Function upsertWorkspaceEnvVars

apps/sim/lib/environment/utils.ts:315–358

(
  workspaceId: string,
  newVars: Record<string, string>,
  actingUserId: string
)

 * Encrypts and upserts workspace environment variables, merging with existing.
 */
export async function upsertWorkspaceEnvVars(
  workspaceId: string,
  newVars: Record<string, string>,
  actingUserId: string
): Promise<string[]> {
  const updatedKeys: string[] = []
  if (Object.keys(newVars).length === 0) return updatedKeys

  const wsRows = await db
    .select()
    .from(workspaceEnvironment)
    .where(eq(workspaceEnvironment.workspaceId, workspaceId))
    .limit(1)
  const existingWsEncrypted = (wsRows[0]?.variables as Record<string, string>) || {}

  const newlyEncrypted: Record<string, string> = {}
  for (const [key, val] of Object.entries(newVars)) {
    const { encrypted } = await encryptSecret(val)
    newlyEncrypted[key] = encrypted
    updatedKeys.push(key)
  }

  const merged = { ...existingWsEncrypted, ...newlyEncrypted }

  await db
    .insert(workspaceEnvironment)
    .values({
      id: generateId(),
      workspaceId,
      variables: merged,
      createdAt: new Date(),
      updatedAt: new Date(),
    })
    .onConflictDoUpdate({
      target: [workspaceEnvironment.workspaceId],
      set: { variables: merged, updatedAt: new Date() },
    })

  invalidateEffectiveDecryptedEnvCache({ workspaceId })
  const newKeys = Object.keys(newVars).filter((k) => !(k in existingWsEncrypted))
  await createWorkspaceEnvCredentials({ workspaceId, newKeys, actingUserId })

  return updatedKeys
}

/**
 * Returns a merged decrypted env map for webhook/copilot/MCP config resolution.