fix(webapp): tighten branch env var prune after parent-level import

The branch-copy prune after an import now deletes every qualifying
value row, its secret and its reference in a single transaction using
the rows it already fetched, instead of re-reading the project and the
whole variable once per key.

The import only offers keys for pruning that the parent write actually
accepted, so a value the parent rejected (empty or disallowed) can no
longer cause the branch to fall back to an older parent value. Keys the
same request also sets on the branch are still excluded.

Author: matt-aitken

.server-changes/envvar-import-prune-branch-copies.md

@@ -3,4 +3,4 @@ area: webapp
 type: fix
 ---
 
-Importing environment variables to a preview branch's parent now removes that same source's earlier copies of those variables on the branch, so the branch picks up the shared value instead of a stale override. Variables set on the branch by anyone else are left untouched.
+When an integration syncs a variable to a preview branch's parent, its earlier copy of that variable on the branch is removed so the branch inherits the shared value. Values set on the branch by anyone else are kept.

apps/webapp/app/routes/api.v1.projects.$projectRef.envvars.$slug.import.ts

@@ -13,6 +13,7 @@ import {
 } from "~/services/environmentVariableApiAccess.server";
 import { logger } from "~/services/logger.server";
 import { EnvironmentVariablesRepository } from "~/v3/environmentVariables/environmentVariablesRepository.server";
+import { parentKeysToPrune } from "~/v3/environmentVariables/parentKeysToPrune";
 
 const ParamsSchema = z.object({
   projectRef: z.string(),
@@ -84,12 +85,15 @@ export async function action({ params, request }: ActionFunctionArgs) {
     });
 
     if (parentResult.success && body.source) {
-      const branchKeys = new Set(Object.keys(body.variables));
       await pruneBranchCopies(repository, {
         projectId: environment.project.id,
         environmentId: environment.id,
         parentEnvironmentId: environment.parentEnvironmentId,
-        keys: Object.keys(body.parentVariables).filter((key) => !branchKeys.has(key)),
+        keys: parentKeysToPrune({
+          variables: body.variables,
+          parentVariables: body.parentVariables,
+          acceptedParentKeys: parentResult.acceptedKeys ?? [],
+        }),
         source: body.source,
       });
     }

apps/webapp/app/v3/environmentVariables/environmentVariablesRepository.server.ts

@@ -149,7 +149,7 @@ export class EnvironmentVariablesRepository implements Repository {
         options.lastUpdatedBy?.type === "integration" &&
         !removedBlacklisted
       ) {
-        return { success: true as const };
+        return { success: true as const, acceptedKeys: [] };
       }
     }
     if (values.length === 0) {
@@ -313,6 +313,7 @@ export class EnvironmentVariablesRepository implements Repository {
 
       return {
         success: true as const,
+        acceptedKeys: values.map((v) => v.key),
       };
     } catch (error) {
       if (error instanceof Prisma.PrismaClientKnownRequestError) {
@@ -975,9 +976,8 @@ export class EnvironmentVariablesRepository implements Repository {
     projectId: string,
     options: PruneBranchValuesShadowingParent
   ): Promise<PruneBranchValuesResult> {
-    const result: PruneBranchValuesResult = { prunedKeys: [], failures: [] };
     if (options.keys.length === 0) {
-      return result;
+      return { prunedKeys: [], failures: [] };
     }
 
     const variables = await this.prismaClient.environmentVariable.findMany({
@@ -991,11 +991,17 @@ export class EnvironmentVariablesRepository implements Repository {
         key: true,
         values: {
           where: { environmentId: { in: [options.environmentId, options.parentEnvironmentId] } },
-          select: { environmentId: true, lastUpdatedBy: true },
+          select: {
+            id: true,
+            environmentId: true,
+            lastUpdatedBy: true,
+            valueReference: { select: { key: true } },
+          },
         },
       },
     });
 
+    const shadowing: { id: string; key: string; secretReferenceKey: string | undefined }[] = [];
     for (const variable of variables) {
       const branchValue = variable.values.find((v) => v.environmentId === options.environmentId);
       const parentValue = variable.values.find(
@@ -1008,19 +1014,52 @@ export class EnvironmentVariablesRepository implements Repository {
       ) {
         continue;
       }
-
-      const deleted = await this.deleteValue(projectId, {
-        id: variable.id,
-        environmentId: options.environmentId,
+      shadowing.push({
+        id: branchValue.id,
+        key: variable.key,
+        secretReferenceKey: branchValue.valueReference?.key,
       });
-      if (deleted.success) {
-        result.prunedKeys.push(variable.key);
-      } else {
-        result.failures.push({ key: variable.key, error: deleted.error });
-      }
     }
 
-    return result;
+    if (shadowing.length === 0) {
+      return { prunedKeys: [], failures: [] };
+    }
+
+    const keys = shadowing.map((v) => v.key);
+    try {
+      await $transaction(this.prismaClient, "prune branch env var values", async (tx) => {
+        const secretStore = getSecretStore("DATABASE", {
+          prismaClient: tx,
+        });
+
+        for (const value of shadowing) {
+          await secretStore.deleteSecret(secretKey(projectId, options.environmentId, value.key));
+
+          if (value.secretReferenceKey) {
+            await tx.secretReference.delete({
+              where: {
+                key: value.secretReferenceKey,
+              },
+            });
+          }
+
+          await tx.environmentVariableValue.delete({
+            where: {
+              id: value.id,
+            },
+          });
+        }
+      });
+
+      return { prunedKeys: keys, failures: [] };
+    } catch (error) {
+      return {
+        prunedKeys: [],
+        failures: [
+          { keys, error: error instanceof Error ? error.message : "Something went wrong" },
+        ],
+      };
+    }
   }
 }
 

apps/webapp/app/v3/environmentVariables/parentKeysToPrune.test.ts

@@ -0,0 +1,46 @@
+import { describe, expect, test } from "vitest";
+import { parentKeysToPrune } from "./parentKeysToPrune";
+
+describe("parentKeysToPrune", () => {
+  test("returns accepted parent keys the request does not also set on the branch", () => {
+    expect(
+      parentKeysToPrune({
+        variables: { BRANCH_ONLY: "b", BOTH: "b" },
+        parentVariables: { SHARED: "p", BOTH: "p" },
+        acceptedParentKeys: ["SHARED", "BOTH"],
+      })
+    ).toEqual(["SHARED"]);
+  });
+
+  test("excludes parent keys the write did not accept", () => {
+    expect(
+      parentKeysToPrune({
+        variables: {},
+        parentVariables: { KEPT: "p", DROPPED: "", TRIGGER_SECRET_KEY: "x" },
+        acceptedParentKeys: ["KEPT"],
+      })
+    ).toEqual(["KEPT"]);
+  });
+
+  test("ignores accepted keys that were not part of parentVariables", () => {
+    expect(
+      parentKeysToPrune({
+        variables: {},
+        parentVariables: { A: "p" },
+        acceptedParentKeys: ["A", "B"],
+      })
+    ).toEqual(["A"]);
+  });
+
+  test("handles empty inputs", () => {
+    expect(
+      parentKeysToPrune({ variables: {}, parentVariables: {}, acceptedParentKeys: [] })
+    ).toEqual([]);
+    expect(
+      parentKeysToPrune({ variables: {}, parentVariables: { A: "p" }, acceptedParentKeys: [] })
+    ).toEqual([]);
+    expect(
+      parentKeysToPrune({ variables: { A: "b" }, parentVariables: {}, acceptedParentKeys: ["A"] })
+    ).toEqual([]);
+  });
+});

apps/webapp/app/v3/environmentVariables/parentKeysToPrune.ts

@@ -0,0 +1,15 @@
+/**
+ * Keys whose branch copy an import may retract: the parent-level keys the write actually accepted,
+ * minus any key the same request also sets on the branch itself (an explicit branch override).
+ */
+export function parentKeysToPrune(options: {
+  variables: Record<string, string>;
+  parentVariables: Record<string, string>;
+  acceptedParentKeys: string[];
+}): string[] {
+  const branchKeys = new Set(Object.keys(options.variables));
+  const accepted = new Set(options.acceptedParentKeys);
+  return Object.keys(options.parentVariables).filter(
+    (key) => accepted.has(key) && !branchKeys.has(key)
+  );
+}

apps/webapp/app/v3/environmentVariables/repository.ts

@@ -32,6 +32,8 @@ export type CreateEnvironmentVariables = z.infer<typeof CreateEnvironmentVariabl
 export type CreateResult =
   | {
       success: true;
+      /** Keys that survived blacklist and empty-value filtering and were written or already held. */
+      acceptedKeys?: string[];
     }
   | {
       success: false;
@@ -72,7 +74,7 @@ export type PruneBranchValuesShadowingParent = {
 
 export type PruneBranchValuesResult = {
   prunedKeys: string[];
-  failures: { key: string; error: string }[];
+  failures: { keys: string[]; error: string }[];
 };
 
 // Forms preserve explicit empty strings through their custom coercion.
@@ -156,7 +158,9 @@ export interface Repository {
    * A source that writes a key at the parent level retracts its own earlier copy of that key on
    * the branch. Deletes the branch's own value rows for `keys` that were last written by `source`
    * and that now shadow a value the parent holds. Rows written by anyone else, and rows whose key
-   * the parent has no value for, are untouched.
+   * the parent has no value for, are untouched. A caller that wants both a branch value and a
+   * parent value for the same key must send both in the same import request; the same-request
+   * exclusion is what keeps the branch value from being retracted.
    */
   pruneBranchValuesShadowingParent(
     projectId: string,

apps/webapp/test/environmentVariablesRepository.test.ts

@@ -20,6 +20,7 @@ vi.mock("~/db.server", () => ({
 import { postgresTest } from "@internal/testcontainers";
 import { emptyEnvironmentVariableValuesEnabled } from "~/v3/environmentVariables/emptyValuesFlag.server";
 import { EnvironmentVariablesRepository } from "~/v3/environmentVariables/environmentVariablesRepository.server";
+import { parentKeysToPrune } from "~/v3/environmentVariables/parentKeysToPrune";
 import {
   createEnvironmentVariable,
   createRuntimeEnvironment,
@@ -835,6 +836,16 @@ describe("EnvironmentVariablesRepository.pruneBranchValuesShadowingParent", () =
       ]);
       expect(secrets.has(`${branch.id}:SHARED`)).toBe(false);
       expect(secrets.get(`${parent.id}:SHARED`)).toBe("root");
+      expect(
+        await prisma.secretReference.findFirst({
+          where: { key: `environmentvariable:${project.id}:${branch.id}:SHARED` },
+        })
+      ).toBeNull();
+      expect(
+        await prisma.secretReference.findFirst({
+          where: { key: `environmentvariable:${project.id}:${parent.id}:SHARED` },
+        })
+      ).not.toBeNull();
       expect(
         Object.fromEntries(
           (await repository.getEnvironmentVariables(project.id, branch.id, parent.id)).map(
@@ -937,6 +948,52 @@ describe("EnvironmentVariablesRepository.pruneBranchValuesShadowingParent", () =
     }
   );
 
+  postgresTest(
+    "keeps a same-source branch row when the parent write dropped the key",
+    async ({ prisma }) => {
+      const { project, parent, branch, repository, write, ownKeys } = await createBranchWithParent(
+        prisma,
+        { allowEmptyValues: false }
+      );
+      await write(parent.id, { K: "old" }, vercel);
+      await write(branch.id, { K: "branch-copy" }, vercel);
+
+      const parentResult = await repository.create(project.id, {
+        override: true,
+        environmentIds: [parent.id],
+        variables: [{ key: "K", value: "" }],
+        lastUpdatedBy: vercel,
+      });
+      expect(parentResult).toEqual({ success: true, acceptedKeys: [] });
+
+      const keys = parentKeysToPrune({
+        variables: {},
+        parentVariables: { K: "" },
+        acceptedParentKeys: parentResult.success ? (parentResult.acceptedKeys ?? []) : [],
+      });
+      expect(keys).toEqual([]);
+      const result = await repository.pruneBranchValuesShadowingParent(project.id, {
+        environmentId: branch.id,
+        parentEnvironmentId: parent.id,
+        keys,
+        source: vercel,
+      });
+      expect(result).toEqual({ prunedKeys: [], failures: [] });
+      expect(await ownKeys(branch.id)).toEqual(["K"]);
+
+      const refreshed = await repository.create(project.id, {
+        override: true,
+        environmentIds: [parent.id],
+        variables: [
+          { key: "K", value: "new" },
+          { key: "TRIGGER_SECRET_KEY", value: "not-allowed" },
+        ],
+        lastUpdatedBy: vercel,
+      });
+      expect(refreshed).toEqual({ success: true, acceptedKeys: ["K"] });
+    }
+  );
+
   postgresTest("does not reach into another project's variables", async ({ prisma }) => {
     const mine = await createBranchWithParent(prisma);
     const theirs = await createBranchWithParent(prisma);