diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php index b371452a74..0b69aff669 100644 --- a/app/Jobs/ApplicationDeploymentJob.php +++ b/app/Jobs/ApplicationDeploymentJob.php @@ -1916,7 +1916,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue $envs_dict[$key] = $escapedValue; if (isDev()) { - $this->application_deployment_queue->addLogEntry("[DEBUG] Nixpacks var: {$key}={$escapedValue}"); + $this->application_deployment_queue->addLogEntry("[DEBUG] Nixpacks var: {$key}"); } } } @@ -2015,7 +2015,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue $escapedValue = escapeBashEnvValue($value); if (isDev() && isset($envs_dict[$env->key])) { - $this->application_deployment_queue->addLogEntry("[DEBUG] User override: {$env->key} (was: {$envs_dict[$env->key]}, now: {$escapedValue})"); + $this->application_deployment_queue->addLogEntry("[DEBUG] User override: {$env->key} (value replaced)"); } $envs_dict[$env->key] = $escapedValue; @@ -2023,16 +2023,14 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue if (isDev()) { $this->application_deployment_queue->addLogEntry("[DEBUG] Build-time env: {$env->key}"); $this->application_deployment_queue->addLogEntry('[DEBUG] Type: literal/multiline'); - $this->application_deployment_queue->addLogEntry("[DEBUG] raw real_value: {$resolvedValue}"); - $this->application_deployment_queue->addLogEntry("[DEBUG] stripped value: {$value}"); - $this->application_deployment_queue->addLogEntry("[DEBUG] final escaped: {$escapedValue}"); + $this->application_deployment_queue->addLogEntry('[DEBUG] Value length: '.strlen($escapedValue)); } } else { // For normal vars, use double quotes to allow $VAR expansion $escapedValue = escapeBashDoubleQuoted($resolvedValue); if (isDev() && isset($envs_dict[$env->key])) { - $this->application_deployment_queue->addLogEntry("[DEBUG] User override: {$env->key} (was: {$envs_dict[$env->key]}, now: {$escapedValue})"); + $this->application_deployment_queue->addLogEntry("[DEBUG] User override: {$env->key} (value replaced)"); } $envs_dict[$env->key] = $escapedValue; @@ -2040,8 +2038,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue if (isDev()) { $this->application_deployment_queue->addLogEntry("[DEBUG] Build-time env: {$env->key}"); $this->application_deployment_queue->addLogEntry('[DEBUG] Type: normal (allows expansion)'); - $this->application_deployment_queue->addLogEntry("[DEBUG] real_value: {$resolvedValue}"); - $this->application_deployment_queue->addLogEntry("[DEBUG] final escaped: {$escapedValue}"); + $this->application_deployment_queue->addLogEntry('[DEBUG] Value length: '.strlen($escapedValue)); } } } @@ -2076,7 +2073,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue $escapedValue = escapeBashEnvValue($value); if (isDev() && isset($envs_dict[$env->key])) { - $this->application_deployment_queue->addLogEntry("[DEBUG] User override: {$env->key} (was: {$envs_dict[$env->key]}, now: {$escapedValue})"); + $this->application_deployment_queue->addLogEntry("[DEBUG] User override: {$env->key} (value replaced)"); } $envs_dict[$env->key] = $escapedValue; @@ -2084,16 +2081,14 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue if (isDev()) { $this->application_deployment_queue->addLogEntry("[DEBUG] Build-time env: {$env->key}"); $this->application_deployment_queue->addLogEntry('[DEBUG] Type: literal/multiline'); - $this->application_deployment_queue->addLogEntry("[DEBUG] raw real_value: {$resolvedValue}"); - $this->application_deployment_queue->addLogEntry("[DEBUG] stripped value: {$value}"); - $this->application_deployment_queue->addLogEntry("[DEBUG] final escaped: {$escapedValue}"); + $this->application_deployment_queue->addLogEntry('[DEBUG] Value length: '.strlen($escapedValue)); } } else { // For normal vars, use double quotes to allow $VAR expansion $escapedValue = escapeBashDoubleQuoted($resolvedValue); if (isDev() && isset($envs_dict[$env->key])) { - $this->application_deployment_queue->addLogEntry("[DEBUG] User override: {$env->key} (was: {$envs_dict[$env->key]}, now: {$escapedValue})"); + $this->application_deployment_queue->addLogEntry("[DEBUG] User override: {$env->key} (value replaced)"); } $envs_dict[$env->key] = $escapedValue; @@ -2101,8 +2096,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue if (isDev()) { $this->application_deployment_queue->addLogEntry("[DEBUG] Build-time env: {$env->key}"); $this->application_deployment_queue->addLogEntry('[DEBUG] Type: normal (allows expansion)'); - $this->application_deployment_queue->addLogEntry("[DEBUG] real_value: {$resolvedValue}"); - $this->application_deployment_queue->addLogEntry("[DEBUG] final escaped: {$escapedValue}"); + $this->application_deployment_queue->addLogEntry('[DEBUG] Value length: '.strlen($escapedValue)); } } } diff --git a/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php b/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php index e98d42ff2d..ea527024ad 100644 --- a/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php +++ b/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php @@ -97,8 +97,7 @@ it('does not retain locked values from generated build-time debug logs', functio expect($retainedLogs) ->not->toContain('harmless-single-marker') ->not->toContain('harmless-first-marker') - ->not->toContain('harmless-second-marker') - ->toContain(REDACTED); + ->not->toContain('harmless-second-marker'); $member = User::factory()->create(); $application->team()->members()->attach($member->id, ['role' => 'member']); @@ -112,6 +111,24 @@ it('does not retain locked values from generated build-time debug logs', functio ->not->toContain('harmless-second-marker'); }); +it('does not print build-time values in the development debug lines', function () { + config()->set('app.env', 'local'); + [$application, $server] = makeDeploymentControlVarFixture(); + + createApplicationEnvironmentVariable($application, ['key' => 'DB_PASSWORD', 'value' => 'normal-secret-marker']); + createApplicationEnvironmentVariable($application, ['key' => 'LITERAL_TOKEN', 'value' => 'literal-secret-marker', 'is_literal' => true]); + + [$job, $reflection] = makeControlVarFilteringJob($application, $server); + invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables'); + + $debugLines = collect($job->recordedLogEntries)->filter(fn (string $line) => str_contains($line, '[DEBUG]'))->implode("\n"); + expect($debugLines) + ->toContain('[DEBUG] Build-time env: DB_PASSWORD') + ->toContain('[DEBUG] Build-time env: LITERAL_TOKEN') + ->not->toContain('normal-secret-marker') + ->not->toContain('literal-secret-marker'); +}); + it('redacts generated multiline forms in remote command and output logging', function () { [$application, $server] = makeDeploymentControlVarFixture(); createApplicationEnvironmentVariable($application, [