value sets the server password. Databases created
      * before this release (legacy_password_quoting) keep their v4.3.23 server password, the stored
@@ -391,7 +404,7 @@ class StandaloneRedis extends BaseModel
      */
     public function serverPasswordEnvironmentVariable(): ?EnvironmentVariable
     {
-        $environmentVariable = $this->runtime_environment_variables()->where('key', 'REDIS_PASSWORD')->first();
+        $environmentVariable = $this->runtimeEnvironmentVariable('REDIS_PASSWORD');
 
         if (! $environmentVariable) {
             return null;
@@ -444,7 +457,7 @@ class StandaloneRedis extends BaseModel
     {
         return new Attribute(
             get: function () {
-                $password = $this->runtime_environment_variables()->where('key', 'REDIS_PASSWORD')->first();
+                $password = $this->runtimeEnvironmentVariable('REDIS_PASSWORD');
                 if (! $password) {
                     return null;
                 }
@@ -459,7 +472,9 @@ class StandaloneRedis extends BaseModel
     {
         return new Attribute(
             get: function () {
-                $username = $this->runtime_environment_variables()->where('key', 'REDIS_USERNAME')->first();
+                // A loaded relation does not hold a variable created by an earlier read, so check the table before creating one.
+                $username = $this->runtimeEnvironmentVariable('REDIS_USERNAME')
+                    ?? $this->runtime_environment_variables()->where('key', 'REDIS_USERNAME')->first();
                 if (! $username) {
                     $this->runtime_environment_variables()->create([
                         'key' => 'REDIS_USERNAME',
diff --git a/tests/Feature/Api/RedisFamilyDatabaseListQueryCountTest.php b/tests/Feature/Api/RedisFamilyDatabaseListQueryCountTest.php
new file mode 100644
index 0000000000..bea7b1de5b
--- /dev/null
+++ b/tests/Feature/Api/RedisFamilyDatabaseListQueryCountTest.php
@@ -0,0 +1,144 @@
+<?php
+
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneRedis;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0], ['is_api_enabled' => true]));
+    Server::flushIdentityMap();
+
+    $this->team = Team::factory()->create();
+    $user = User::factory()->create();
+    $this->team->members()->attach($user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+    $this->bearerToken = $user->createToken('test-token', ['root'])->plainTextToken;
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $project->id]);
+});
+
+function createRedisFamilyDatabasesForQueryCount(int $environmentId, StandaloneDocker $destination, int $count): void
+{
+    foreach (range(1, $count) as $index) {
+        $public = ['is_public' => true, 'public_port' => 30000 + $index];
+
+        create_standalone_redis($environmentId, $destination, $public + ['image' => 'redis:7.2']);
+
+        foreach (['create_standalone_keydb', 'create_standalone_dragonfly'] as $create) {
+            $database = $create($environmentId, $destination, $public);
+            EnvironmentVariable::create([
+                'key' => 'REDIS_PASSWORD',
+                'value' => "variable-password-{$index}",
+                'resourceable_type' => $database->getMorphClass(),
+                'resourceable_id' => $database->id,
+            ]);
+        }
+    }
+}
+
+/**
+ * Counts the queries of one database list request. The REDIS_USERNAME lookup of the StandaloneRedis
+ * "retrieved" hook runs per model before any relation can be eager loaded, so it is not counted.
+ * Pass $onlyTable to count only the queries that read that table.
+ *
+ * @return array{0: int, 1: array<int, array<string, mixed>>}
+ */
+function countRedisFamilyDatabaseListQueries(string $bearerToken, string $uri = '/api/v1/databases', ?string $onlyTable = null): array
+{
+    DB::flushQueryLog();
+    DB::enableQueryLog();
+
+    $response = test()->withHeaders(['Authorization' => 'Bearer '.$bearerToken])
+        ->getJson($uri)
+        ->assertOk();
+
+    DB::disableQueryLog();
+
+    $queries = collect(DB::getQueryLog())
+        ->reject(fn (array $query) => str_contains($query['query'], 'audit_events') || in_array('REDIS_USERNAME', $query['bindings'], true))
+        ->filter(fn (array $query) => $onlyTable === null || str_contains($query['query'], "from \"{$onlyTable}\""))
+        ->count();
+
+    return [$queries, $response->json()];
+}
+
+it('does not query environment variables per Redis, KeyDB and Dragonfly database in the database list', function () {
+    createRedisFamilyDatabasesForQueryCount($this->environment->id, $this->destination, 1);
+    // The first request also authenticates the token; measure warm requests only.
+    countRedisFamilyDatabaseListQueries($this->bearerToken);
+    [$queriesForOneEach] = countRedisFamilyDatabaseListQueries($this->bearerToken);
+
+    createRedisFamilyDatabasesForQueryCount($this->environment->id, $this->destination, 4);
+    [$queriesForFiveEach, $databases] = countRedisFamilyDatabaseListQueries($this->bearerToken);
+
+    expect($databases)->toHaveCount(15)
+        ->and($queriesForFiveEach)->toBe($queriesForOneEach);
+
+    $modelsByUuid = collect([StandaloneRedis::class, StandaloneKeydb::class, StandaloneDragonfly::class])
+        ->flatMap(fn (string $model) => $model::query()->get())
+        ->keyBy('uuid');
+
+    foreach ($databases as $database) {
+        $model = $modelsByUuid[$database['uuid']];
+
+        expect($database)->not->toHaveKey('runtime_environment_variables')
+            ->and($database['internal_db_url'])->toBe($model->internal_db_url)
+            ->and($database['external_db_url'])->toBe($model->external_db_url)
+            ->and($database['internal_db_url'])->toStartWith('redis://')
+            ->and($database['external_db_url'])->toStartWith('redis://');
+
+        if (str_starts_with($database['name'], 'redis-database-')) {
+            expect($database['internal_db_url'])->toStartWith('redis://default:'.rawurlencode($model->redis_password).'@');
+        } else {
+            expect($database['internal_db_url'])->toMatch('/^redis:\/\/:variable-password-\d@/');
+        }
+    }
+});
+
+it('does not query environment variables per Redis database in the environment details', function () {
+    $uri = "/api/v1/projects/{$this->environment->project->uuid}/{$this->environment->uuid}";
+
+    createRedisFamilyDatabasesForQueryCount($this->environment->id, $this->destination, 1);
+    countRedisFamilyDatabaseListQueries($this->bearerToken, $uri);
+    // The environment details lazy load each database's destination for external URLs; only variable reads are checked here.
+    [$queriesForOne] = countRedisFamilyDatabaseListQueries($this->bearerToken, $uri, 'environment_variables');
+
+    createRedisFamilyDatabasesForQueryCount($this->environment->id, $this->destination, 4);
+    [$queriesForFive, $environment] = countRedisFamilyDatabaseListQueries($this->bearerToken, $uri, 'environment_variables');
+
+    expect($environment['redis'])->toHaveCount(5)
+        ->and($queriesForFive)->toBe($queriesForOne);
+
+    foreach ($environment['redis'] as $database) {
+        $model = StandaloneRedis::query()->where('uuid', $database['uuid'])->firstOrFail();
+
+        expect($database)->not->toHaveKey('runtime_environment_variables')
+            ->and($database['internal_db_url'])->toBe($model->internal_db_url)
+            ->and($database['external_db_url'])->toBe($model->external_db_url);
+    }
+});
+
+it('creates a missing Redis username variable only once when the variables are loaded', function () {
+    $redis = create_standalone_redis($this->environment->id, $this->destination);
+    $redis->runtime_environment_variables()->where('key', 'REDIS_USERNAME')->delete();
+    $redis->load('runtime_environment_variables');
+
+    expect($redis->redis_username)->toBe('default')
+        ->and($redis->redis_username)->toBe('default')
+        ->and($redis->runtime_environment_variables()->where('key', 'REDIS_USERNAME')->count())->toBe(1);
+});