tenseleyflow/shithub / 59d5619

+## Secrets + variables settings surface (S41c)

+

+S41c wires the previously schema-only `workflow_secrets` and

+`actions_variables` tables into repo/org settings.

+

+Repository routes are gated through

+`policy.ActionRepoSettingsActions` (`repo:settings:actions`, admin

+role minimum):

+

+- `GET /{owner}/{repo}/settings/secrets/actions`

+- `POST /{owner}/{repo}/settings/secrets/actions`

+- `POST /{owner}/{repo}/settings/secrets/actions/{name}/delete`

+- `GET /{owner}/{repo}/settings/variables/actions`

+- `POST /{owner}/{repo}/settings/variables/actions`

+- `POST /{owner}/{repo}/settings/variables/actions/{name}/delete`

+

+Organization routes follow the existing org-settings prefix and are

+owner-only:

+

+- `GET /organizations/{org}/settings/secrets/actions`

+- `POST /organizations/{org}/settings/secrets/actions`

+- `POST /organizations/{org}/settings/secrets/actions/{name}/delete`

+- `GET /organizations/{org}/settings/variables/actions`

+- `POST /organizations/{org}/settings/variables/actions`

+- `POST /organizations/{org}/settings/variables/actions/{name}/delete`

+

+Secrets are sealed through `internal/auth/secretbox` using the

+operator-managed `Auth.TOTPKeyB64` root key. Secret list pages render

+names/metadata only; the plaintext value is accepted once on create or

+rotation and never rendered back. Variables are non-secret plaintext

+configuration, so settings pages render their values. Both stores use

+the same name grammar as the database constraints:

+`^[A-Za-z_][A-Za-z0-9_]*$`, 1-100 characters. Variables additionally

+enforce the 4096-character value cap in Go before hitting the DB

+constraint.

+

+| `repo:settings:actions`               | `admin`          |

+	// S41c — Actions secret/variable lifecycle. Metadata must include

+	// names only, never secret values.

+	ActionActionsSecretSet       Action = "actions_secret_set"

+	ActionActionsSecretDeleted   Action = "actions_secret_deleted"

+	ActionActionsVariableSet     Action = "actions_variable_set"

+	ActionActionsVariableDeleted Action = "actions_variable_deleted"

+

+	TargetOrg   Target = "org"

+	ActionRepoSettingsActions       Action = "repo:settings:actions"

+	ActionRepoSettingsGeneral, ActionRepoSettingsCollaborators, ActionRepoSettingsBranches, ActionRepoSettingsActions,

+	case ActionRepoAdmin, ActionRepoSettingsCollaborators, ActionRepoSettingsActions,

+	case policy.ActionRepoAdmin, policy.ActionRepoSettingsCollaborators, policy.ActionRepoSettingsActions,

+	// RepoSettingsActionsMounter registers Actions secrets + variables

+	// settings under /{owner}/{repo}/settings/* (S41c). Auth-required.

+	RepoSettingsActionsMounter func(chi.Router)

+		if deps.RepoSettingsActionsMounter != nil {

+			deps.RepoSettingsActionsMounter(r)

+		}

+	"html"

+	if !strings.Contains(html.UnescapeString(string(body)), "ERROR=Enter this organization's name to confirm deletion.") {

+//	GET  /{org}/people                                      members + pending invites + invite form

+//	POST /{org}/people/invite                               invite by username or email

+//	POST /{org}/people/{user}/role                          change role

+//	POST /{org}/people/{user}/remove                        remove member

+//	GET  /organizations/{org}/settings/profile              profile settings

+//	GET  /organizations/{org}/settings/{secrets,variables}/actions

+//	POST /organizations/{org}/settings/{secrets,variables}/actions

+//	GET  /invitations/{token}                               accept/decline view

+//	POST /invitations/{token}/accept                        accept

+//	POST /invitations/{token}/decline                       decline

+	"github.com/tenseleyFlow/shithub/internal/auth/audit"

+	"github.com/tenseleyFlow/shithub/internal/auth/secretbox"

+	SecretBox   *secretbox.Box

+	Audit       *audit.Recorder

+	if d.Audit == nil {

+		d.Audit = audit.NewRecorder()

+	}

+// MountCreate registers /organizations/new, POST /organizations, and

+// organization settings routes under /organizations/{org}/settings/*.

+// Caller wraps these in RequireUser since they require a logged-in

+// actor. The /organizations prefix is on the auth-reserved list so it

+// never shadows a user/org slug.

+	r.Get("/organizations/{org}/settings/secrets/actions", h.settingsActionsSecrets)

+	r.Post("/organizations/{org}/settings/secrets/actions", h.settingsActionsSecretSet)

+	r.Post("/organizations/{org}/settings/secrets/actions/{name}/delete", h.settingsActionsSecretDelete)

+	r.Get("/organizations/{org}/settings/variables/actions", h.settingsActionsVariables)

+	r.Post("/organizations/{org}/settings/variables/actions", h.settingsActionsVariableSet)

+	r.Post("/organizations/{org}/settings/variables/actions/{name}/delete", h.settingsActionsVariableDelete)

+// SPDX-License-Identifier: AGPL-3.0-or-later

+

+package orgs

+

+import (

+	"errors"

+	"net/http"

+	"strings"

+

+	"github.com/go-chi/chi/v5"

+

+	"github.com/tenseleyFlow/shithub/internal/actions/secrets"

+	actionsvars "github.com/tenseleyFlow/shithub/internal/actions/variables"

+	"github.com/tenseleyFlow/shithub/internal/auth/audit"

+	orgsdb "github.com/tenseleyFlow/shithub/internal/orgs/sqlc"

+	"github.com/tenseleyFlow/shithub/internal/web/middleware"

+)

+

+func (h *Handlers) settingsActionsSecrets(w http.ResponseWriter, r *http.Request) {

+	org, ok := h.loadOrgSettingsOwner(w, r)

+	if !ok {

+		return

+	}

+	h.renderOrgActionsSettings(w, r, org, "secrets", "", orgActionsNoticeMessage(r.URL.Query().Get("notice")))

+}

+

+func (h *Handlers) settingsActionsSecretSet(w http.ResponseWriter, r *http.Request) {

+	org, ok := h.loadOrgSettingsOwner(w, r)

+	if !ok {

+		return

+	}

+	if h.d.SecretBox == nil {

+		http.Error(w, "actions secret key not configured", http.StatusServiceUnavailable)

+		return

+	}

+	if err := r.ParseForm(); err != nil {

+		http.Error(w, "form parse", http.StatusBadRequest)

+		return

+	}

+	viewer := middleware.CurrentUserFromContext(r.Context())

+	name := strings.TrimSpace(r.PostFormValue("name"))

+	value := []byte(r.PostFormValue("value"))

+	err := secrets.Deps{Pool: h.d.Pool, Box: h.d.SecretBox}.Set(r.Context(), secrets.OrgScope(org.ID), name, value, viewer.ID)

+	if err != nil {

+		h.renderOrgActionsSettings(w, r, org, "secrets", friendlyOrgActionsSecretError(err), "")

+		return

+	}

+	h.recordOrgActionsAudit(r, viewer, audit.ActionActionsSecretSet, org.ID, name)

+	http.Redirect(w, r, orgActionsSettingsPath(org.Slug, "secrets")+"?notice=saved", http.StatusSeeOther)

+}

+

+func (h *Handlers) settingsActionsSecretDelete(w http.ResponseWriter, r *http.Request) {

+	org, ok := h.loadOrgSettingsOwner(w, r)

+	if !ok {

+		return

+	}

+	name := chi.URLParam(r, "name")

+	err := secrets.Deps{Pool: h.d.Pool, Box: h.d.SecretBox}.Delete(r.Context(), secrets.OrgScope(org.ID), name)

+	if err != nil {

+		if errors.Is(err, secrets.ErrInvalidName) {

+			http.Error(w, "bad secret name", http.StatusBadRequest)

+			return

+		}

+		http.Error(w, "delete failed", http.StatusInternalServerError)

+		return

+	}

+	viewer := middleware.CurrentUserFromContext(r.Context())

+	h.recordOrgActionsAudit(r, viewer, audit.ActionActionsSecretDeleted, org.ID, name)

+	http.Redirect(w, r, orgActionsSettingsPath(org.Slug, "secrets")+"?notice=deleted", http.StatusSeeOther)

+}

+

+func (h *Handlers) settingsActionsVariables(w http.ResponseWriter, r *http.Request) {

+	org, ok := h.loadOrgSettingsOwner(w, r)

+	if !ok {

+		return

+	}

+	h.renderOrgActionsSettings(w, r, org, "variables", "", orgActionsNoticeMessage(r.URL.Query().Get("notice")))

+}

+

+func (h *Handlers) settingsActionsVariableSet(w http.ResponseWriter, r *http.Request) {

+	org, ok := h.loadOrgSettingsOwner(w, r)

+	if !ok {

+		return

+	}

+	if err := r.ParseForm(); err != nil {

+		http.Error(w, "form parse", http.StatusBadRequest)

+		return

+	}

+	viewer := middleware.CurrentUserFromContext(r.Context())

+	name := strings.TrimSpace(r.PostFormValue("name"))

+	value := r.PostFormValue("value")

+	err := actionsvars.Deps{Pool: h.d.Pool}.Set(r.Context(), actionsvars.OrgScope(org.ID), name, value, viewer.ID)

+	if err != nil {

+		h.renderOrgActionsSettings(w, r, org, "variables", friendlyOrgActionsVariableError(err), "")

+		return

+	}

+	h.recordOrgActionsAudit(r, viewer, audit.ActionActionsVariableSet, org.ID, name)

+	http.Redirect(w, r, orgActionsSettingsPath(org.Slug, "variables")+"?notice=saved", http.StatusSeeOther)

+}

+

+func (h *Handlers) settingsActionsVariableDelete(w http.ResponseWriter, r *http.Request) {

+	org, ok := h.loadOrgSettingsOwner(w, r)

+	if !ok {

+		return

+	}

+	name := chi.URLParam(r, "name")

+	err := actionsvars.Deps{Pool: h.d.Pool}.Delete(r.Context(), actionsvars.OrgScope(org.ID), name)

+	if err != nil {

+		if errors.Is(err, actionsvars.ErrInvalidName) {

+			http.Error(w, "bad variable name", http.StatusBadRequest)

+			return

+		}

+		http.Error(w, "delete failed", http.StatusInternalServerError)

+		return

+	}

+	viewer := middleware.CurrentUserFromContext(r.Context())

+	h.recordOrgActionsAudit(r, viewer, audit.ActionActionsVariableDeleted, org.ID, name)

+	http.Redirect(w, r, orgActionsSettingsPath(org.Slug, "variables")+"?notice=deleted", http.StatusSeeOther)

+}

+

+func (h *Handlers) loadOrgSettingsOwner(w http.ResponseWriter, r *http.Request) (orgsdb.Org, bool) {

+	org, ok := h.orgFromSlug(w, r)

+	if !ok {

+		return orgsdb.Org{}, false

+	}

+	viewer := middleware.CurrentUserFromContext(r.Context())

+	if !h.requireOrgOwner(w, r, org.ID, viewer) {

+		return orgsdb.Org{}, false

+	}

+	return org, true

+}

+

+func (h *Handlers) renderOrgActionsSettings(w http.ResponseWriter, r *http.Request, org orgsdb.Org, kind, errMsg, notice string) {

+	data := map[string]any{

+		"CSRFToken":  middleware.CSRFTokenForRequest(r),

+		"Org":        org,

+		"Kind":       kind,

+		"Error":      errMsg,

+		"Notice":     notice,

+		"FormAction": orgActionsSettingsPath(org.Slug, kind),

+	}

+	switch kind {

+	case "secrets":

+		items, err := secrets.Deps{Pool: h.d.Pool, Box: h.d.SecretBox}.List(r.Context(), secrets.OrgScope(org.ID))

+		if err != nil {

+			h.d.Logger.WarnContext(r.Context(), "actions secrets: list org", "org_id", org.ID, "error", err)

+			items = nil

+		}

+		data["Title"] = org.Slug + " · Actions secrets"

+		data["Heading"] = "Actions secrets"

+		data["IsSecrets"] = true

+		data["Secrets"] = items

+		data["SecretDisabled"] = h.d.SecretBox == nil

+	case "variables":

+		items, err := actionsvars.Deps{Pool: h.d.Pool}.List(r.Context(), actionsvars.OrgScope(org.ID))

+		if err != nil {

+			h.d.Logger.WarnContext(r.Context(), "actions variables: list org", "org_id", org.ID, "error", err)

+			items = nil

+		}

+		data["Title"] = org.Slug + " · Actions variables"

+		data["Heading"] = "Actions variables"

+		data["Variables"] = items

+	}

+	h.d.Render.RenderPage(w, r, "orgs/settings_secrets", data)

+}

+

+func orgActionsSettingsPath(slug, kind string) string {

+	return "/organizations/" + slug + "/settings/" + kind + "/actions"

+}

+

+func friendlyOrgActionsSecretError(err error) string {

+	switch {

+	case errors.Is(err, secrets.ErrInvalidName):

+		return "Name must start with a letter or underscore and contain only letters, numbers, and underscores."

+	case errors.Is(err, secrets.ErrEmptyValue):

+		return "Secret value is required."

+	case errors.Is(err, secrets.ErrInvalidScope):

+		return "Invalid secret scope."

+	default:

+		return "Could not save secret."

+	}

+}

+

+func friendlyOrgActionsVariableError(err error) string {

+	switch {

+	case errors.Is(err, actionsvars.ErrInvalidName):

+		return "Name must start with a letter or underscore and contain only letters, numbers, and underscores."

+	case errors.Is(err, actionsvars.ErrValueTooLong):

+		return "Variable value must be 4096 characters or fewer."

+	case errors.Is(err, actionsvars.ErrInvalidScope):

+		return "Invalid variable scope."

+	default:

+		return "Could not save variable."

+	}

+}

+

+func orgActionsNoticeMessage(code string) string {

+	switch code {

+	case "saved":

+		return "Settings saved."

+	case "deleted":

+		return "Deleted."

+	default:

+		return ""

+	}

+}

+

+func (h *Handlers) recordOrgActionsAudit(r *http.Request, viewer middleware.CurrentUser, action audit.Action, orgID int64, name string) {

+	actor, meta := viewer.AuditActor(map[string]any{"name": name})

+	_ = h.d.Audit.Record(r.Context(), h.d.Pool, actor, action, audit.TargetOrg, orgID, meta)

+}

+// SPDX-License-Identifier: AGPL-3.0-or-later

+

+package orgs_test

+

+import (

+	"context"

+	"io"

+	"log/slog"

+	"net/http"

+	"net/http/httptest"

+	"net/url"

+	"strings"

+	"testing"

+	"testing/fstest"

+

+	"github.com/go-chi/chi/v5"

+	"github.com/jackc/pgx/v5/pgxpool"

+

+	"github.com/tenseleyFlow/shithub/internal/auth/secretbox"

+	"github.com/tenseleyFlow/shithub/internal/infra/storage"

+	"github.com/tenseleyFlow/shithub/internal/testing/dbtest"

+	orgsh "github.com/tenseleyFlow/shithub/internal/web/handlers/orgs"

+	"github.com/tenseleyFlow/shithub/internal/web/middleware"

+	"github.com/tenseleyFlow/shithub/internal/web/render"

+)

+

+func TestOrgActionsSettingsSecretAndVariableCRUD(t *testing.T) {

+	t.Parallel()

+	pool := dbtest.NewTestDB(t)

+	ownerID := insertOrgAvatarUser(t, pool, "owner")

+	orgID := insertOrgAvatarOrg(t, pool, ownerID, "acme")

+	h := newOrgActionsHandler(t, pool)

+	mux := chi.NewRouter()

+	mux.Use(func(next http.Handler) http.Handler {

+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

+			viewer := middleware.CurrentUser{ID: ownerID, Username: "owner"}

+			next.ServeHTTP(w, r.WithContext(middleware.WithCurrentUserForTest(r.Context(), viewer)))

+		})

+	})

+	h.MountCreate(mux)

+

+	resp := httptest.NewRecorder()

+	req := newOrgFormRequest(http.MethodPost, "/organizations/acme/settings/secrets/actions", url.Values{

+		"name":  {"ORG_TOKEN"},

+		"value": {"super-secret"},

+	})

+	mux.ServeHTTP(resp, req)

+	if resp.Code != http.StatusSeeOther {

+		t.Fatalf("POST org secret status=%d body=%s", resp.Code, resp.Body.String())

+	}

+	var ciphertext []byte

+	if err := pool.QueryRow(context.Background(),

+		`SELECT ciphertext FROM workflow_secrets WHERE org_id = $1 AND name = $2`,

+		orgID, "ORG_TOKEN").Scan(&ciphertext); err != nil {

+		t.Fatalf("query org secret: %v", err)

+	}

+	if strings.Contains(string(ciphertext), "super-secret") {

+		t.Fatal("plaintext appeared in org workflow_secrets.ciphertext")

+	}

+

+	resp = httptest.NewRecorder()

+	req = newOrgFormRequest(http.MethodPost, "/organizations/acme/settings/variables/actions", url.Values{

+		"name":  {"REGISTRY"},

+		"value": {"registry.internal"},

+	})

+	mux.ServeHTTP(resp, req)

+	if resp.Code != http.StatusSeeOther {

+		t.Fatalf("POST org variable status=%d body=%s", resp.Code, resp.Body.String())

+	}

+	resp = httptest.NewRecorder()

+	req = httptest.NewRequest(http.MethodGet, "/organizations/acme/settings/variables/actions", nil)

+	mux.ServeHTTP(resp, req)

+	if resp.Code != http.StatusOK {

+		t.Fatalf("GET org variable status=%d body=%s", resp.Code, resp.Body.String())

+	}

+	if got := resp.Body.String(); !strings.Contains(got, "VAR=REGISTRY:registry.internal;") {

+		t.Fatalf("org variable missing from list: %s", got)

+	}

+}

+

+func newOrgActionsHandler(t *testing.T, pool *pgxpool.Pool) *orgsh.Handlers {

+	t.Helper()

+	tmplFS := fstest.MapFS{

+		"_layout.html":               {Data: []byte(`{{ define "layout" }}{{ template "page" . }}{{ end }}`)},

+		"orgs/settings_profile.html": {Data: []byte(`{{ define "page" }}profile{{ end }}`)},

+		"orgs/settings_secrets.html": {Data: []byte(`{{ define "page" }}{{ with .Error }}ERROR={{ . }}{{ end }}{{ range .Secrets }}SECRET={{ .Name }};{{ end }}{{ range .Variables }}VAR={{ .Name }}:{{ .Value }};{{ end }}{{ end }}`)},

+		"errors/403.html":            {Data: []byte(`{{ define "page" }}403{{ end }}`)},

+		"errors/404.html":            {Data: []byte(`{{ define "page" }}404{{ end }}`)},

+		"errors/500.html":            {Data: []byte(`{{ define "page" }}500{{ end }}`)},

+	}

+	rr, err := render.New(tmplFS, render.Options{})

+	if err != nil {

+		t.Fatalf("render.New: %v", err)

+	}

+	key, err := secretbox.GenerateKey()

+	if err != nil {

+		t.Fatalf("GenerateKey: %v", err)

+	}

+	box, err := secretbox.FromBytes(key)

+	if err != nil {

+		t.Fatalf("FromBytes: %v", err)

+	}

+	h, err := orgsh.New(orgsh.Deps{

+		Logger:      slog.New(slog.NewTextHandler(io.Discard, nil)),

+		Render:      rr,

+		Pool:        pool,

+		ObjectStore: storage.NewMemoryStore(),

+		SecretBox:   box,

+	})

+	if err != nil {

+		t.Fatalf("orgsh.New: %v", err)

+	}

+	return h

+}

+

+func newOrgFormRequest(method, target string, form url.Values) *http.Request {

+	body := ""

+	if form != nil {

+		body = form.Encode()

+	}

+	req := httptest.NewRequest(method, target, strings.NewReader(body))

+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

+	return req

+}

+		"_layout.html":               {Data: layout},

+		"_repo_settings_nav.html":    {Data: []byte(`{{ define "repo-settings-nav" }}NAV{{ end }}`)},

+		"errors/403.html":            {Data: body},

+		"errors/404.html":            {Data: body},

+		"errors/429.html":            {Data: body},

+		"errors/500.html":            {Data: body},

+		"repo/new.html":              {Data: []byte(`{{ define "page" }}OWNERS={{ range .Owners }}{{ .Token }}:{{ if eq .Token $.Form.Owner }}selected{{ end }}:{{ .Slug }};{{ end }}{{ end }}`)},

+		"repo/settings_secrets.html": {Data: []byte(`{{ define "page" }}{{ with .Error }}ERROR={{ . }}{{ end }}{{ range .Secrets }}SECRET={{ .Name }};{{ end }}{{ range .Variables }}VAR={{ .Name }}:{{ .Value }};{{ end }}{{ end }}`)},

+// SPDX-License-Identifier: AGPL-3.0-or-later

+

+package repo

+

+import (

+	"errors"

+	"net/http"

+	"strings"

+

+	"github.com/go-chi/chi/v5"

+

+	"github.com/tenseleyFlow/shithub/internal/actions/secrets"

+	actionsvars "github.com/tenseleyFlow/shithub/internal/actions/variables"

+	"github.com/tenseleyFlow/shithub/internal/auth/audit"

+	"github.com/tenseleyFlow/shithub/internal/auth/policy"

+	reposdb "github.com/tenseleyFlow/shithub/internal/repos/sqlc"

+	"github.com/tenseleyFlow/shithub/internal/web/middleware"

+)

+

+// MountSettingsActions registers the Actions secrets + variables settings

+// routes. Caller wraps with RequireUser; per-route policy gates inside.

+func (h *Handlers) MountSettingsActions(r chi.Router) {

+	r.Get("/{owner}/{repo}/settings/secrets/actions", h.settingsActionsSecrets)

+	r.Post("/{owner}/{repo}/settings/secrets/actions", h.settingsActionsSecretSet)

+	r.Post("/{owner}/{repo}/settings/secrets/actions/{name}/delete", h.settingsActionsSecretDelete)

+	r.Get("/{owner}/{repo}/settings/variables/actions", h.settingsActionsVariables)

+	r.Post("/{owner}/{repo}/settings/variables/actions", h.settingsActionsVariableSet)

+	r.Post("/{owner}/{repo}/settings/variables/actions/{name}/delete", h.settingsActionsVariableDelete)

+}

+

+func (h *Handlers) settingsActionsSecrets(w http.ResponseWriter, r *http.Request) {

+	row, owner, ok := h.loadRepoAndAuthorize(w, r, policy.ActionRepoSettingsActions)

+	if !ok {

+		return

+	}

+	h.renderRepoActionsSettings(w, r, row, owner.Username, "secrets", "", settingsNoticeMessage(r.URL.Query().Get("notice")))

+}

+

+func (h *Handlers) settingsActionsSecretSet(w http.ResponseWriter, r *http.Request) {

+	row, owner, ok := h.loadRepoAndAuthorize(w, r, policy.ActionRepoSettingsActions)

+	if !ok {

+		return

+	}

+	if h.d.SecretBox == nil {

+		http.Error(w, "actions secret key not configured", http.StatusServiceUnavailable)

+		return

+	}

+	if err := r.ParseForm(); err != nil {

+		http.Error(w, "form parse", http.StatusBadRequest)

+		return

+	}

+	viewer := middleware.CurrentUserFromContext(r.Context())

+	name := strings.TrimSpace(r.PostFormValue("name"))

+	value := []byte(r.PostFormValue("value"))

+	err := secrets.Deps{Pool: h.d.Pool, Box: h.d.SecretBox}.Set(r.Context(), secrets.RepoScope(row.ID), name, value, viewer.ID)

+	if err != nil {

+		h.renderRepoActionsSettings(w, r, row, owner.Username, "secrets", friendlyActionsSecretError(err), "")

+		return

+	}

+	h.recordRepoActionsAudit(r, viewer, audit.ActionActionsSecretSet, row.ID, name)

+	http.Redirect(w, r, repoActionsSettingsPath(owner.Username, row.Name, "secrets")+"?notice=saved", http.StatusSeeOther)

+}

+

+func (h *Handlers) settingsActionsSecretDelete(w http.ResponseWriter, r *http.Request) {

+	row, owner, ok := h.loadRepoAndAuthorize(w, r, policy.ActionRepoSettingsActions)

+	if !ok {

+		return

+	}

+	name := chi.URLParam(r, "name")

+	err := secrets.Deps{Pool: h.d.Pool, Box: h.d.SecretBox}.Delete(r.Context(), secrets.RepoScope(row.ID), name)

+	if err != nil {

+		if errors.Is(err, secrets.ErrInvalidName) {

+			http.Error(w, "bad secret name", http.StatusBadRequest)

+			return

+		}

+		http.Error(w, "delete failed", http.StatusInternalServerError)

+		return

+	}

+	viewer := middleware.CurrentUserFromContext(r.Context())

+	h.recordRepoActionsAudit(r, viewer, audit.ActionActionsSecretDeleted, row.ID, name)

+	http.Redirect(w, r, repoActionsSettingsPath(owner.Username, row.Name, "secrets")+"?notice=deleted", http.StatusSeeOther)

+}

+

+func (h *Handlers) settingsActionsVariables(w http.ResponseWriter, r *http.Request) {

+	row, owner, ok := h.loadRepoAndAuthorize(w, r, policy.ActionRepoSettingsActions)

+	if !ok {

+		return

+	}

+	h.renderRepoActionsSettings(w, r, row, owner.Username, "variables", "", settingsNoticeMessage(r.URL.Query().Get("notice")))

+}

+

+func (h *Handlers) settingsActionsVariableSet(w http.ResponseWriter, r *http.Request) {

+	row, owner, ok := h.loadRepoAndAuthorize(w, r, policy.ActionRepoSettingsActions)

+	if !ok {

+		return

+	}

+	if err := r.ParseForm(); err != nil {

+		http.Error(w, "form parse", http.StatusBadRequest)

+		return

+	}

+	viewer := middleware.CurrentUserFromContext(r.Context())

+	name := strings.TrimSpace(r.PostFormValue("name"))

+	value := r.PostFormValue("value")

+	err := actionsvars.Deps{Pool: h.d.Pool}.Set(r.Context(), actionsvars.RepoScope(row.ID), name, value, viewer.ID)

+	if err != nil {

+		h.renderRepoActionsSettings(w, r, row, owner.Username, "variables", friendlyActionsVariableError(err), "")

+		return

+	}

+	h.recordRepoActionsAudit(r, viewer, audit.ActionActionsVariableSet, row.ID, name)

+	http.Redirect(w, r, repoActionsSettingsPath(owner.Username, row.Name, "variables")+"?notice=saved", http.StatusSeeOther)

+}

+

+func (h *Handlers) settingsActionsVariableDelete(w http.ResponseWriter, r *http.Request) {

+	row, owner, ok := h.loadRepoAndAuthorize(w, r, policy.ActionRepoSettingsActions)

+	if !ok {

+		return

+	}

+	name := chi.URLParam(r, "name")

+	err := actionsvars.Deps{Pool: h.d.Pool}.Delete(r.Context(), actionsvars.RepoScope(row.ID), name)

+	if err != nil {

+		if errors.Is(err, actionsvars.ErrInvalidName) {

+			http.Error(w, "bad variable name", http.StatusBadRequest)

+			return

+		}

+		http.Error(w, "delete failed", http.StatusInternalServerError)

+		return

+	}

+	viewer := middleware.CurrentUserFromContext(r.Context())

+	h.recordRepoActionsAudit(r, viewer, audit.ActionActionsVariableDeleted, row.ID, name)

+	http.Redirect(w, r, repoActionsSettingsPath(owner.Username, row.Name, "variables")+"?notice=deleted", http.StatusSeeOther)

+}

+

+func (h *Handlers) renderRepoActionsSettings(w http.ResponseWriter, r *http.Request, row reposdb.Repo, owner, kind, errMsg, notice string) {

+	data := map[string]any{

+		"CSRFToken": middleware.CSRFTokenForRequest(r),

+		"Owner":     owner,

+		"Repo":      row,

+		"Kind":      kind,

+		"Error":     errMsg,

+		"Notice":    notice,

+	}

+	switch kind {

+	case "secrets":

+		items, err := secrets.Deps{Pool: h.d.Pool, Box: h.d.SecretBox}.List(r.Context(), secrets.RepoScope(row.ID))

+		if err != nil {

+			h.d.Logger.WarnContext(r.Context(), "actions secrets: list repo", "repo_id", row.ID, "error", err)

+			items = nil

+		}

+		data["Title"] = "Actions secrets · " + row.Name

+		data["Heading"] = "Actions secrets"

+		data["IsSecrets"] = true

+		data["Secrets"] = items

+		data["SecretDisabled"] = h.d.SecretBox == nil

+		data["SettingsActive"] = "actions-secrets"

+		data["FormAction"] = repoActionsSettingsPath(owner, row.Name, "secrets")

+	case "variables":

+		items, err := actionsvars.Deps{Pool: h.d.Pool}.List(r.Context(), actionsvars.RepoScope(row.ID))

+		if err != nil {

+			h.d.Logger.WarnContext(r.Context(), "actions variables: list repo", "repo_id", row.ID, "error", err)

+			items = nil

+		}

+		data["Title"] = "Actions variables · " + row.Name

+		data["Heading"] = "Actions variables"

+		data["Variables"] = items

+		data["SettingsActive"] = "actions-variables"

+		data["FormAction"] = repoActionsSettingsPath(owner, row.Name, "variables")

+	}

+	h.d.Render.RenderPage(w, r, "repo/settings_secrets", data)

+}

+

+func repoActionsSettingsPath(owner, repoName, kind string) string {

+	return "/" + owner + "/" + repoName + "/settings/" + kind + "/actions"

+}

+

+func friendlyActionsSecretError(err error) string {

+	switch {

+	case errors.Is(err, secrets.ErrInvalidName):

+		return "Name must start with a letter or underscore and contain only letters, numbers, and underscores."

+	case errors.Is(err, secrets.ErrEmptyValue):

+		return "Secret value is required."

+	case errors.Is(err, secrets.ErrInvalidScope):

+		return "Invalid secret scope."

+	default:

+		return "Could not save secret."

+	}

+}

+

+func friendlyActionsVariableError(err error) string {

+	switch {

+	case errors.Is(err, actionsvars.ErrInvalidName):

+		return "Name must start with a letter or underscore and contain only letters, numbers, and underscores."

+	case errors.Is(err, actionsvars.ErrValueTooLong):

+		return "Variable value must be 4096 characters or fewer."

+	case errors.Is(err, actionsvars.ErrInvalidScope):

+		return "Invalid variable scope."

+	default:

+		return "Could not save variable."

+	}

+}

+

+func (h *Handlers) recordRepoActionsAudit(r *http.Request, viewer middleware.CurrentUser, action audit.Action, repoID int64, name string) {

+	actor, meta := viewer.AuditActor(map[string]any{"name": name})

+	_ = h.d.Audit.Record(r.Context(), h.d.Pool, actor, action, audit.TargetRepo, repoID, meta)

+}

+// SPDX-License-Identifier: AGPL-3.0-or-later

+

+package repo

+

+import (

+	"context"

+	"net/http"

+	"net/http/httptest"

+	"net/url"

+	"strings"

+	"testing"

+

+	"github.com/go-chi/chi/v5"

+

+	"github.com/tenseleyFlow/shithub/internal/auth/secretbox"

+	"github.com/tenseleyFlow/shithub/internal/web/middleware"

+)

+

+func TestSettingsActionsRepoSecretCRUDDoesNotRenderPlaintext(t *testing.T) {

+	t.Parallel()

+	f := newRepoFixture(t)

+	f.handlers.d.SecretBox = testSecretBox(t)

+	mux := f.actionsSettingsMux(f.owner.ID, f.owner.Username)

+

+	resp := httptest.NewRecorder()

+	req := newFormRequest(http.MethodPost, "/alice/public-repo/settings/secrets/actions", url.Values{

+		"name":  {"DEPLOY_KEY"},

+		"value": {"hunter2"},

+	})

+	mux.ServeHTTP(resp, req)

+	if resp.Code != http.StatusSeeOther {

+		t.Fatalf("POST secret status=%d body=%s", resp.Code, resp.Body.String())

+	}

+

+	var ciphertext []byte

+	if err := f.pool.QueryRow(context.Background(),

+		`SELECT ciphertext FROM workflow_secrets WHERE repo_id = $1 AND name = $2`,

+		f.publicRepo.ID, "DEPLOY_KEY").Scan(&ciphertext); err != nil {

+		t.Fatalf("query ciphertext: %v", err)

+	}

+	if strings.Contains(string(ciphertext), "hunter2") {

+		t.Fatal("plaintext appeared in workflow_secrets.ciphertext")

+	}

+

+	resp = httptest.NewRecorder()

+	req = httptest.NewRequest(http.MethodGet, "/alice/public-repo/settings/secrets/actions", nil)

+	mux.ServeHTTP(resp, req)

+	if resp.Code != http.StatusOK {

+		t.Fatalf("GET secret list status=%d body=%s", resp.Code, resp.Body.String())

+	}

+	body := resp.Body.String()

+	if !strings.Contains(body, "SECRET=DEPLOY_KEY;") {

+		t.Fatalf("secret name missing from list: %s", body)

+	}

+	if strings.Contains(body, "hunter2") {

+		t.Fatalf("secret plaintext leaked in list body: %s", body)

+	}

+

+	resp = httptest.NewRecorder()

+	req = newFormRequest(http.MethodPost, "/alice/public-repo/settings/secrets/actions/DEPLOY_KEY/delete", nil)

+	mux.ServeHTTP(resp, req)

+	if resp.Code != http.StatusSeeOther {

+		t.Fatalf("DELETE secret status=%d body=%s", resp.Code, resp.Body.String())

+	}

+	var count int

+	if err := f.pool.QueryRow(context.Background(),

+		`SELECT count(*) FROM workflow_secrets WHERE repo_id = $1 AND name = $2`,

+		f.publicRepo.ID, "DEPLOY_KEY").Scan(&count); err != nil {

+		t.Fatalf("count secrets: %v", err)

+	}

+	if count != 0 {

+		t.Fatalf("secret row count=%d, want 0", count)

+	}

+}

+

+func TestSettingsActionsRepoVariableCRUDRendersValue(t *testing.T) {

+	t.Parallel()

+	f := newRepoFixture(t)

+	mux := f.actionsSettingsMux(f.owner.ID, f.owner.Username)

+

+	resp := httptest.NewRecorder()

+	req := newFormRequest(http.MethodPost, "/alice/public-repo/settings/variables/actions", url.Values{

+		"name":  {"IMAGE_TAG"},

+		"value": {"2026.05"},

+	})

+	mux.ServeHTTP(resp, req)

+	if resp.Code != http.StatusSeeOther {

+		t.Fatalf("POST variable status=%d body=%s", resp.Code, resp.Body.String())

+	}

+

+	resp = httptest.NewRecorder()

+	req = httptest.NewRequest(http.MethodGet, "/alice/public-repo/settings/variables/actions", nil)

+	mux.ServeHTTP(resp, req)

+	if resp.Code != http.StatusOK {

+		t.Fatalf("GET variable list status=%d body=%s", resp.Code, resp.Body.String())

+	}

+	if got := resp.Body.String(); !strings.Contains(got, "VAR=IMAGE_TAG:2026.05;") {

+		t.Fatalf("variable missing from list: %s", got)

+	}

+

+	resp = httptest.NewRecorder()

+	req = newFormRequest(http.MethodPost, "/alice/public-repo/settings/variables/actions/IMAGE_TAG/delete", nil)

+	mux.ServeHTTP(resp, req)

+	if resp.Code != http.StatusSeeOther {

+		t.Fatalf("DELETE variable status=%d body=%s", resp.Code, resp.Body.String())

+	}

+	var count int

+	if err := f.pool.QueryRow(context.Background(),

+		`SELECT count(*) FROM actions_variables WHERE repo_id = $1 AND name = $2`,

+		f.publicRepo.ID, "IMAGE_TAG").Scan(&count); err != nil {

+		t.Fatalf("count variables: %v", err)

+	}

+	if count != 0 {

+		t.Fatalf("variable row count=%d, want 0", count)

+	}

+}

+

+func (f *repoFixture) actionsSettingsMux(userID int64, username string) http.Handler {

+	mux := chi.NewRouter()

+	mux.Use(func(next http.Handler) http.Handler {

+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

+			viewer := middleware.CurrentUser{ID: userID, Username: username}

+			next.ServeHTTP(w, r.WithContext(middleware.WithCurrentUserForTest(r.Context(), viewer)))

+		})

+	})

+	f.handlers.MountSettingsActions(mux)

+	return mux

+}

+

+func newFormRequest(method, target string, form url.Values) *http.Request {

+	body := ""

+	if form != nil {

+		body = form.Encode()

+	}

+	req := httptest.NewRequest(method, target, strings.NewReader(body))

+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

+	return req

+}

+

+func testSecretBox(t *testing.T) *secretbox.Box {

+	t.Helper()

+	key, err := secretbox.GenerateKey()

+	if err != nil {

+		t.Fatalf("GenerateKey: %v", err)

+	}

+	box, err := secretbox.FromBytes(key)

+	if err != nil {

+		t.Fatalf("FromBytes: %v", err)

+	}

+	return box

+}

+	case "deleted":

+		return "Deleted."

+	"github.com/tenseleyFlow/shithub/internal/auth/audit"

+	"github.com/tenseleyFlow/shithub/internal/auth/secretbox"

+	var box *secretbox.Box

+	if cfg.Auth.TOTPKeyB64 != "" {

+		if b, err := secretbox.FromBase64(cfg.Auth.TOTPKeyB64); err == nil {

+			box = b

+		} else if logger != nil {

+			logger.Warn("orgs: actions secretbox unavailable",

+				"hint", "set Auth.TOTPKeyB64 to a base64 32-byte key",

+				"error", err)

+		}

+	}

+		SecretBox:   box,

+		Audit:       audit.NewRecorder(),

+		deps.RepoSettingsActionsMounter = func(r chi.Router) {

+			r.Group(func(r chi.Router) {

+				r.Use(middleware.RequireUser)

+				repoH.MountSettingsActions(r)

+			})

+		}

+      <li{{ if eq .SettingsActive "actions-secrets" }} class="active"{{ end }}>

+        <a href="/{{ .Owner }}/{{ .Repo.Name }}/settings/secrets/actions">Actions secrets</a>

+      </li>

+      <li{{ if eq .SettingsActive "actions-variables" }} class="active"{{ end }}>

+        <a href="/{{ .Owner }}/{{ .Repo.Name }}/settings/variables/actions">Actions variables</a>

+      </li>

+{{ define "page" -}}

+<section class="shithub-org-settings">

+  <header class="shithub-org-profile-head">

+    <h1>{{ .Org.DisplayName }} · {{ .Heading }}</h1>

+    <p class="shithub-meta">@{{ .Org.Slug }}</p>

+    <nav class="shithub-subnav" aria-label="Organization Actions settings">

+      <a class="{{ if .IsSecrets }}active{{ end }}" href="/organizations/{{ .Org.Slug }}/settings/secrets/actions">Secrets</a>

+      <a class="{{ if not .IsSecrets }}active{{ end }}" href="/organizations/{{ .Org.Slug }}/settings/variables/actions">Variables</a>

+    </nav>

+  </header>

+

+  {{ with .Notice }}<p class="shithub-flash shithub-flash-notice" role="status">{{ . }}</p>{{ end }}

+  {{ with .Error }}<p class="shithub-flash shithub-flash-error" role="alert">{{ . }}</p>{{ end }}

+

+  <section class="shithub-settings-section">

+    <h2>{{ if .IsSecrets }}Organization secrets{{ else }}Organization variables{{ end }}</h2>

+    {{ if and .IsSecrets .SecretDisabled }}

+      <p>Actions secret writes require the at-rest secret key. Set Auth.TOTPKeyB64 in config and restart.</p>

+    {{ else }}

+      <form method="POST" action="{{ .FormAction }}" novalidate>

+        <input type="hidden" name="csrf_token" value="{{ .CSRFToken }}">

+        <label>

+          <span>Name</span>

+          <input type="text" name="name" maxlength="100" pattern="[A-Za-z_][A-Za-z0-9_]*" autocomplete="off" required>

+        </label>

+        <label>

+          <span>{{ if .IsSecrets }}Secret{{ else }}Value{{ end }}</span>

+          {{ if .IsSecrets }}

+            <input type="password" name="value" autocomplete="off" required>

+          {{ else }}

+            <textarea name="value" maxlength="4096" rows="3"></textarea>

+          {{ end }}

+        </label>

+        <button type="submit" class="shithub-button shithub-button-primary">Save {{ if .IsSecrets }}secret{{ else }}variable{{ end }}</button>

+      </form>

+    {{ end }}

+  </section>

+

+  <section class="shithub-settings-section">

+    <h2>Existing {{ if .IsSecrets }}secrets{{ else }}variables{{ end }}</h2>

+    {{ if .IsSecrets }}

+      {{ if .Secrets }}

+        <table class="shithub-branches-table">

+          <thead><tr><th>Name</th><th></th></tr></thead>

+          <tbody>

+            {{ range .Secrets }}

+            <tr>

+              <td><code>{{ .Name }}</code></td>

+              <td>

+                <form method="POST" action="/organizations/{{ $.Org.Slug }}/settings/secrets/actions/{{ .Name }}/delete" style="display:inline">

+                  <input type="hidden" name="csrf_token" value="{{ $.CSRFToken }}">

+                  <button type="submit" class="shithub-button shithub-button-danger">Delete</button>

+                </form>

+              </td>

+            </tr>

+            {{ end }}

+          </tbody>

+        </table>

+      {{ else }}

+        <p>No secrets have been added.</p>

+      {{ end }}

+    {{ else }}

+      {{ if .Variables }}

+        <table class="shithub-branches-table">

+          <thead><tr><th>Name</th><th>Value</th><th></th></tr></thead>

+          <tbody>

+            {{ range .Variables }}

+            <tr>

+              <td><code>{{ .Name }}</code></td>

+              <td><code>{{ .Value }}</code></td>

+              <td>

+                <form method="POST" action="/organizations/{{ $.Org.Slug }}/settings/variables/actions/{{ .Name }}/delete" style="display:inline">

+                  <input type="hidden" name="csrf_token" value="{{ $.CSRFToken }}">

+                  <button type="submit" class="shithub-button shithub-button-danger">Delete</button>

+                </form>

+              </td>

+            </tr>

+            {{ end }}

+          </tbody>

+        </table>

+      {{ else }}

+        <p>No variables have been added.</p>

+      {{ end }}

+    {{ end }}

+  </section>

+</section>

+{{- end }}

+{{ define "page" -}}

+<div class="shithub-settings-page">

+  {{ template "repo-settings-nav" . }}

+  <div class="shithub-settings-content">

+    <h1>{{ .Heading }}</h1>

+    {{ with .Notice }}<p class="shithub-flash shithub-flash-notice" role="status">{{ . }}</p>{{ end }}

+    {{ with .Error }}<p class="shithub-flash shithub-flash-error" role="alert">{{ . }}</p>{{ end }}

+

+    <section class="shithub-settings-section">

+      <h2>{{ if .IsSecrets }}Repository secrets{{ else }}Repository variables{{ end }}</h2>

+      {{ if and .IsSecrets .SecretDisabled }}

+        <p>Actions secret writes require the at-rest secret key. Set Auth.TOTPKeyB64 in config and restart.</p>

+      {{ else }}

+        <form method="POST" action="{{ .FormAction }}" novalidate>

+          <input type="hidden" name="csrf_token" value="{{ .CSRFToken }}">

+          <label>

+            <span>Name</span>

+            <input type="text" name="name" maxlength="100" pattern="[A-Za-z_][A-Za-z0-9_]*" autocomplete="off" required>

+          </label>

+          <label>

+            <span>{{ if .IsSecrets }}Secret{{ else }}Value{{ end }}</span>

+            {{ if .IsSecrets }}

+              <input type="password" name="value" autocomplete="off" required>

+            {{ else }}

+              <textarea name="value" maxlength="4096" rows="3"></textarea>

+            {{ end }}

+          </label>

+          <button type="submit" class="shithub-button shithub-button-primary">Save {{ if .IsSecrets }}secret{{ else }}variable{{ end }}</button>

+        </form>

+      {{ end }}

+    </section>

+

+    <section class="shithub-settings-section">