Implement Project-level environment variables (WIP)

jankeromnes · jankeromnes · commit a056a5414f41 · 2021-12-24T17:34:13.000Z
diff --git a/components/dashboard/src/App.tsx b/components/dashboard/src/App.tsx
@@ -21,7 +21,6 @@ import { trackButtonOrAnchor, trackPathChange, trackLocation } from './Analytics
 import { User } from '@gitpod/gitpod-protocol';
 import * as GitpodCookie from '@gitpod/gitpod-protocol/lib/util/gitpod-cookie';
 import { Experiment } from './experiments';
-import ProjectSettings from './projects/ProjectSettings';
 
 const Setup = React.lazy(() => import(/* webpackPrefetch: true */ './Setup'));
 const Workspaces = React.lazy(() => import(/* webpackPrefetch: true */ './workspaces/Workspaces'));
@@ -42,6 +41,8 @@ const NewProject = React.lazy(() => import(/* webpackPrefetch: true */ './projec
 const ConfigureProject = React.lazy(() => import(/* webpackPrefetch: true */ './projects/ConfigureProject'));
 const Projects = React.lazy(() => import(/* webpackPrefetch: true */ './projects/Projects'));
 const Project = React.lazy(() => import(/* webpackPrefetch: true */ './projects/Project'));
+const ProjectSettings = React.lazy(() => import(/* webpackPrefetch: true */ './projects/ProjectSettings'));
+const ProjectVariables = React.lazy(() => import(/* webpackPrefetch: true */ './projects/ProjectVariables'));
 const Prebuilds = React.lazy(() => import(/* webpackPrefetch: true */ './projects/Prebuilds'));
 const Prebuild = React.lazy(() => import(/* webpackPrefetch: true */ './projects/Prebuild'));
 const InstallGitHubApp = React.lazy(() => import(/* webpackPrefetch: true */ './projects/InstallGitHubApp'));
@@ -305,6 +306,9 @@ function App() {
                         if (resourceOrPrebuild === "configure") {
                             return <ConfigureProject />;
                         }
+                        if (resourceOrPrebuild === "variables") {
+                            return <ProjectVariables />;
+                        }
                         if (resourceOrPrebuild === "workspaces") {
                             return <Workspaces />;
                         }
@@ -338,11 +342,14 @@ function App() {
                             if (maybeProject === "settings") {
                                 return <TeamSettings />;
                             }
+                            if (resourceOrPrebuild === "settings") {
+                                return <ProjectSettings />;
+                            }
                             if (resourceOrPrebuild === "configure") {
                                 return <ConfigureProject />;
                             }
-                            if (resourceOrPrebuild === "settings") {
-                                return <ProjectSettings />;
+                            if (resourceOrPrebuild === "variables") {
+                                return <ProjectVariables />;
                             }
                             if (resourceOrPrebuild === "workspaces") {
                                 return <Workspaces />;
diff --git a/components/dashboard/src/Menu.tsx b/components/dashboard/src/Menu.tsx
@@ -47,7 +47,7 @@ export default function Menu() {
     })();
     const prebuildId = (() => {
         const resource = projectSlug && match?.params?.segment3;
-        if (resource !== "workspaces" && resource !== "prebuilds" && resource !== "settings" && resource !== "configure") {
+        if (resource !== "workspaces" && resource !== "prebuilds" && resource !== "settings" && resource !== "configure" && resource !== "variables") {
             return resource;
         }
     })();
diff --git a/components/dashboard/src/projects/ProjectSettings.tsx b/components/dashboard/src/projects/ProjectSettings.tsx
@@ -25,6 +25,10 @@ export function getProjectSettingsMenu(project?: Project, team?: Team) {
             title: 'Configuration',
             link: [`/${teamOrUserSlug}/${project?.slug || project?.name}/configure`],
         },
+        {
+            title: 'Variables',
+            link: [`/${teamOrUserSlug}/${project?.slug || project?.name}/variables`],
+        },
     ];
 }
 
diff --git a/components/dashboard/src/projects/ProjectVariables.tsx b/components/dashboard/src/projects/ProjectVariables.tsx
@@ -0,0 +1,76 @@
+/**
+ * Copyright (c) 2021 Gitpod GmbH. All rights reserved.
+ * Licensed under the GNU Affero General Public License (AGPL).
+ * See License-AGPL.txt in the project root for license information.
+ */
+
+import { Project, ProjectEnvVar } from "@gitpod/gitpod-protocol";
+import { useContext, useEffect, useState } from "react";
+import Modal from "../components/Modal";
+import { getGitpodService } from "../service/service";
+import { ProjectContext } from "./project-context";
+import { ProjectSettingsPage } from "./ProjectSettings";
+
+export default function () {
+    const { project } = useContext(ProjectContext);
+    const [ envVars, setEnvVars ] = useState<ProjectEnvVar[]>([]);
+    const [ showAddVariableModal, setShowAddVariableModal ] = useState<boolean>(false);
+
+    const updateEnvVars = async () => {
+        if (!project) {
+            return;
+        }
+        const vars = await getGitpodService().server.getProjectEnvironmentVariables(project.id);
+        setEnvVars(vars);
+    }
+
+    useEffect(() => {
+        updateEnvVars();
+    }, [project]);
+
+    return <ProjectSettingsPage project={project}>
+        {showAddVariableModal && <AddVariableModal project={project} onClose={() => { updateEnvVars(); setShowAddVariableModal(false); }} />}
+        <h3>Project Variables</h3>
+        <ul>{envVars.map(e => <li>{e.name}</li>)}</ul>
+        <button onClick={() => setShowAddVariableModal(true)}>Add Variable</button>
+    </ProjectSettingsPage>;
+}
+
+function AddVariableModal(props: { project?: Project, onClose: () => void }) {
+    const [ name, setName ] = useState<string>("");
+    const [ value, setValue ] = useState<string>("");
+    const [ error, setError ] = useState<Error | undefined>();
+
+    const addVariable = async () => {
+        if (!props.project) {
+            return;
+        }
+        try {
+            await getGitpodService().server.setProjectEnvironmentVariable(props.project.id, name, value);
+            props.onClose();
+        } catch (err) {
+            setError(err);
+        }
+    }
+
+    return <Modal visible={true} onClose={props.onClose}>
+        <h3 className="mb-4">Add Variable</h3>
+        <div className="border-t border-b border-gray-200 dark:border-gray-800 -mx-6 px-6 py-4 flex flex-col">
+            {error && <div className="bg-gitpod-kumquat-light rounded-md p-3 text-gitpod-red text-sm mb-2">
+                {error}
+            </div>}
+            <div>
+                <h4>Name</h4>
+                <input autoFocus className="w-full" type="text" value={name} onChange={e => setName(e.target.value)} />
+            </div>
+            <div className="mt-4">
+                <h4>Value</h4>
+                <input className="w-full" type="text" value={value} onChange={e => setValue(e.target.value)} />
+            </div>
+        </div>
+        <div className="flex justify-end mt-6">
+            <button className="secondary" onClick={props.onClose}>Cancel</button>
+            <button className="ml-2" onClick={addVariable} >Add Variable</button>
+        </div>
+    </Modal>;
+}
diff --git a/components/gitpod-db/src/project-db.ts b/components/gitpod-db/src/project-db.ts
@@ -4,7 +4,7 @@
  * See License.enterprise.txt in the project root folder.
  */
 
-import { PartialProject, Project } from "@gitpod/gitpod-protocol";
+import { PartialProject, Project, ProjectEnvVar } from "@gitpod/gitpod-protocol";
 
 export const ProjectDB = Symbol('ProjectDB');
 export interface ProjectDB {
@@ -16,4 +16,7 @@ export interface ProjectDB {
     storeProject(project: Project): Promise<Project>;
     updateProject(partialProject: PartialProject): Promise<void>;
     markDeleted(projectId: string): Promise<void>;
+    setProjectEnvironmentVariable(projectId: string, name: string, value: string): Promise<void>;
+    getProjectEnvironmentVariables(projectId: string): Promise<ProjectEnvVar[]>;
+    deleteProjectEnvironmentVariable(projectId: string, name: string): Promise<void>;
 }
diff --git a/components/gitpod-db/src/tables.ts b/components/gitpod-db/src/tables.ts
@@ -47,7 +47,7 @@ export class GitpodSessionTableDescriptionProvider implements TableDescriptionPr
 /**
  * BEWARE
  *
- * When updating this list, make sure you update the deleted-entry-gc in gitpod-db
+ * When updating this list, make sure you update the deleted-entry-gc.ts in gitpod-db
  * as well, if you're adding a table that needs some of its entries deleted.
  */
 @injectable()
@@ -250,6 +250,18 @@ export class GitpodTableDescriptionProvider implements TableDescriptionProvider
             deletionColumn: 'deleted',
             timeColumn: '_lastModified',
         },
+        {
+            name: 'd_b_project_env_var',
+            primaryKeys: ['id', 'projectId'],
+            deletionColumn: 'deleted',
+            timeColumn: '_lastModified',
+        },
+        /**
+         * BEWARE
+         *
+         * When updating this list, make sure you update the deleted-entry-gc.ts in gitpod-db
+         * as well, if you're adding a table that needs some of its entries deleted.
+         */
     ]
 
     public getSortedTables(): TableDescription[] {
diff --git a/components/gitpod-db/src/typeorm/deleted-entry-gc.ts b/components/gitpod-db/src/typeorm/deleted-entry-gc.ts
@@ -58,6 +58,7 @@ const tables: TableWithDeletion[] = [
     { deletionColumn: "deleted", name: "d_b_project" },
     { deletionColumn: "deleted", name: "d_b_prebuild_info" },
     { deletionColumn: "deleted", name: "d_b_oss_allow_list" },
+    { deletionColumn: "deleted", name: "d_b_project_env_var" },
 ];
 
 interface TableWithDeletion {
diff --git a/components/gitpod-db/src/typeorm/entity/db-project-env-vars.ts b/components/gitpod-db/src/typeorm/entity/db-project-env-vars.ts
@@ -0,0 +1,46 @@
+/**
+ * Copyright (c) 2022 Gitpod GmbH. All rights reserved.
+ * Licensed under the GNU Affero General Public License (AGPL).
+ * See License-AGPL.txt in the project root for license information.
+ */
+
+import { PrimaryColumn, Entity, Column } from "typeorm";
+import { TypeORM } from "../typeorm";
+import { ProjectEnvVarWithValue } from "@gitpod/gitpod-protocol";
+import { Transformer } from "../transformer";
+import { encryptionService } from "../user-db-impl";
+
+@Entity()
+// on DB but not Typeorm: @Index("ind_lastModified", ["_lastModified"])   // DBSync
+export class DBProjectEnvVar implements ProjectEnvVarWithValue {
+    @PrimaryColumn(TypeORM.UUID_COLUMN_TYPE)
+    id: string;
+
+    // projectId must be part of the primary key as otherwise malicious users could overwrite
+    // the value of arbitrary user env vars because we use TypeORM.save. If the projectId were
+    // not part of the primary key, this save call would overwrite env vars with arbitrary IDs,
+    // allowing an attacker to steal other users environment variables.
+    // But projectId is part of the primary key and we ensure that users can only overwrite/set variables
+    // that belong to them.
+    @PrimaryColumn(TypeORM.UUID_COLUMN_TYPE)
+    projectId: string;
+
+    @Column()
+    name: string;
+
+    @Column({
+        type: "simple-json",
+        transformer: Transformer.compose(
+            Transformer.SIMPLE_JSON([]),
+            Transformer.encrypted(() => encryptionService)
+        )
+    })
+    value: string;
+
+    @Column("varchar")
+    creationTime: string;
+
+    // This column triggers the db-sync deletion mechanism. It's not intended for public consumption.
+    @Column()
+    deleted: boolean;
+}
diff --git a/components/gitpod-db/src/typeorm/migration/1639735838107-ProjectEnvVars.ts b/components/gitpod-db/src/typeorm/migration/1639735838107-ProjectEnvVars.ts
@@ -0,0 +1,18 @@
+/**
+ * Copyright (c) 2022 Gitpod GmbH. All rights reserved.
+ * Licensed under the GNU Affero General Public License (AGPL).
+ * See License-AGPL.txt in the project root for license information.
+ */
+
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class ProjectEnvVars1639735838107 implements MigrationInterface {
+
+    public async up(queryRunner: QueryRunner): Promise<void> {
+        await queryRunner.query("CREATE TABLE IF NOT EXISTS `d_b_project_env_var` (`id` char(36) NOT NULL, `projectId` char(36) NOT NULL, `name` varchar(255) NOT NULL, `value` text NOT NULL, `creationTime` varchar(255) NOT NULL, `deleted` tinyint(4) NOT NULL DEFAULT '0', `_lastModified` timestamp(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6), PRIMARY KEY (`id`, `projectId`), KEY `ind_projectid` (projectId), KEY `ind_dbsync` (`_lastModified`)) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;");
+    }
+
+    public async down(queryRunner: QueryRunner): Promise<void> {
+    }
+
+}
diff --git a/components/gitpod-db/src/typeorm/project-db-impl.ts b/components/gitpod-db/src/typeorm/project-db-impl.ts
@@ -7,22 +7,31 @@
 import { inject, injectable } from "inversify";
 import { TypeORM } from "./typeorm";
 import { Repository } from "typeorm";
+import { v4 as uuidv4 } from 'uuid';
+import { PartialProject, Project, ProjectEnvVar } from "@gitpod/gitpod-protocol";
+import { EncryptionService } from "@gitpod/gitpod-protocol/lib/encryption/encryption-service";
+import { censor } from '@gitpod/gitpod-protocol/lib/util/censor';
 import { ProjectDB } from "../project-db";
 import { DBProject } from "./entity/db-project";
-import { PartialProject, Project } from "@gitpod/gitpod-protocol";
+import { DBProjectEnvVar } from "./entity/db-project-env-vars";
 
 @injectable()
 export class ProjectDBImpl implements ProjectDB {
     @inject(TypeORM) typeORM: TypeORM;
+    @inject(EncryptionService) protected readonly encryptionService: EncryptionService;
 
     protected async getEntityManager() {
         return (await this.typeORM.getConnection()).manager;
     }
 
-    async getRepo(): Promise<Repository<DBProject>> {
+    protected async getRepo(): Promise<Repository<DBProject>> {
         return (await this.getEntityManager()).getRepository<DBProject>(DBProject);
     }
 
+    protected async getProjectEnvVarRepo(): Promise<Repository<DBProjectEnvVar>> {
+        return (await this.getEntityManager()).getRepository<DBProjectEnvVar>(DBProjectEnvVar);
+    }
+
     public async findProjectById(projectId: string): Promise<Project | undefined> {
         const repo = await this.getRepo();
         return repo.findOne({ id: projectId, markedDeleted: false });
@@ -93,4 +102,39 @@ export class ProjectDBImpl implements ProjectDB {
             await repo.save(project);
         }
     }
+
+    public async setProjectEnvironmentVariable(projectId: string, name: string, value: string): Promise<void>{
+        const envVarRepo = await this.getProjectEnvVarRepo();
+        let envVar = await envVarRepo.findOne({ projectId, name, deleted: false });
+        if (envVar) {
+            envVar.value = value;
+        } else {
+            envVar = {
+                id: uuidv4(),
+                projectId,
+                name,
+                value,
+                creationTime: new Date().toISOString(),
+                deleted: false,
+            };
+        }
+        await envVarRepo.save(envVar);
+    }
+
+    public async getProjectEnvironmentVariables(projectId: string): Promise<ProjectEnvVar[]> {
+        const envVarRepo = await this.getProjectEnvVarRepo();
+        const envVarsWithValue = await envVarRepo.find({ projectId, deleted: false });
+        const envVars = envVarsWithValue.map(v => (censor(v, 'value') as any as ProjectEnvVar));
+        return envVars;
+    }
+
+    public async deleteProjectEnvironmentVariable(projectId: string, name: string): Promise<void> {
+        const envVarRepo = await this.getProjectEnvVarRepo();
+        const envVar = await envVarRepo.findOne({ projectId, name, deleted: false });
+        if (!envVar) {
+            throw new Error('A environment variable with this name could not be found for this project');
+        }
+        envVar.deleted = true;
+        envVarRepo.update(envVar.id, envVar);
+    }
 }
diff --git a/components/gitpod-protocol/src/gitpod-service.ts b/components/gitpod-protocol/src/gitpod-service.ts
@@ -9,7 +9,7 @@ import {
     WhitelistedRepository, WorkspaceImageBuild, AuthProviderInfo, Branding, CreateWorkspaceMode,
     Token, UserEnvVarValue, ResolvePluginsParams, PreparePluginUploadParams, Terms,
     ResolvedPlugins, Configuration, InstallPluginsParams, UninstallPluginParams, UserInfo, GitpodTokenType,
-    GitpodToken, AuthProviderEntry, GuessGitTokenScopesParams, GuessedGitTokenScopes
+    GitpodToken, AuthProviderEntry, GuessGitTokenScopesParams, GuessedGitTokenScopes, ProjectEnvVar
 } from './protocol';
 import {
     Team, TeamMemberInfo,
@@ -142,6 +142,9 @@ export interface GitpodServer extends JsonRpcServer<GitpodClient>, AdminServer,
     guessRepositoryConfiguration(cloneUrl: string): Promise<string | undefined>;
     setProjectConfiguration(projectId: string, configString: string): Promise<void>;
     updateProjectPartial(partialProject: PartialProject): Promise<void>;
+    setProjectEnvironmentVariable(projectId: string, name: string, value: string): Promise<void>;
+    getProjectEnvironmentVariables(projectId: string): Promise<ProjectEnvVar[]>;
+    deleteProjectEnvironmentVariable(projectId: string, name: string): Promise<void>;
 
     // content service
     getContentBlobUploadUrl(name: string): Promise<string>
diff --git a/components/gitpod-protocol/src/protocol.ts b/components/gitpod-protocol/src/protocol.ts
@@ -151,10 +151,19 @@ export interface UserFeatureSettings {
 export const WorkspaceFeatureFlags = { "full_workspace_backup": undefined, "fixed_resources": undefined };
 export type NamedWorkspaceFeatureFlag = keyof (typeof WorkspaceFeatureFlags);
 
+export interface ProjectEnvVarWithValue {
+    id: string;
+    projectId: string;
+    name: string;
+    value: string;
+}
+
+export type ProjectEnvVar = Omit<Project, 'value'>;
+
 export interface UserEnvVarValue {
     id?: string;
     name: string;
-    repositoryPattern: string;
+    repositoryPattern: string; // DEPRECATED: Use ProjectEnvVar instead - https://github.com/gitpod-com/gitpod/issues/5322
     value: string;
 }
 export interface UserEnvVar extends UserEnvVarValue {
@@ -163,6 +172,7 @@ export interface UserEnvVar extends UserEnvVarValue {
     deleted?: boolean;
 }
 
+// DEPRECATED: Use ProjectEnvVar instead - https://github.com/gitpod-com/gitpod/issues/5322
 export namespace UserEnvVar {
 
     export function normalizeRepoPattern(pattern: string) {
diff --git a/components/server/src/auth/rate-limiter.ts b/components/server/src/auth/rate-limiter.ts
@@ -80,6 +80,9 @@ function getConfig(config: RateLimiterConfig): RateLimiterConfig {
         "getAllEnvVars": { group: "default", points: 1 },
         "setEnvVar": { group: "default", points: 1 },
         "deleteEnvVar": { group: "default", points: 1 },
+        "setProjectEnvironmentVariable": { group: "default", points: 1 },
+        "getProjectEnvironmentVariables": { group: "default", points: 1 },
+        "deleteProjectEnvironmentVariable": { group: "default", points: 1 },
         "getTeams": { group: "default", points: 1 },
         "getTeamMembers": { group: "default", points: 1 },
         "createTeam": { group: "default", points: 1 },
diff --git a/components/server/src/projects/projects-service.ts b/components/server/src/projects/projects-service.ts
diff --git a/components/server/src/workspace/gitpod-server-impl.ts b/components/server/src/workspace/gitpod-server-impl.ts

Original file line number	Diff line number	Diff line change
`@@ -47,7 +47,7 @@ export default function Menu() {`
`47`	`47`	`})();`
`48`	`48`	`const prebuildId = (() => {`
`49`	`49`	`const resource = projectSlug && match?.params?.segment3;`
`50`		`- if (resource !== "workspaces" && resource !== "prebuilds" && resource !== "settings" && resource !== "configure") {`
	`50`	`+ if (resource !== "workspaces" && resource !== "prebuilds" && resource !== "settings" && resource !== "configure" && resource !== "variables") {`
`51`	`51`	`return resource;`
`52`	`52`	`}`
`53`	`53`	`})();`