From c6fd0a0b0d38ee3e4e392654908332af6caa8a85 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 12:40:16 +0200
Subject: [PATCH] fix(shared-variables): show server variable values only to
 admins

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 app/Livewire/SharedVariables/Server/Show.php |  7 +++++-
 tests/Feature/SharedVariableDevViewTest.php  | 25 ++++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/app/Livewire/SharedVariables/Server/Show.php b/app/Livewire/SharedVariables/Server/Show.php
index a0498b2b7d..4701465739 100644
--- a/app/Livewire/SharedVariables/Server/Show.php
+++ b/app/Livewire/SharedVariables/Server/Show.php
@@ -75,7 +75,12 @@ class Show extends Component
 
     private function formatEnvironmentVariables($variables)
     {
-        return $variables->map(function ($item) {
+        $isMember = auth()->user()?->isMember();
+
+        return $variables->map(function ($item) use ($isMember) {
+            if ($isMember) {
+                return "$item->key=(Hidden, only admins can view)";
+            }
             if ($item->is_shown_once) {
                 return "$item->key=(Locked Secret, delete and add again to change)";
             }
diff --git a/tests/Feature/SharedVariableDevViewTest.php b/tests/Feature/SharedVariableDevViewTest.php
index 9b434ef994..9fca94c146 100644
--- a/tests/Feature/SharedVariableDevViewTest.php
+++ b/tests/Feature/SharedVariableDevViewTest.php
@@ -203,3 +203,28 @@ test('server built-ins are visible to team members but not other teams', functio
         ->assertRedirect(route('dashboard'))
         ->assertDontSee($otherServer->uuid);
 });
+
+test('server shared variable values are only visible to admins', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    SharedEnvironmentVariable::create([
+        'key' => 'SERVER_TOKEN',
+        'value' => 'stored-server-variable-value',
+        'type' => 'server',
+        'server_id' => $server->id,
+        'team_id' => $this->team->id,
+    ]);
+
+    Livewire::test(App\Livewire\SharedVariables\Server\Show::class, ['server_uuid' => $server->uuid])
+        ->assertSet('variables', 'SERVER_TOKEN=stored-server-variable-value');
+
+    $this->user->teams()->updateExistingPivot($this->team->id, ['role' => 'member']);
+    $this->actingAs($this->user->fresh());
+
+    $component = Livewire::test(App\Livewire\SharedVariables\Server\Show::class, ['server_uuid' => $server->uuid])
+        ->assertSet('variables', 'SERVER_TOKEN=(Hidden, only admins can view)')
+        ->call('switch')
+        ->call('refreshEnvs')
+        ->assertSet('variables', 'SERVER_TOKEN=(Hidden, only admins can view)');
+
+    expect(json_encode($component->snapshot).$component->html())->not->toContain('stored-server-variable-value');
+});