feat: monolithic env var editing (bulk save, no per-var CRUD)

Replace individual env var add/edit/delete with a single bulk save
endpoint. The UI now shows a textarea with KEY=VALUE lines. On save,
all existing env vars are deleted and the full submitted set is
inserted.

- Replace HandleEnvVarAdd, HandleEnvVarEdit, HandleEnvVarDelete with
  HandleEnvVarSave
- Collapse 3 routes into single POST /apps/{id}/env
- Template uses textarea instead of per-row edit/delete forms
- No individual env var IDs exposed in the UI
- Extract parseEnvPairs helper to keep cyclomatic complexity low
- Use strings.SplitSeq per modernize linter
- Update tests for new bulk save behavior

closes #156
closes #163

internal/handlers/app.go

@@ -903,51 +903,98 @@ func (h *Handlers) addKeyValueToApp(
 	http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
 }
 
-// HandleEnvVarAdd handles adding an environment variable.
+// HandleEnvVarSave handles bulk saving of all environment variables.
-func (h *Handlers) HandleEnvVarAdd() http.HandlerFunc {
+// It deletes all existing env vars for the app and inserts the full
+// submitted set (monolithic list approach).
+func (h *Handlers) HandleEnvVarSave() http.HandlerFunc {
 	return func(writer http.ResponseWriter, request *http.Request) {
-		h.addKeyValueToApp(
+		appID := chi.URLParam(request, "id")
+
+		application, findErr := models.FindApp(request.Context(), h.db, appID)
+		if findErr != nil || application == nil {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		parseErr := request.ParseForm()
+		if parseErr != nil {
+			http.Error(writer, "Bad Request", http.StatusBadRequest)
+
+			return
+		}
+
+		pairs := parseEnvPairs(request.FormValue("env_vars"))
+		ctx := request.Context()
+
+		// Delete all existing env vars for this app
+		deleteErr := models.DeleteEnvVarsByAppID(ctx, h.db, application.ID)
+		if deleteErr != nil {
+			h.log.Error("failed to delete env vars", "error", deleteErr)
+			http.Error(
 				writer,
-			request,
+				"Internal Server Error",
-			func(ctx context.Context, application *models.App, key, value string) error {
+				http.StatusInternalServerError,
+			)
+
+			return
+		}
+
+		// Insert the full new set
+		for _, p := range pairs {
 			envVar := models.NewEnvVar(h.db)
 			envVar.AppID = application.ID
-				envVar.Key = key
+			envVar.Key = p.key
-				envVar.Value = value
+			envVar.Value = p.value
 
-				return envVar.Save(ctx)
+			saveErr := envVar.Save(ctx)
-			},
+			if saveErr != nil {
+				h.log.Error(
+					"failed to save env var",
+					"key", p.key,
+					"error", saveErr,
+				)
+			}
+		}
+
+		http.Redirect(
+			writer,
+			request,
+			"/apps/"+appID+"?success=env-updated",
+			http.StatusSeeOther,
 		)
 	}
 }
 
-// HandleEnvVarDelete handles deleting an environment variable.
+// envPair holds a parsed key-value pair from the env vars textarea.
-func (h *Handlers) HandleEnvVarDelete() http.HandlerFunc {
+type envPair struct {
-	return func(writer http.ResponseWriter, request *http.Request) {
+	key   string
-		appID := chi.URLParam(request, "id")
+	value string
-		envVarIDStr := chi.URLParam(request, "varID")
+}
 
-		envVarID, parseErr := strconv.ParseInt(envVarIDStr, 10, 64)
+// parseEnvPairs parses KEY=VALUE lines from a textarea string.
-		if parseErr != nil {
+// Blank lines and lines starting with # are skipped.
-			http.NotFound(writer, request)
+func parseEnvPairs(text string) []envPair {
+	var pairs []envPair
 
-			return
+	for line := range strings.SplitSeq(text, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
 		}
 
-		envVar, findErr := models.FindEnvVar(request.Context(), h.db, envVarID)
+		key, value, ok := strings.Cut(line, "=")
-		if findErr != nil || envVar == nil || envVar.AppID != appID {
+		if !ok || strings.TrimSpace(key) == "" {
-			http.NotFound(writer, request)
+			continue
-
-			return
 		}
 
-		deleteErr := envVar.Delete(request.Context())
+		pairs = append(pairs, envPair{
-		if deleteErr != nil {
+			key:   strings.TrimSpace(key),
-			h.log.Error("failed to delete env var", "error", deleteErr)
+			value: value,
+		})
 	}
 
-		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+	return pairs
-	}
 }
 
 // HandleLabelAdd handles adding a label.
@@ -1205,59 +1252,6 @@ func ValidateVolumePath(p string) error {
 	return nil
 }
 
-// HandleEnvVarEdit handles editing an existing environment variable.
-func (h *Handlers) HandleEnvVarEdit() http.HandlerFunc {
-	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-		envVarIDStr := chi.URLParam(request, "varID")
-
-		envVarID, parseErr := strconv.ParseInt(envVarIDStr, 10, 64)
-		if parseErr != nil {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		envVar, findErr := models.FindEnvVar(request.Context(), h.db, envVarID)
-		if findErr != nil || envVar == nil || envVar.AppID != appID {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		formErr := request.ParseForm()
-		if formErr != nil {
-			http.Error(writer, "Bad Request", http.StatusBadRequest)
-
-			return
-		}
-
-		key := request.FormValue("key")
-		value := request.FormValue("value")
-
-		if key == "" || value == "" {
-			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
-
-			return
-		}
-
-		envVar.Key = key
-		envVar.Value = value
-
-		saveErr := envVar.Save(request.Context())
-		if saveErr != nil {
-			h.log.Error("failed to update env var", "error", saveErr)
-		}
-
-		http.Redirect(
-			writer,
-			request,
-			"/apps/"+appID+"?success=env-updated",
-			http.StatusSeeOther,
-		)
-	}
-}
-
 // HandleLabelEdit handles editing an existing label.
 func (h *Handlers) HandleLabelEdit() http.HandlerFunc {
 	return func(writer http.ResponseWriter, request *http.Request) {

internal/handlers/handlers_test.go

@@ -560,45 +560,89 @@ func testOwnershipVerification(t *testing.T, cfg ownedResourceTestConfig) {
 	cfg.verifyFn(t, testCtx, resourceID)
 }
 
-// TestDeleteEnvVarOwnershipVerification tests that deleting an env var
+// TestHandleEnvVarSaveBulk tests that HandleEnvVarSave replaces all env vars
-// via another app's URL path returns 404 (IDOR prevention).
+// for an app with the submitted set (monolithic delete-all + insert-all).
-func TestDeleteEnvVarOwnershipVerification(t *testing.T) { //nolint:dupl // intentionally similar IDOR test pattern
+func TestHandleEnvVarSaveBulk(t *testing.T) {
 	t.Parallel()
 
-	testOwnershipVerification(t, ownedResourceTestConfig{
+	testCtx := setupTestHandlers(t)
-		appPrefix1: "envvar-owner-app",
+	createdApp := createTestApp(t, testCtx, "envvar-bulk-app")
-		appPrefix2: "envvar-other-app",
-		createFn: func(t *testing.T, tc *testContext, ownerApp *models.App) int64 {
-			t.Helper()
 
-			envVar := models.NewEnvVar(tc.database)
+	// Create some pre-existing env vars
-			envVar.AppID = ownerApp.ID
+	for _, kv := range [][2]string{{"OLD_KEY", "old_value"}, {"REMOVE_ME", "gone"}} {
-			envVar.Key = "SECRET"
+		ev := models.NewEnvVar(testCtx.database)
-			envVar.Value = "hunter2"
+		ev.AppID = createdApp.ID
-			require.NoError(t, envVar.Save(context.Background()))
+		ev.Key = kv[0]
+		ev.Value = kv[1]
+		require.NoError(t, ev.Save(context.Background()))
+	}
 
-			return envVar.ID
+	// Submit a new set via textarea
-		},
+	form := url.Values{}
-		deletePath: func(appID string, resourceID int64) string {
+	form.Set("env_vars", "NEW_KEY=new_value\nANOTHER=42\n# comment line\n")
-			return "/apps/" + appID + "/env/" + strconv.FormatInt(resourceID, 10) + "/delete"
-		},
-		chiParams: func(appID string, resourceID int64) map[string]string {
-			return map[string]string{"id": appID, "varID": strconv.FormatInt(resourceID, 10)}
-		},
-		handler: func(h *handlers.Handlers) http.HandlerFunc { return h.HandleEnvVarDelete() },
-		verifyFn: func(t *testing.T, tc *testContext, resourceID int64) {
-			t.Helper()
 
-			found, findErr := models.FindEnvVar(context.Background(), tc.database, resourceID)
+	r := chi.NewRouter()
-			require.NoError(t, findErr)
+	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
-			assert.NotNil(t, found, "env var should still exist after IDOR attempt")
+
-		},
+	request := httptest.NewRequest(
-	})
+		http.MethodPost,
+		"/apps/"+createdApp.ID+"/env",
+		strings.NewReader(form.Encode()),
+	)
+	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	recorder := httptest.NewRecorder()
+	r.ServeHTTP(recorder, request)
+
+	assert.Equal(t, http.StatusSeeOther, recorder.Code)
+
+	// Verify old env vars are gone and new ones exist
+	envVars, err := models.FindEnvVarsByAppID(
+		context.Background(), testCtx.database, createdApp.ID,
+	)
+	require.NoError(t, err)
+	assert.Len(t, envVars, 2)
+
+	keys := make(map[string]string)
+	for _, ev := range envVars {
+		keys[ev.Key] = ev.Value
+	}
+
+	assert.Equal(t, "new_value", keys["NEW_KEY"])
+	assert.Equal(t, "42", keys["ANOTHER"])
+	assert.Empty(t, keys["OLD_KEY"], "old env vars should be deleted")
+	assert.Empty(t, keys["REMOVE_ME"], "old env vars should be deleted")
+}
+
+// TestHandleEnvVarSaveAppNotFound tests that HandleEnvVarSave returns 404
+// for a non-existent app.
+func TestHandleEnvVarSaveAppNotFound(t *testing.T) {
+	t.Parallel()
+
+	testCtx := setupTestHandlers(t)
+
+	form := url.Values{}
+	form.Set("env_vars", "KEY=value\n")
+
+	r := chi.NewRouter()
+	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
+
+	request := httptest.NewRequest(
+		http.MethodPost,
+		"/apps/nonexistent-id/env",
+		strings.NewReader(form.Encode()),
+	)
+	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	recorder := httptest.NewRecorder()
+	r.ServeHTTP(recorder, request)
+
+	assert.Equal(t, http.StatusNotFound, recorder.Code)
 }
 
 // TestDeleteLabelOwnershipVerification tests that deleting a label
 // via another app's URL path returns 404 (IDOR prevention).
-func TestDeleteLabelOwnershipVerification(t *testing.T) { //nolint:dupl // intentionally similar IDOR test pattern
+func TestDeleteLabelOwnershipVerification(t *testing.T) {
 	t.Parallel()
 
 	testOwnershipVerification(t, ownedResourceTestConfig{
@@ -714,41 +758,46 @@ func TestDeletePortOwnershipVerification(t *testing.T) {
 	assert.NotNil(t, found, "port should still exist after IDOR attempt")
 }
 
-// TestHandleEnvVarDeleteUsesCorrectRouteParam verifies that HandleEnvVarDelete
+// TestHandleEnvVarSaveEmptyClears verifies that submitting an empty textarea
-// reads the "varID" chi URL parameter (matching the route definition {varID}),
+// deletes all existing env vars for the app.
-// not a mismatched name like "envID".
+func TestHandleEnvVarSaveEmptyClears(t *testing.T) {
-func TestHandleEnvVarDeleteUsesCorrectRouteParam(t *testing.T) {
 	t.Parallel()
 
 	testCtx := setupTestHandlers(t)
+	createdApp := createTestApp(t, testCtx, "envvar-clear-app")
 
-	createdApp := createTestApp(t, testCtx, "envdelete-param-app")
+	// Create a pre-existing env var
+	ev := models.NewEnvVar(testCtx.database)
+	ev.AppID = createdApp.ID
+	ev.Key = "DELETE_ME"
+	ev.Value = "gone"
+	require.NoError(t, ev.Save(context.Background()))
 
-	envVar := models.NewEnvVar(testCtx.database)
+	// Submit empty textarea
-	envVar.AppID = createdApp.ID
+	form := url.Values{}
-	envVar.Key = "DELETE_ME"
+	form.Set("env_vars", "")
-	envVar.Value = "gone"
-	require.NoError(t, envVar.Save(context.Background()))
 
-	// Use chi router with the real route pattern to test param name
 	r := chi.NewRouter()
-	r.Post("/apps/{id}/env/{varID}/delete", testCtx.handlers.HandleEnvVarDelete())
+	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
 
 	request := httptest.NewRequest(
 		http.MethodPost,
-		"/apps/"+createdApp.ID+"/env/"+strconv.FormatInt(envVar.ID, 10)+"/delete",
+		"/apps/"+createdApp.ID+"/env",
-		nil,
+		strings.NewReader(form.Encode()),
 	)
-	recorder := httptest.NewRecorder()
+	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 
+	recorder := httptest.NewRecorder()
 	r.ServeHTTP(recorder, request)
 
 	assert.Equal(t, http.StatusSeeOther, recorder.Code)
 
-	// Verify the env var was actually deleted
+	// Verify all env vars are gone
-	found, findErr := models.FindEnvVar(context.Background(), testCtx.database, envVar.ID)
+	envVars, err := models.FindEnvVarsByAppID(
-	require.NoError(t, findErr)
+		context.Background(), testCtx.database, createdApp.ID,
-	assert.Nil(t, found, "env var should be deleted when using correct route param")
+	)
+	require.NoError(t, err)
+	assert.Empty(t, envVars, "all env vars should be deleted")
 }
 
 // TestHandleVolumeAddValidatesPaths verifies that HandleVolumeAdd validates

internal/server/routes.go

@@ -82,10 +82,8 @@ func (s *Server) SetupRoutes() {
 			r.Post("/apps/{id}/stop", s.handlers.HandleAppStop())
 			r.Post("/apps/{id}/start", s.handlers.HandleAppStart())
 
-			// Environment variables
+			// Environment variables (monolithic bulk save)
-			r.Post("/apps/{id}/env", s.handlers.HandleEnvVarAdd())
+			r.Post("/apps/{id}/env", s.handlers.HandleEnvVarSave())
-			r.Post("/apps/{id}/env/{varID}/edit", s.handlers.HandleEnvVarEdit())
-			r.Post("/apps/{id}/env/{varID}/delete", s.handlers.HandleEnvVarDelete())
 
 			// Labels
 			r.Post("/apps/{id}/labels", s.handlers.HandleLabelAdd())

templates/app_detail.html

@@ -103,57 +103,14 @@
     <!-- Environment Variables -->
     <div class="card p-6 mb-6">
         <h2 class="section-title mb-4">Environment Variables</h2>
-        {{if .EnvVars}}
+        <form method="POST" action="/apps/{{.App.ID}}/env">
-        <div class="overflow-x-auto mb-4">
-            <table class="table">
-                <thead class="table-header">
-                    <tr>
-                        <th>Key</th>
-                        <th>Value</th>
-                        <th class="text-right">Actions</th>
-                    </tr>
-                </thead>
-                <tbody class="table-body">
-                    {{range .EnvVars}}
-                    <tr x-data="{ editing: false }">
-                        <template x-if="!editing">
-                            <td class="font-mono font-medium">{{.Key}}</td>
-                        </template>
-                        <template x-if="!editing">
-                            <td class="font-mono text-gray-500">{{.Value}}</td>
-                        </template>
-                        <template x-if="!editing">
-                            <td class="text-right">
-                                <button @click="editing = true" class="text-primary-600 hover:text-primary-800 text-sm mr-2">Edit</button>
-                                <form method="POST" action="/apps/{{$.App.ID}}/env/{{.ID}}/delete" class="inline" x-data="confirmAction('Delete this environment variable?')" @submit="confirm($event)">
-                                    {{ $.CSRFField }}
-                                    <button type="submit" class="text-error-500 hover:text-error-700 text-sm">Delete</button>
-                                </form>
-                            </td>
-                        </template>
-                        <template x-if="editing">
-                            <td colspan="3">
-                                <form method="POST" action="/apps/{{$.App.ID}}/env/{{.ID}}/edit" class="flex gap-2 items-center">
-                                    {{ $.CSRFField }}
-                                    <input type="text" name="key" value="{{.Key}}" required class="input flex-1 font-mono text-sm">
-                                    <input type="text" name="value" value="{{.Value}}" required class="input flex-1 font-mono text-sm">
-                                    <button type="submit" class="btn-primary text-sm">Save</button>
-                                    <button type="button" @click="editing = false" class="text-gray-500 hover:text-gray-700 text-sm">Cancel</button>
-                                </form>
-                                <p class="text-xs text-amber-600 mt-1">⚠ Container restart needed after env var changes.</p>
-                            </td>
-                        </template>
-                    </tr>
-                    {{end}}
-                </tbody>
-            </table>
-        </div>
-        {{end}}
-        <form method="POST" action="/apps/{{.App.ID}}/env" class="flex flex-col sm:flex-row gap-2">
             {{ .CSRFField }}
-            <input type="text" name="key" placeholder="KEY" required class="input flex-1 font-mono text-sm">
+            <p class="text-sm text-gray-500 mb-2">One <code>KEY=value</code> per line. Lines starting with <code>#</code> are ignored.</p>
-            <input type="text" name="value" placeholder="value" required class="input flex-1 font-mono text-sm">
+            <textarea name="env_vars" rows="8" class="input font-mono text-sm w-full mb-2" placeholder="DATABASE_URL=postgres://localhost/mydb&#10;SECRET_KEY=changeme">{{range .EnvVars}}{{.Key}}={{.Value}}&#10;{{end}}</textarea>
-            <button type="submit" class="btn-primary">Add</button>
+            <div class="flex items-center gap-3">
+                <button type="submit" class="btn-primary">Save Environment Variables</button>
+                <p class="text-xs text-amber-600">⚠ Container restart needed after env var changes.</p>
+            </div>
         </form>
     </div>