GeezerVison

area: webapp

type: feature

When regenerating an environment's API key you can now revoke the previous key immediately instead of keeping it working for 24 hours. Use this when a key may have leaked.

import { InputGroup } from "../primitives/InputGroup";

import { Paragraph } from "../primitives/Paragraph";

import { CheckboxWithLabel } from "../primitives/Checkbox";

import { RadioGroup, RadioGroupItem } from "../primitives/RadioButton";

import { Spinner } from "../primitives/Spinner";

type ModalProps = {

return (

<div className="flex flex-col items-center gap-y-4 pt-4">

<Callout variant="warning">

{`A new API key will be issued for the ${title} environment. The previous key stays valid

{`A new API key will be issued for the ${title} environment. Choose what happens to the previous key.`}

</Callout>

<fetcher.Form

method="post"

action={`/resources/environments/${id}/regenerate-api-key`}

className="mt-2 w-full"

>

<Fieldset className="w-full">

<InputGroup className="max-w-full">

<RadioGroup name="previousKey" defaultValue="grace" className="flex flex-col gap-2">

<RadioGroupItem

id="previousKey-grace"

value="grace"

variant="description"

label="Keep the previous key working for 24 hours"

description="Roll out the new key to your environment variables without downtime. The previous key stops working after 24 hours."

/>

<RadioGroupItem

id="previousKey-revoke"

value="revoke"

variant="description"

label="Revoke the previous key immediately"

description="Choose this if the key may have leaked. Deployments and services still using the previous key will fail until they are updated with the new key."

/>

</RadioGroup>

</InputGroup>

<InputGroup className="max-w-full">

<Paragraph variant="small/bright">Enter this text below to confirm:</Paragraph>

<Paragraph

environmentId: string;

type RegenerateApiKeyInput = RootApiKeyMutationInput & {

revokeImmediately?: boolean;

export class RootApiKeyNotVisibleError extends Error {

constructor() {

super("The root API key is no longer visible");

export async function regenerateApiKey(

input: RootApiKeyMutationInput,

{ revokeImmediately = false, ...input }: RegenerateApiKeyInput,

{ prismaClient = prisma }: { prismaClient?: PrismaClient } = {}

) {

const environment = await findRootApiKeyEnvironment(input, prismaClient);

},

});

await tx.revokedApiKey.create({

data: {

apiKey: currentEnvironment.apiKey,

runtimeEnvironmentId: environment.id,

expiresAt: revokedApiKeyExpiresAt,

},

});

if (!revokeImmediately) {

await tx.revokedApiKey.create({

data: {

apiKey: currentEnvironment.apiKey,

runtimeEnvironmentId: environment.id,

expiresAt: revokedApiKeyExpiresAt,

},

});

}

return { ...environment, apiKey: newApiKey, pkApiKey: newPkApiKey };

}

env: z.enum(["dev", "staging", "prod", "preview"]),

const BodySchema = z.object({

revokeImmediately: z.boolean().default(false),

export async function action({ request, params }: ActionFunctionArgs) {

if (request.method.toUpperCase() !== "POST") {

return json({ error: "Method Not Allowed" }, { status: 405 });

return json({ error: "Branch-scoped key rotation is not supported" }, { status: 400 });

}

const rawBody = await request.text();

let body: unknown = {};

if (rawBody.trim().length > 0) {

try {

body = JSON.parse(rawBody);

} catch {

return json({ error: "Invalid JSON body" }, { status: 400 });

}

}

const parsedBody = BodySchema.safeParse(body);

if (!parsedBody.success) {

return json({ error: "Invalid Body" }, { status: 400 });

}

const { revokeImmediately } = parsedBody.data;

const environment = await authenticatedEnvironmentForAuthentication(

authenticationResult,

projectRef,

const updatedEnvironment = await regenerateApiKey({

userId: authenticationResult.result.userId,

environmentId: environment.id,

revokeImmediately,

});

return json({ apiKey: updatedEnvironment.apiKey });

const formData = await request.formData();

const syncToVercel = formData.get("syncToVercel") === "on";

const revokeImmediately = formData.get("previousKey") === "revoke";

try {

const updatedEnvironment = await regenerateApiKey({ userId: user.id, environmentId });

const updatedEnvironment = await regenerateApiKey({

userId: user.id,

environmentId,

revokeImmediately,

});

// Sync the regenerated API key to Vercel only when requested and not for DEVELOPMENT

if (syncToVercel && updatedEnvironment.type !== "DEVELOPMENT") {

isActivated: true,

members: { create: { userId: user.id, role: "ADMIN" } },

},

include: { members: true },

});

const orgMember = organization.members[0];

const project = await prisma.project.create({

data: {

shortcode: suffix.slice(0, 4),

projectId: project.id,

organizationId: organization.id,

orgMemberId: orgMember.id,

},

});

import { containerTest } from "@internal/testcontainers";

import { expect, vi } from "vitest";

import { regenerateApiKey } from "~/models/api-key.server";

import { findEnvironmentByApiKey } from "~/models/runtimeEnvironment.server";

import {

createRuntimeEnvironment,

createTestOrgProjectWithMember,

} from "./fixtures/environmentVariablesFixtures";

vi.setConfig({ testTimeout: 60_000 });

"regenerating keeps the previous root key valid for a grace period",

async ({ prisma }) => {

const { organization, project, user } = await createTestOrgProjectWithMember(prisma);

const environment = await createRuntimeEnvironment(prisma, {

projectId: project.id,

organizationId: organization.id,

type: "PRODUCTION",

});

const oldRootApiKey = environment.apiKey;

const result = await regenerateApiKey(

{ environmentId: environment.id, userId: user.id },

{ prismaClient: prisma }

);

expect(result.apiKey).not.toBe(oldRootApiKey);

const revoked = await prisma.revokedApiKey.findMany({

where: { runtimeEnvironmentId: environment.id },

});

expect(revoked).toHaveLength(1);

expect(revoked[0].apiKey).toBe(oldRootApiKey);

expect(revoked[0].expiresAt.getTime()).toBeGreaterThan(Date.now());

await expect(findEnvironmentByApiKey(oldRootApiKey, undefined, prisma)).resolves.toMatchObject({

id: environment.id,

});

await expect(findEnvironmentByApiKey(result.apiKey, undefined, prisma)).resolves.toMatchObject({

id: environment.id,

});

}

"regenerating with revokeImmediately rejects the previous root key at once",

async ({ prisma }) => {

const { organization, project, user } = await createTestOrgProjectWithMember(prisma);

const environment = await createRuntimeEnvironment(prisma, {

projectId: project.id,

organizationId: organization.id,

type: "PRODUCTION",

});

const oldRootApiKey = environment.apiKey;

const result = await regenerateApiKey(

{ environmentId: environment.id, userId: user.id, revokeImmediately: true },

{ prismaClient: prisma }

);

expect(result.apiKey).not.toBe(oldRootApiKey);

const revoked = await prisma.revokedApiKey.findMany({

where: { runtimeEnvironmentId: environment.id },

});

expect(revoked).toHaveLength(0);

await expect(findEnvironmentByApiKey(oldRootApiKey, undefined, prisma)).resolves.toBeNull();

await expect(findEnvironmentByApiKey(result.apiKey, undefined, prisma)).resolves.toMatchObject({

id: environment.id,

});

}

import { seedTestUserProject } from "./helpers/seedTestUserProject";

describe("regenerate API key branch handling", () => {

it.each(["feature", "", "default"])(

it.each(["feature", "default"])(

"rejects a present branch header without rotating the root key (%s)",

async (branch) => {

const server = getTestServer();

});

expect(revoked?.expiresAt.getTime()).toBeGreaterThan(Date.now());

});

it("revokes the previous key immediately when asked", async () => {

const server = getTestServer();

const { environment, pat, project } = await seedTestUserProject(server.prisma);

const apiKeyRoute = "/api/v1/runs/run_doesnotexist/result";

const response = await server.webapp.fetch(

`/api/v1/projects/${project.externalRef}/dev/regenerate-api-key`,

{

method: "POST",

headers: {

Authorization: `Bearer ${pat.token}`,

"Content-Type": "application/json",

},

body: JSON.stringify({ revokeImmediately: true }),

}

);

expect(response.status).toBe(200);

const body = (await response.json()) as { apiKey: string };

expect(body.apiKey).not.toBe(environment.apiKey);

const revoked = await server.prisma.revokedApiKey.findFirst({

where: { apiKey: environment.apiKey, runtimeEnvironmentId: environment.id },

});

expect(revoked).toBeNull();

const oldKeyResponse = await server.webapp.fetch(apiKeyRoute, {

headers: { Authorization: `Bearer ${environment.apiKey}` },

});

expect(oldKeyResponse.status).toBe(401);

const newKeyResponse = await server.webapp.fetch(apiKeyRoute, {

headers: { Authorization: `Bearer ${body.apiKey}` },

});

expect(newKeyResponse.status).not.toBe(401);

});

it("rejects a malformed body without rotating the root key", async () => {

const server = getTestServer();

const { environment, pat, project } = await seedTestUserProject(server.prisma);

const response = await server.webapp.fetch(

`/api/v1/projects/${project.externalRef}/dev/regenerate-api-key`,

{

method: "POST",

headers: {

Authorization: `Bearer ${pat.token}`,

"Content-Type": "application/json",

},

body: JSON.stringify({ revokeImmediately: "yes" }),

}

);

expect(response.status).toBe(400);

const persisted = await server.prisma.runtimeEnvironment.findUniqueOrThrow({

where: { id: environment.id },

select: { apiKey: true },

});

expect(persisted.apiKey).toBe(environment.apiKey);

});