Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

`cf workers secrets update` replaces the entire secret set instead of patching a single secret

Abierto
  • ¿Algo no está bien?
#96 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
68/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
typescript
Área
api, cli, cloud

Línea de trabajo

Start at the cf workers secrets update command entry point and compare its dry-run request with cf workers secrets bulk, including the /secrets and /secrets-bulk endpoints. Reproduce the two-secret sequence from the issue and inspect the existing command tests or request handling. Done means updating one secret leaves other secrets unchanged, with coverage for the reported sequence or clearly documented replacement behavior.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

cf version: 1.0.0-beta.5, macOS

What happens

cf workers secrets update <NAME> --worker <worker> --type secret_text --text <value> sets the named secret, but silently deletes every other secret already on the Worker — it's not a patch, it's a full replace.

Hit this for real while migrating a production Worker (8 secrets already set via wrangler secret put, working fine). Ran cf workers secrets update RUN_TOKEN --worker web-qa-jev-agent --type secret_text --text "<new-token>" to rotate one token. cf workers secrets list --worker web-qa-jev-agent immediately after came back [{"name": "RUN_TOKEN", ...}] — the other 7 (GitHub App auth, webhook secret, target URL) were gone. Broke GitHub App auth and a webhook trigger until manually restored via wrangler secret put.

Repro

cf init repro-cf --package-manager npm
cd repro-cf
cf deploy   # after declaring at least one bindings.secret() per #70/#72's workaround, or use --secrets-file
cf workers secrets update FIRST --worker repro-cf --type secret_text --text a
cf workers secrets list --worker repro-cf     # [FIRST]
cf workers secrets update SECOND --worker repro-cf --type secret_text --text b
cf workers secrets list --worker repro-cf     # [SECOND] -- FIRST is gone

What I found

cf workers secrets update --dry-run shows exactly why:

{
  "command": "cf workers secrets update",
  "method": "PUT",
  "url": "https://api.cloudflare.com/client/v4/accounts/{account}/workers/scripts/{script}/secrets",
  "body": { "name": "SECOND", "type": "secret_text", "text": "b" }
}

It's a PUT to the plain /secrets collection endpoint with only the one secret in the body — a full replace, not a merge. Compare to cf workers secrets bulk --dry-run with the same secret:

{
  "command": "cf workers secrets bulk",
  "method": "PATCH",
  "url": "https://api.cloudflare.com/client/v4/accounts/{account}/workers/scripts/{script}/secrets-bulk",
  "body": { "SECOND": { "type": "secret_text", "text": "b" } }
}

bulk hits a different endpoint (/secrets-bulk) with PATCH/RFC 7396 merge semantics — its own --help text even says "Secrets not included in the request are left unchanged" and recommends it over update for multi-secret changes. But nothing in update's own --help or command name suggests that a single-secret call is just as destructive to every other existing secret. This looks like the same root-cause family as #70/#72/#54 (PUT-only API, no merge-on-single-field-update), specifically for the one command whose entire job description ("Add a secret to a Worker script") implies it should be additive.

Expected

cf workers secrets update either performs a genuine patch (e.g. by using the bulk/secrets-bulk endpoint under the hood when only one secret is given), or its --help/docs state unambiguously that it replaces the whole secret set — right now the command name and description ("Add a secret...") actively suggest the opposite of what it does.

Workaround

Use cf workers secrets bulk --body '{"NAME": {"type": "secret_text", "text": "value"}}' instead of update, always, even for a single secret on a Worker that has others set.

Lenguaje dominante
TypeScript
Estrellas
916
Forks
53
Merge medio
18 h 37 min
PR fusionados (30 d)
197

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de cloudflare/cf

Todos los issues de cloudflare/cf

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.