BUG: HandleEnvVarDelete uses wrong route parameter name — env var deletion always 404s #104

New Issue

clawbot · 2026-02-20T12:27:58+01:00

clawbot commented

2026-02-20 12:27:58 +01:00

Severity: CRITICAL

File & Line

internal/handlers/app.go:919

Description

HandleEnvVarDelete reads chi.URLParam(request, "envID") but the route in routes.go:87 defines the parameter as {varID}:

// routes.go:87
r.Post("/apps/{id}/env-vars/{varID}/delete", s.handlers.HandleEnvVarDelete())

// app.go:919 — reads wrong param name
envVarIDStr := chi.URLParam(request, "envID")

Since "envID" is never set by the router, envVarIDStr is always empty, ParseInt fails, and the handler always returns 404. Environment variable deletion via the UI is completely broken.

Impact

Users cannot delete environment variables from apps. This is a core CRUD operation.

Suggested Fix

Change line 919 in app.go from:

envVarIDStr := chi.URLParam(request, "envID")

to:

envVarIDStr := chi.URLParam(request, "varID")

## Severity: CRITICAL ## File & Line `internal/handlers/app.go:919` ## Description `HandleEnvVarDelete` reads `chi.URLParam(request, "envID")` but the route in `routes.go:87` defines the parameter as `{varID}`: ```go // routes.go:87 r.Post("/apps/{id}/env-vars/{varID}/delete", s.handlers.HandleEnvVarDelete()) // app.go:919 — reads wrong param name envVarIDStr := chi.URLParam(request, "envID") ``` Since `"envID"` is never set by the router, `envVarIDStr` is always empty, `ParseInt` fails, and the handler **always returns 404**. Environment variable deletion via the UI is completely broken. ## Impact Users cannot delete environment variables from apps. This is a core CRUD operation. ## Suggested Fix Change line 919 in `app.go` from: ```go envVarIDStr := chi.URLParam(request, "envID") ``` to: ```go envVarIDStr := chi.URLParam(request, "varID") ```

clawbot added this to the 1.0 milestone 2026-02-20 12:27:58 +01:00

clawbot added the

bug

label 2026-02-20 12:27:58 +01:00

clawbot self-assigned this 2026-02-20 12:27:58 +01:00

clawbot referenced this issue from a commit

2026-02-20 12:35:50 +01:00

fix: HandleEnvVarDelete uses correct varID route param (closes #104)

clawbot referenced a pull request that will close this issue

2026-02-20 12:36:00 +01:00

fix: resolve 1.0 audit bugs (closes #104, #105, #106, #107, #108) #109

clawbot referenced this issue