Patch Vercel case where secrets can be of type plain and sensitive

backend/src/integrations/sync.ts

@@ -545,7 +545,7 @@ const syncSecretsVercel = async ({
     value: string;
     target: string[];
   }
-
+  
   try {
     // Get all (decrypted) secrets back from Vercel in
     // decrypted format
@@ -574,7 +574,10 @@ const syncSecretsVercel = async ({
       .data
       .envs
       .filter((secret: VercelSecret) => secret.target.includes(integration.targetEnvironment))
-      .map(async (secret: VercelSecret) => (await axios.get(
+      .map(async (secret: VercelSecret) => {
+        if (secret.type === 'encrypted') {
+          // case: secret is encrypted -> need to decrypt
+          return (await axios.get(
               `${INTEGRATION_VERCEL_API_URL}/v9/projects/${integration.app}/env/${secret.id}`,
               {
                 params,
@@ -583,8 +586,11 @@ const syncSecretsVercel = async ({
                     'Accept-Encoding': 'application/json'
                 }
               }
-          )).data)
-      )).reduce((obj: any, secret: any) => ({
+          )).data;
+        }
+
+        return secret;
+      }))).reduce((obj: any, secret: any) => ({
           ...obj,
           [secret.key]: secret
       }), {});
@@ -615,8 +621,10 @@ const syncSecretsVercel = async ({
             id: res[key].id,
             key: key,
             value: secrets[key],
-            type: "encrypted",
-            target: [integration.targetEnvironment],
+            type: res[key].type,
+            target: res[key].target.includes(integration.targetEnvironment) 
+            ? [...res[key].target] 
+            : [...res[key].target, integration.targetEnvironment]
           });
         }
       } else {
@@ -625,7 +633,7 @@ const syncSecretsVercel = async ({
           id: res[key].id,
           key: key,
           value: res[key].value,
-          type: "encrypted",
+          type: "encrypted", // value doesn't matter
           target: [integration.targetEnvironment],
         });
       }
@@ -650,17 +658,20 @@ const syncSecretsVercel = async ({
     if (updateSecrets.length > 0) {
       updateSecrets.forEach(async (secret: VercelSecret) => {
         const { id, ...updatedSecret } = secret;
-        await axios.patch(
-          `${INTEGRATION_VERCEL_API_URL}/v9/projects/${integration.app}/env/${secret.id}`,
-          updatedSecret,
-          {
-            params,
-            headers: {
-              Authorization: `Bearer ${accessToken}`,
-              'Accept-Encoding': 'application/json'
-            },
-          }
-        );
+        
+        if (secret.type !== 'sensitive') {
+          await axios.patch(
+            `${INTEGRATION_VERCEL_API_URL}/v9/projects/${integration.app}/env/${secret.id}`,
+            updatedSecret,
+            {
+              params,
+              headers: {
+                Authorization: `Bearer ${accessToken}`,
+                'Accept-Encoding': 'application/json'
+              },
+            }
+          );
+        }
       });
     }
 

backend/src/routes/v2/workspace.ts

@@ -118,7 +118,6 @@ router.delete( // TODO - rewire dashboard to this route
 	workspaceController.deleteWorkspaceMembership
 );
 
-
 router.patch(
 	'/:workspaceId/auto-capitalization',
 	requireAuth({

backend/src/services/EventService.ts

@@ -1,5 +1,3 @@
-import { Bot, IBot } from '../models';
-import * as Sentry from '@sentry/node';
 import { handleEventHelper } from '../helpers/event';
 
 interface Event {

docs/integrations/cloud/vercel.mdx

@@ -30,3 +30,20 @@ Select which Infisical environment secrets you want to sync to which Vercel app
 
 ![integrations vercel](../../images/integrations-vercel-create.png)
 ![integrations vercel](../../images/integrations-vercel.png)
+
+<Info>
+  Infisical syncs every envar to Vercel with type `encrypted` unless an existing
+  envar with the same name in Vercel exists with a different type. Note that
+  Infisical will not be able to update Vercel envars with type `sensitive` since
+  they can only be decrypted and modified by Vercel's deployment systems.
+</Info>
+
+<Warning>
+  The following environment variable names are reserved by Vercel and cannot be
+  synced: `AWS_SECRET_KEY`, `AWS_EXECUTION_ENV`, `AWS_LAMBDA_LOG_GROUP_NAME`,
+  `AWS_LAMBDA_LOG_STREAM_NAME`, `AWS_LAMBDA_FUNCTION_NAME`,
+  `AWS_LAMBDA_FUNCTION_MEMORY_SIZE`, `AWS_LAMBDA_FUNCTION_VERSION`,
+  `NOW_REGION`, `TZ`, `LAMBDA_TASK_ROOT`, `LAMBDA_RUNTIME_DIR`,
+  `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`,
+  `AWS_REGION`, and `AWS_DEFAULT_REGION`.
+</Warning>