Fixup: Prevent public var and secret overlap

Author: martintomazic

cmd/rofl/mgmt.go

@@ -652,6 +652,7 @@ var (
 			if err := appID.UnmarshalText([]byte(deployment.AppID)); err != nil {
 				cobra.CheckErr(fmt.Errorf("malformed ROFL app ID: %w", err))
 			}
+			cobra.CheckErr(checkNoPublicVarNamed(deployment.Metadata, secretName))
 
 			// Establish connection with the target network.
 			ctx := context.Background()
@@ -769,6 +770,8 @@ var (
 
 			var imported, updated int
 			for _, name := range names {
+				cobra.CheckErr(checkNoPublicVarNamed(deployment.Metadata, name))
+
 				value := []byte(entries[name])
 
 				encValue, err := buildRofl.EncryptSecret(name, value, appCfg.SEK)

cmd/rofl/public_var.go

@@ -5,11 +5,13 @@ import (
 	"io"
 	"os"
 	"sort"
+	"strings"
 	"unicode/utf8"
 
 	"github.com/spf13/cobra"
 
 	buildDotenv "github.com/oasisprotocol/cli/build/dotenv"
+	buildRofl "github.com/oasisprotocol/cli/build/rofl"
 	"github.com/oasisprotocol/cli/cmd/common"
 	roflCommon "github.com/oasisprotocol/cli/cmd/rofl/common"
 )
@@ -42,6 +44,7 @@ var (
 			if err != nil {
 				cobra.CheckErr(err)
 			}
+			cobra.CheckErr(checkNoSecretNamed(deployment.Secrets, publicVarName))
 
 			// Read public variable.
 			var publicVarValueRaw []byte
@@ -139,6 +142,7 @@ var (
 				if err != nil {
 					cobra.CheckErr(err)
 				}
+				cobra.CheckErr(checkNoSecretNamed(deployment.Secrets, name))
 
 				if existing, ok := deployment.Metadata[key]; ok {
 					if existing == entries[name] {
@@ -240,6 +244,33 @@ func publicVarMetadataKey(name string) (string, error) {
 	return publicVarMetadataPrefix + name, nil
 }
 
+// checkNoSecretNamed returns an error if a secret exposed under the given environment variable
+// name exists among the secrets.
+func checkNoSecretNamed(secrets []*buildRofl.SecretConfig, name string) error {
+	for _, sc := range secrets {
+		if secretEnvVarName(sc.Name) == name {
+			return fmt.Errorf("the secret named '%s' for deployment '%s' already exists", sc.Name, roflCommon.DeploymentName)
+		}
+	}
+	return nil
+}
+
+// checkNoPublicVarNamed returns an error if a public variable exposed under the same environment
+// variable name as a secret with the given name exists in the deployment metadata.
+func checkNoPublicVarNamed(metadata map[string]string, name string) error {
+	envName := secretEnvVarName(name)
+	if _, ok := metadata[publicVarMetadataPrefix+envName]; ok {
+		return fmt.Errorf("the public variable named '%s' for deployment '%s' already exists", envName, roflCommon.DeploymentName)
+	}
+	return nil
+}
+
+// secretEnvVarName returns the environment variable name under which rofl-containers exposes a
+// secret with the given name.
+func secretEnvVarName(name string) string {
+	return strings.ToUpper(strings.ReplaceAll(name, " ", "_"))
+}
+
 func validatePublicVarName(name string) error {
 	if name == "" {
 		return fmt.Errorf("public variable name cannot be empty")