fix: Decrypt encrypted front component variables by remihuigen · Pull Request #23494 · twentyhq/twenty

remihuigen · 2026-07-29T11:39:37Z

Summary

Fixes front-component application variables returning their encrypted at-rest value instead of their configured plaintext value.

Non-secret application variables (isSecret: false) are now decrypted server-side before being injected into the front-component environment. Secret variables remain excluded and are never decrypted or exposed to the browser.

Root cause

The front-component resolver filtered secret application variables correctly, but forwarded the cached encryptedValue directly. As a result, getApplicationVariable() returned an enc:v2:... envelope rather than the configured value.

Changes

Decrypt recognized versioned envelopes for non-secret application variables.
Preserve empty and legacy/plain values unchanged for backwards compatibility.
Add SecretEncryptionModule to the front-component module.
Add coverage for:
- decrypting public variables;
- retaining plaintext compatibility;
- excluding secret variables without attempting decryption.

twenty-ci-bot-public · 2026-07-29T11:40:02Z

👋 Thanks for contributing to Twenty! We're excited to have you on board.

Your PR has been set to draft while you work on it. Once you're done, mark it as Ready for review and our automated checks will run.

By submitting your Pull Request, you acknowledge that you agree with the terms of our Contributor License Agreement.

greptile-apps · 2026-07-29T11:42:11Z

Greptile Summary

Fixes front-component application-variable injection by:

Centralizing cached variable lookup and decryption in ApplicationVariableEntityService.
Exposing only decrypted non-secret variables to front components.
Reusing the centralized environment builder for logic-function execution.
Adding unit and integration coverage for decryption and secret exclusion.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
packages/twenty-server/src/engine/core-modules/application/application-variable/application-variable.service.ts	Adds centralized cached lookup and environment-record construction for decrypted application variables.
packages/twenty-server/src/engine/metadata-modules/front-component/front-component.resolver.ts	Replaces direct cached-value forwarding with the non-secret decrypted environment builder.
packages/twenty-server/src/engine/core-modules/application/application-variable/tests/application-variable.service.spec.ts	Consolidates variable decryption tests and now verifies exactly one decryption call for the non-secret path.
packages/twenty-server/src/engine/core-modules/logic-function/logic-function-executor/logic-function-executor.service.ts	Delegates logic-function application-variable environment construction to the centralized service.
packages/twenty-server/test/integration/metadata/suites/front-component/successful-front-component-application-variables.integration-spec.ts	Adds end-to-end coverage that public variables are encrypted at rest, decrypted for front components, and secret variables remain excluded.

_{Reviews (3): Last reviewed commit: "test(server): integ test front comp appl..." | Re-trigger Greptile}

Copilot

Pull request overview

This PR fixes front-component application variables (isSecret: false) being injected into the front-component runtime as their encrypted at-rest envelope (enc:v2:...) instead of plaintext, by decrypting eligible values server-side while continuing to omit secret variables.

Changes:

Pass SecretEncryptionService into the front-component variable sanitization utility and decrypt non-secret encrypted values before serialization.
Wire SecretEncryptionModule into the front-component Nest module so the resolver can inject the encryption service.
Extend unit tests to cover decryption behavior and ensure secret variables are excluded without attempting decryption.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
packages/twenty-server/src/engine/metadata-modules/front-component/utils/strip-secret-from-application-variables.ts	Adds server-side decryption for non-secret application variable values before injecting them into front-component env.
packages/twenty-server/src/engine/metadata-modules/front-component/utils/tests/strip-secret-from-application-variables.spec.ts	Updates and adds tests covering decryption and secret-variable exclusion behavior.
packages/twenty-server/src/engine/metadata-modules/front-component/front-component.resolver.ts	Injects `SecretEncryptionService` and supplies it to the stripping/decryption utility.
packages/twenty-server/src/engine/metadata-modules/front-component/front-component.module.ts	Imports `SecretEncryptionModule` to make encryption services available in the front-component module.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+  it('should decrypt non-secret encrypted variables', () => {
+    const encryptedValue = 'enc:v2:key-id:payload' as EncryptedString;
+
+    decryptVersionedOrThrow.mockReturnValue('pk.mapbox-token');
+
+    expect(
+      stripSecretFromApplicationVariables(
+        [
+          makeFlatVariable({
+            key: 'MAPBOX_PUBLIC_ACCESS_TOKEN',
+            value: encryptedValue,
+          }),
+        ],
+        secretEncryptionService,
+      ),
+    ).toEqual({ MAPBOX_PUBLIC_ACCESS_TOKEN: 'pk.mapbox-token' });
+    expect(decryptVersionedOrThrow).toHaveBeenCalledWith(encryptedValue, {
+      workspaceId: '00000000-0000-0000-0000-000000000000',
+    });
  });
 });


+        isNonEmptyString(value) && isEncryptedString(value)
+          ? secretEncryptionService.decryptVersionedOrThrow(value, {
+              workspaceId: flatApplicationVariable.workspaceId,
+            })
+          : value;


martmull · 2026-07-30T12:19:30Z

We don't expose secret variables in front components for security reasons, you can access them via logic-functions

https://docs.twenty.com/developers/extend/apps/layout/front-components#application-variables

github-actions · 2026-07-30T15:14:03Z

	Fails
🚫	`node` failed.

Log

Details

�[31mError: �[39m SyntaxError: Unexpected token '<', "<!DOCTYPE "... is not valid JSON
    at JSON.parse (<anonymous>)
�[90m    at parseJSONFromBytes (node:internal/deps/undici/undici:4387:19)�[39m
�[90m    at successSteps (node:internal/deps/undici/undici:7041:27)�[39m
�[90m    at readAllBytes (node:internal/deps/undici/undici:5958:13)�[39m
�[90m    at process.processTicksAndRejections (node:internal/process/task_queues:104:5)�[39m
danger-results://tmp/danger-results-0f65ddb3.json

Generated by 🚫 dangerJS against fab152f

prastoin

Hey there thanks for reporting, double checking

Copilot

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

prastoin

Thanks a lot for reporting this, that's unfortunate
Refactored few things
Will be released tomorrow along 2.26 ( twenty engine )

prastoin · 2026-07-30T15:57:19Z

@greptileai review

twenty-ci-bot-public · 2026-07-30T15:58:02Z

🔍 Automated Pre-Review

✅ No issues detected - This PR is ready for human review.

🧭 External PR Triage Review

✅ Looks good — a maintainer can pick this up.

Checks

⏳ CI: pending
🔗 Linked issue: Fixes #23492

Detailed findings (duplicate candidates, standards notes, summary) are in the workflow run logs.

View details

Automated pre-review — human approval still required.

remihuigen · 2026-07-30T16:06:06Z

@prastoin thanks! (I tried to keep the surface of my PR minimal because I'm not too familiar with the code and its conventions.) The refactor looks good.

It's kind of baffling that no one—neither users nor maintainers—noticed this feature shipped in a broken state back in v2.10.

Anyway, glad it's included in tomorrow's release.

prastoin · 2026-07-30T16:18:18Z

@remihuigen no worries ! reporting is way more than enough

It's kind of baffling that no one—neither users nor maintainers—noticed this feature shipped in a broken state back in v2.10.

You took the words right out of my mouth
Might be a regression introduced more recently following the database encryption consistency refactor

Weiko

I'd rename the "dangerous" one buildEnvRecordIncludingSecrets or something like that now that you have buildEnvRecord / buildNonSecretEnvRecord? (you can probably find a better name)

Copilot

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

Copilot

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

Decrypt encrypted front component variables

44e8c03

Copilot AI review requested due to automatic review settings July 29, 2026 11:39

twenty-eng-sync Bot added the -PR: draft label Jul 29, 2026

Copilot started reviewing on behalf of remihuigen July 29, 2026 11:40 View session

greptile-apps Bot reviewed Jul 29, 2026

View reviewed changes

Comment thread ...data-modules/front-component/utils/__tests__/strip-secret-from-application-variables.spec.ts Outdated

Copilot AI reviewed Jul 29, 2026

View reviewed changes

martmull closed this Jul 30, 2026

remihuigen mentioned this pull request Jul 30, 2026

getApplicationVariable() returns encrypted values in front components #23492

Closed

martmull reopened this Jul 30, 2026

prastoin self-requested a review July 30, 2026 15:12

prastoin reviewed Jul 30, 2026

View reviewed changes

prastoin added 2 commits July 30, 2026 17:52

refactor(server): centralize in applicationVariableService

8cf606e

test(server): integ test front comp applicable variables

196df43

Copilot AI review requested due to automatic review settings July 30, 2026 15:53

Copilot AI reviewed Jul 30, 2026

prastoin approved these changes Jul 30, 2026

View reviewed changes

prastoin added -PR: awaiting review and removed -PR: draft labels Jul 30, 2026

prastoin requested a review from Weiko July 30, 2026 15:56

twenty-eng-sync Bot added the -PR: awaiting author label Jul 30, 2026

twenty-eng-sync Bot removed the -PR: awaiting review label Jul 30, 2026

twenty-ci-bot-public Bot added the external-needs-triage label Jul 30, 2026

Weiko reviewed Jul 30, 2026

View reviewed changes

Comment thread ...ngine/core-modules/logic-function/logic-function-executor/logic-function-executor.service.ts Outdated

optional flat app vars maps args

3b0a09c

Weiko approved these changes Jul 30, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 30, 2026 16:34

Copilot AI reviewed Jul 30, 2026

naming

fab152f

Copilot AI review requested due to automatic review settings July 30, 2026 16:37

Copilot AI reviewed Jul 30, 2026

prastoin enabled auto-merge July 30, 2026 16:39

twenty-ci-bot-public Bot added external-ready-to-be-reviewed and removed external-needs-triage labels Jul 30, 2026

prastoin added this pull request to the merge queue Jul 30, 2026

Merged via the queue into twentyhq:main with commit 830404b Jul 30, 2026
122 checks passed

Uh oh!

Conversation

remihuigen commented Jul 29, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root cause

Changes

Uh oh!

twenty-ci-bot-public Bot commented Jul 29, 2026

Uh oh!

Uh oh!

greptile-apps Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

martmull commented Jul 30, 2026

Uh oh!

github-actions Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Log

Uh oh!

prastoin left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

prastoin left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

prastoin commented Jul 30, 2026

Uh oh!

twenty-ci-bot-public Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Automated Pre-Review

🧭 External PR Triage Review

Checks

Uh oh!

remihuigen commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

prastoin commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Weiko left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

remihuigen commented Jul 29, 2026 •

edited by cubic-dev-ai Bot

Loading

greptile-apps Bot commented Jul 29, 2026 •

edited

Loading

github-actions Bot commented Jul 30, 2026 •

edited

Loading

prastoin left a comment •

edited

Loading

twenty-ci-bot-public Bot commented Jul 30, 2026 •

edited

Loading

remihuigen commented Jul 30, 2026 •

edited

Loading

prastoin commented Jul 30, 2026 •

edited

Loading