Function resolveKey

packages/db/scripts/migrate-block-api-keys-to-byok.ts:329–368

(
  ref: RawKeyRef,
  env: EnvLookup,
  ctx: ResolveKeyContext
)

}

async function resolveKey(
  ref: RawKeyRef,
  env: EnvLookup,
  ctx: ResolveKeyContext
): Promise<{ key: string | null; source: KeySource; envVarFailed: boolean }> {
  if (!isEnvVarReference(ref.rawValue)) {
    return { key: ref.rawValue, source: 'plaintext', envVarFailed: false }
  }

  const varName = extractEnvVarName(ref.rawValue)
  if (!varName) return { key: null, source: 'personal', envVarFailed: true }

  const personalVars = env.personalEnvCache.get(ref.userId)

  const wsValue = env.wsEnvVars[varName]
  const personalValue = personalVars?.[varName]
  const encryptedValue = wsValue ?? personalValue
  const source: KeySource = wsValue ? 'workspace' : 'personal'

  const logPrefix =
    `workspace=${ctx.workspaceId} owner=${ctx.workspaceOwnerId ?? 'unknown'}` +
    ` workflow=${ref.workflowId} user=${ref.userId}`

  if (!encryptedValue) {
    console.warn(
      `  [WARN] Env var "${varName}" not found — ${logPrefix} "${ref.blockName}" in "${ref.workflowName}"`
    )
    return { key: null, source, envVarFailed: true }
  }

  try {
    const decrypted = await decryptSecret(encryptedValue)
    return { key: decrypted, source, envVarFailed: false }
  } catch (error) {
    console.warn(
      `  [WARN] Failed to decrypt env var "${varName}" — ${logPrefix} "${ref.blockName}" in "${ref.workflowName}": ${error}`
    )
    return { key: null, source, envVarFailed: true }
  }
}

async function processWorkspace(
  workspaceId: string,