fix(secrets): reveal legacy values safely

Author: icecrasher321

apps/sim/app/workspace/[workspaceId]/settings/components/secrets/components/secrets-manager/secrets-manager.tsx

@@ -1038,7 +1038,8 @@ export function SecretsManager() {
                   ).map(([key, value]) => {
                     const cred = workspaceEnvKeyToCredential.get(key)
                     const canEditRow = canCreateWorkspaceSecret && cred?.role === 'admin'
-                    const canRevealRow = cred?.role === 'admin' || Boolean(cred?.unredacted)
+                    const canRevealRow =
+                      isWorkspaceAdmin || cred?.role === 'admin' || Boolean(cred?.unredacted)
                     return (
                       <WorkspaceVariableRow
                         key={key}

apps/sim/hooks/queries/workspace.test.tsx

@@ -17,7 +17,11 @@ vi.mock('@/lib/api/client/request', () => ({
 
 import { ApiClientError } from '@/lib/api/client/errors'
 import { createPinnedItemContract, deletePinnedItemContract } from '@/lib/api/contracts'
-import { useToggleWorkspacePin, workspaceKeys } from '@/hooks/queries/workspace'
+import {
+  useToggleWorkspacePin,
+  useWorkspacePermissionsQuery,
+  workspaceKeys,
+} from '@/hooks/queries/workspace'
 
 /** Trees rendered by a test, torn down in afterEach so observers do not leak across tests. */
 const mountedRoots: Root[] = []
@@ -92,6 +96,46 @@ beforeEach(() => {
   vi.clearAllMocks()
 })
 
+describe('useWorkspacePermissionsQuery', () => {
+  it('does not retain admin access while a different workspace loads', () => {
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } })
+    const container = document.createElement('div')
+    const root = createRoot(container)
+    mountedRoots.push(root)
+
+    queryClient.setQueryData(workspaceKeys.permissions('ws-a'), {
+      users: [],
+      total: 0,
+      viewer: { userId: 'user-1', isAdmin: true, permissionType: 'admin' },
+    })
+    mockRequestJson.mockReturnValueOnce(new Promise<never>(() => {}))
+
+    function Probe({ workspaceId }: { workspaceId: string }) {
+      const { data } = useWorkspacePermissionsQuery(workspaceId)
+      return <span>{data ? (data.viewer?.isAdmin ? 'admin' : 'member') : 'loading'}</span>
+    }
+
+    act(() => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <Probe workspaceId='ws-a' />
+        </QueryClientProvider>
+      )
+    })
+    expect(container.textContent).toBe('admin')
+
+    act(() => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <Probe workspaceId='ws-b' />
+        </QueryClientProvider>
+      )
+    })
+
+    expect(container.textContent).toBe('loading')
+  })
+})
+
 describe('useToggleWorkspacePin', () => {
   it('pins by creating a row addressed to the workspace itself', async () => {
     mockRequestJson.mockResolvedValue({ pinnedItem: {} })

apps/sim/hooks/queries/workspace.ts

@@ -336,7 +336,6 @@ export function useWorkspacePermissionsQuery(workspaceId: string | null | undefi
     queryFn: ({ signal }) => fetchWorkspacePermissions(workspaceId as string, signal),
     enabled: Boolean(workspaceId),
     staleTime: WORKSPACE_PERMISSIONS_STALE_TIME,
-    placeholderData: keepPreviousData,
   })
 }