Rename STACK_SEED_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY to STACK_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY#1411
Rename STACK_SEED_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY to STACK_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY#1411
Conversation
…TERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughThis PR renames the environment variable ChangesEnvironment Variable Rename: STACK_SEED_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY → STACK_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
apps/backend/.env (1)
8-19: 💤 Low valueConsider moving
STACK_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEYout of the "seed script settings" section.This variable is no longer seed-only —
apps/backend/src/stack.tsxnow reads it at runtime ingetStackServerApp(). Leaving it under the# seed script settingsheader next to keys that remainSTACK_SEED_*may confuse operators about whether it's required only at seed time. Consider relocating it to its own section or adding a clarifying comment, e.g.:📝 Proposed clarifying comment
STACK_SEED_INTERNAL_PROJECT_USER_GITHUB_ID=# add github oauth id to the default user +# Required at runtime by the backend (apps/backend/src/stack.tsx) and at seed time. Unlike the STACK_SEED_* keys, this is not seed-only. STACK_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY=# default publishable client key for the internal project STACK_SEED_INTERNAL_PROJECT_SECRET_SERVER_KEY=# default secret server key for the internal project STACK_SEED_INTERNAL_PROJECT_SUPER_SECRET_ADMIN_KEY=# default super secret admin key for the internal project🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/backend/.env` around lines 8 - 19, The env var STACK_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY is used at runtime by getStackServerApp(), so move it out of the "seed script settings" block or add a clarifying comment above the variable indicating it's required at runtime (not just for seeding); update the .env grouping/header so STACK_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY is either in a new "runtime settings" section or annotated with a note referencing getStackServerApp() to avoid operator confusion.apps/backend/src/stack.tsx (1)
20-21: ⚖️ Poor tradeoffNaming inconsistency:
secretServerKeystill usesSTACK_SEED_*prefix even though it's also read at runtime here.
getStackServerApp()is invoked at backend runtime (not just seed time), yet only the publishable client key was renamed. ThesecretServerKeyon line 21 still pulls fromSTACK_SEED_INTERNAL_PROJECT_SECRET_SERVER_KEY, which now misleadingly suggests it's seed-only. Consider renamingSTACK_SEED_INTERNAL_PROJECT_SECRET_SERVER_KEY→STACK_INTERNAL_PROJECT_SECRET_SERVER_KEYin a follow-up so the naming convention is uniform across the keys this constructor consumes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/backend/src/stack.tsx` around lines 20 - 21, The env key name is inconsistent: secretServerKey is still reading STACK_SEED_INTERNAL_PROJECT_SECRET_SERVER_KEY even though getStackServerApp() is used at runtime; update the call that sets secretServerKey to read STACK_INTERNAL_PROJECT_SECRET_SERVER_KEY instead of STACK_SEED_INTERNAL_PROJECT_SECRET_SERVER_KEY and rename the environment variable everywhere else (docs, .env templates, seed scripts) to match; ensure the change is applied where the object with publishableClientKey and secretServerKey is constructed so both keys share the STACK_INTERNAL_PROJECT_* naming convention.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@apps/backend/.env`:
- Around line 8-19: The env var STACK_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY is
used at runtime by getStackServerApp(), so move it out of the "seed script
settings" block or add a clarifying comment above the variable indicating it's
required at runtime (not just for seeding); update the .env grouping/header so
STACK_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY is either in a new "runtime
settings" section or annotated with a note referencing getStackServerApp() to
avoid operator confusion.
In `@apps/backend/src/stack.tsx`:
- Around line 20-21: The env key name is inconsistent: secretServerKey is still
reading STACK_SEED_INTERNAL_PROJECT_SECRET_SERVER_KEY even though
getStackServerApp() is used at runtime; update the call that sets
secretServerKey to read STACK_INTERNAL_PROJECT_SECRET_SERVER_KEY instead of
STACK_SEED_INTERNAL_PROJECT_SECRET_SERVER_KEY and rename the environment
variable everywhere else (docs, .env templates, seed scripts) to match; ensure
the change is applied where the object with publishableClientKey and
secretServerKey is constructed so both keys share the STACK_INTERNAL_PROJECT_*
naming convention.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 46e7f058-0a78-4395-a2e5-f8f2057efe47
📒 Files selected for processing (9)
apps/backend/.envapps/backend/.env.developmentapps/backend/prisma/seed.tsapps/backend/src/stack.tsxdocker/local-emulator/generate-env-development.mjsdocker/local-emulator/qemu/cloud-init/emulator/user-datadocker/local-emulator/qemu/run-emulator.shdocker/local-emulator/rotate-secrets.shdocker/server/entrypoint.sh
Greptile SummaryThis PR completes a mechanical rename of
Confidence Score: 4/5Safe to merge into dev assuming any external deployment configs (CI secrets, Kubernetes, cloud environments) that set the old variable name are updated before or alongside this change. The rename is thorough and complete — no occurrences of the old name survive in the repo. The remaining concern is that any operator running the Docker image with the old variable name in their environment will either get a silent random-key substitution (standard mode) or a hard startup failure (emulator mode). Two test-plan items were left unchecked, including the one that covers external config verification. docker/server/entrypoint.sh and docker/local-emulator/rotate-secrets.sh are the most operationally sensitive files — they are the runtime entry points that consume or validate the renamed variable and will fail visibly if callers haven't switched over. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[VM boot / host] -->|generates openssl rand -hex 32| B[STACK_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY]
B --> C{Deployment mode?}
C -->|Emulator mode| D[user-data cloud-init\nsets var in env-file]
C -->|Emulator mode| E[run-emulator.sh\nqga_trigger_fast_rotate payload]
C -->|Standard Docker| F[entrypoint.sh\nautofills with openssl rand -base64 32\nif not set]
D --> G[entrypoint.sh\nvalidates & exports var]
E --> H[rotate-secrets.sh\nvalidates hex, writes rotated-secrets.env,\npatches JS bundles, UPDATEs ApiKeySet]
G --> I[seed.ts\nreads process.env.STACK_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY\nupserts internal ApiKeySet]
G --> J[stack.tsx\ngetEnvVariable to construct StackServerApp]
F --> I
F --> J
Prompt To Fix All With AIFix the following 1 code review issue. Work through them one at a time, proposing concise fixes.
---
### Issue 1 of 1
apps/backend/src/stack.tsx:20-21
The PCK is now read under `STACK_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY` (no `SEED` prefix), while `secretServerKey` still reads from `STACK_SEED_INTERNAL_PROJECT_SECRET_SERVER_KEY`. This creates a naming inconsistency within the same constructor call that may confuse operators configuring both variables. Consider renaming the SSK variable in a follow-up to align the convention, or add a comment here explaining why the prefix differs.
```suggestion
publishableClientKey: getEnvVariable('STACK_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY'),
secretServerKey: getEnvVariable('STACK_SEED_INTERNAL_PROJECT_SECRET_SERVER_KEY'), // TODO: rename to STACK_INTERNAL_PROJECT_SECRET_SERVER_KEY for consistency
```
Reviews (1): Last reviewed commit: "rename STACK_SEED_INTERNAL_PROJECT_PUBLI..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
2 participants
Summary
STACK_SEED_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEYtoSTACK_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEYeverywhere it is used (24 occurrences across 9 files), covering backend env files, the Prisma seed script, runtime config, and the docker entrypoint/local-emulator scripts.Test plan
pnpm lintpnpm typecheckSummary by CodeRabbit