Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Greptile SummaryThis PR adds inline secret entry support to chat messages. The main changes are:
Confidence Score: 4/5The chat secret save path needs fixes before merging.
apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags.tsx
|
| Filename | Overview |
|---|---|
| apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags.tsx | Adds parsing and rendering for chat secret inputs, with new environment-save behavior and permission gates. |
Reviews (1): Last reviewed commit: "improvement(secrets): special tags impro..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| function SecretInputDisplay({ data }: { data: CredentialTagData }) { | ||
| const { workspaceId } = useParams<{ workspaceId: string }>() | ||
| const secretName = (data.name ?? '').trim() | ||
| const scope: SecretInputScope = data.scope === 'personal' ? 'personal' : 'workspace' |
There was a problem hiding this comment.
When a chat secret_input tag omits scope, this defaults the pasted credential to workspace and saves it through the shared workspace environment path. A user-provided API key entered in chat can therefore become a workspace secret instead of a user-only credential, exposing the key name and making the secret available to workspace-scoped flows.
Rule Used: API keys and other user-provided credentials shoul... (source)
Learned From
simstudioai/sim#2133
| const merged: Record<string, string> = {} | ||
| for (const [key, entry] of Object.entries(personalEnv ?? {})) merged[key] = entry.value | ||
| merged[secretName] = value | ||
| await savePersonal.mutateAsync({ variables: merged }) |
There was a problem hiding this comment.
This personal save path rebuilds the entire environment map from the current personalEnv snapshot before sending it to an endpoint that replaces the stored map. If two chat widgets or tabs save different personal secrets from the same cached snapshot, the later save omits the first new key and removes it from the user's personal environment.
| if (data.type === 'link') { | ||
| if (!data.provider) return null | ||
| // Connecting a credential mutates the workspace — hide it from read-only members. | ||
| if (!data.provider || !canEdit) return null |
There was a problem hiding this comment.
This hides every link credential tag from read-only workspace members, even though the tag's value is just the OAuth/connect URL rendered from the chat message. If that URL starts a personal credential connection rather than a workspace-level mutation, read-only members lose the only visible action for connecting their own account.
t# with '#' will be ignored, and an empty message aborts the commit.
1 participant
Summary
Add secrets input in chat
Type of Change
Testing
Manual
Checklist