improvement(secrets): parallelize save mutations and add admin visibility for workspace secrets by waleedlatif1 · Pull Request #4032 · simstudioai/sim

waleedlatif1 · 2026-04-08T00:50:06Z

Summary

Parallelize personal/workspace env save mutations with Promise.all instead of sequential awaits
Skip personal save entirely when only workspace vars changed
Remove pointless double transformation in useSavePersonalEnvironment
Narrow mutation invalidation scopes (each hook only invalidates its own query key, credential list invalidated once after all mutations via finally)
Workspace secrets now visible to admins on focus (matching personal secrets UX), non-admins still see dots

Type of Change

Bug fix
Enhancement

Testing

Tested manually

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

cursor · 2026-04-08T00:50:12Z

PR Summary

Medium Risk
Touches secrets UI and the save flow for personal/workspace environment variables; regressions could expose values to the wrong users or leave caches stale if invalidation timing is wrong.

Overview
Improves the secrets settings page by allowing workspace secret values to be revealed for workspace admins (masked by default and unmasked on focus), while non-admins continue to see masked dots.

Optimizes saving environment variables by skipping the personal save when unchanged, running personal/workspace mutations in parallel with Promise.allSettled, and consolidating credential-list cache invalidation to a single finally block after any save.

Simplifies useSavePersonalEnvironment to send variables directly and narrows environment query invalidation so each mutation only refreshes its own environment query key.

^{Reviewed by Cursor Bugbot for commit 1cb5810. Configure here.}

vercel · 2026-04-08T00:50:12Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 8, 2026 1:22am

gitguardian · 2026-04-08T00:50:13Z

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

apps/sim/app/workspace/[workspaceId]/settings/components/credentials/credentials-manager.tsx

greptile-apps · 2026-04-08T00:59:00Z

Greptile Summary

This PR makes two improvements to the credentials/environment settings feature: (1) parallelizes personal and workspace environment save mutations using Promise.allSettled, skips the personal save when nothing changed, narrows cache invalidation scopes so each mutation only invalidates its own query key, and removes a redundant double-transformation in useSavePersonalEnvironment; (2) extends workspace secrets to be visible to workspace admins on focus, matching the existing UX for personal secrets.

Confidence Score: 5/5

Safe to merge — changes are well-scoped improvements with no correctness issues.

Both features (parallelized save and admin secret visibility) are correctly implemented. The personalChanged diff logic is sound. Using Promise.allSettled + re-throw is the right pattern. Cache invalidation is narrowed correctly. No P0/P1 findings identified.

No files require special attention.

Vulnerabilities

No security concerns identified. Admin-only secret visibility is gated behind a server-sourced workspacePermissions check rather than a client-side flag, and non-admin users continue to receive only bullet characters for workspace secret values.

Important Files Changed

Filename	Overview
apps/sim/hooks/queries/environment.ts	Removes redundant double-transformation in useSavePersonalEnvironment and narrows cache invalidation scope in all three mutation hooks; changes are correct and improve clarity.
apps/sim/app/workspace/[workspaceId]/settings/components/credentials/credentials-manager.tsx	Adds parallelized save logic with personalChanged short-circuit, moves credential-list invalidation to finally block, and adds admin visibility for workspace secrets; no bugs found.

_{Reviews (4): Last reviewed commit: "fix(secrets): use Promise.allSettled to ..." | Re-trigger Greptile}

apps/sim/app/workspace/[workspaceId]/settings/components/credentials/credentials-manager.tsx

…lity for workspace secrets

…rite race

waleedlatif1 · 2026-04-08T01:06:17Z

@greptile

waleedlatif1 · 2026-04-08T01:06:22Z

@cursor review

apps/sim/app/workspace/[workspaceId]/settings/components/credentials/credentials-manager.tsx

…n after all mutations settle

waleedlatif1 · 2026-04-08T01:22:59Z

@greptile

waleedlatif1 · 2026-04-08T01:23:03Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1cb5810. Configure here.}

cursor bot reviewed Apr 8, 2026

View reviewed changes

apps/sim/app/workspace/[workspaceId]/settings/components/credentials/credentials-manager.tsx Outdated Show resolved Hide resolved

greptile-apps bot reviewed Apr 8, 2026

View reviewed changes

apps/sim/app/workspace/[workspaceId]/settings/components/credentials/credentials-manager.tsx Show resolved Hide resolved

apps/sim/app/workspace/[workspaceId]/settings/components/credentials/credentials-manager.tsx Outdated Show resolved Hide resolved

vercel bot temporarily deployed to Preview April 8, 2026 01:00 Inactive

waleedlatif1 added 2 commits April 7, 2026 18:05

improvement(secrets): parallelize save mutations and add admin visibi…

614d156

…lity for workspace secrets

fix(secrets): sequence workspace upsert/delete to avoid read-modify-w…

74e0509

…rite race

waleedlatif1 force-pushed the waleedlatif1/secrets-perf-visibility branch from 352c2a5 to 74e0509 Compare April 8, 2026 01:05

vercel bot temporarily deployed to Preview April 8, 2026 01:05 Inactive

cursor bot reviewed Apr 8, 2026

View reviewed changes

apps/sim/app/workspace/[workspaceId]/settings/components/credentials/credentials-manager.tsx Show resolved Hide resolved

fix(secrets): use Promise.allSettled to ensure credential invalidatio…

1cb5810

…n after all mutations settle

vercel bot temporarily deployed to Preview April 8, 2026 01:22 Inactive

cursor bot reviewed Apr 8, 2026

View reviewed changes

waleedlatif1 merged commit 98be968 into staging Apr 8, 2026
12 checks passed

waleedlatif1 deleted the waleedlatif1/secrets-perf-visibility branch April 8, 2026 01:30

waleedlatif1 mentioned this pull request Apr 8, 2026

v0.6.30: slack trigger enhancements, secrets performance, polling refactors, drag resources in mothership #4038

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

improvement(secrets): parallelize save mutations and add admin visibility for workspace secrets#4032

improvement(secrets): parallelize save mutations and add admin visibility for workspace secrets#4032
waleedlatif1 merged 3 commits intostagingfrom
waleedlatif1/secrets-perf-visibility

waleedlatif1 commented Apr 8, 2026

Uh oh!

cursor bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

vercel bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

gitguardian bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

greptile-apps bot commented Apr 8, 2026 •

edited

Loading

Vulnerabilities

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Apr 8, 2026

Uh oh!

waleedlatif1 commented Apr 8, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Apr 8, 2026

Uh oh!

waleedlatif1 commented Apr 8, 2026

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

waleedlatif1 commented Apr 8, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

cursor bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

vercel bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gitguardian bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

️✅ There are no secrets present in this pull request anymore.

Uh oh!

Uh oh!

greptile-apps bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Vulnerabilities

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Apr 8, 2026

Uh oh!

waleedlatif1 commented Apr 8, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Apr 8, 2026

Uh oh!

waleedlatif1 commented Apr 8, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cursor bot commented Apr 8, 2026 •

edited

Loading

vercel bot commented Apr 8, 2026 •

edited

Loading

gitguardian bot commented Apr 8, 2026 •

edited

Loading

greptile-apps bot commented Apr 8, 2026 •

edited

Loading