Repository navigation
Conversation
Co-Authored-By: Claude Code <noreply@anthropic.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Co-Authored-By: Claude Code <noreply@anthropic.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What / why
Precompute is the last v4 feature which throws without
FLAGS_SECRET. With this change, the precompute functions fall back to a key derived fromVERCEL_DEPLOYMENT_KEYwhen there is no secret.lib/precompute-secret.ts:deploymentPrecomputeSecret()derives 32 bytes with HKDF-SHA-256 (Web Crypto, so it works in the Edge runtime) and the infoflags:precompute:v1. The derived key is not the deployment key itself, so precompute does not share a key with other users ofVERCEL_DEPLOYMENT_KEY.secretargument, thenFLAGS_PRECOMPUTE_SECRET(new, the name whichstandarduses), thenFLAGS_SECRET, then the deployment key. With asecretargument or onlyFLAGS_SECRET, nothing changes.vercel buildwith--prebuilt).secretparameters in Next.js is nowundefinedand notprocess.env.FLAGS_SECRET. The functions read the variables themselves.serialize,deserialize,getPrecomputed,generatePermutations(and thusprecompute).precompute,generatePermutationsand the read of a precomputed flag, throughgetPrecomputeSecretinsveltekit/env.ts. The handle fills a missing secret withFLAGS_SECRET, so a secret equal toFLAGS_SECRETdoes not count as passed:FLAGS_PRECOMPUTE_SECRETwins over it, also when the app passesFLAGS_SECRETtocreateHandle.VERCEL_DEPLOYMENT_KEY, the functions throw the same errors as before.Why a key per deployment is enough
A code is created by the build (
generatePermutations) and by the middleware, and read by the pages of the same deployment. Vercel writesVERCEL_DEPLOYMENT_KEYwith one value to the build environment and to the runtime environment of a deployment (get-deployment-env-context.tsin vercel/api), so all three use the same key. HS256 is deterministic, so the build and the middleware create the same code for the same values. This is the same reasoning as the build secret ofwithFlagsonstandard.Before this can ship
VERCEL_DEPLOYMENT_KEYis behind the workflow feature flag in vercel/api today, and only set when the project exposes the system environment variables. Flags needs it for all projects, or its own variable. No change in vercel/api is part of this PR.vercel buildwith--prebuiltis not covered: the deployment does not exist at build time, so the build has no key and throws. Such projects must keepFLAGS_SECRET.next devandvite devhave no deployment key and still needFLAGS_SECRET.FLAGS_SECRET.Tests
packages/flags:pnpm test(19 files, 276 tests passed),pnpm type-check,pnpm checkandpnpm buildare ok.New tests: the derivation (stable, 32 bytes, different per deployment key, not the key itself), Next.js and SvelteKit without
FLAGS_SECRET(the build and the middleware create the same code, a page reads it, a code of another deployment is rejected, the order of the secrets, throws without any key).🤖 Generated with Claude Code