Implement option to configure secret environment variables for RF executions

examples/termination/main.rs

@@ -46,6 +46,7 @@ fn system_main() -> AnyhowResult<()> {
             "--variable".into(),
             format!("RESOURCE:{resource_file}"),
         ],
+        envs_rendered_obfuscated: vec![],
         retry_strategy: RetryStrategy::Complete,
     };
     let token = CancellationToken::new();
@@ -100,6 +101,7 @@ fn rcc_main(rcc_binary_path: Utf8PathBuf) -> AnyhowResult<()> {
             "--variable".into(),
             format!("RESOURCE:{resource_file}"),
         ],
+        envs_rendered_obfuscated: vec![],
         retry_strategy: RetryStrategy::Complete,
     };
     let rcc_environment = Environment::Rcc(RCCEnvironment {

src/bin/scheduler/internal_config.rs

@@ -133,6 +133,9 @@ pub fn from_external_config(
                             .map(|f| plan_source_dir.join(f))
                             .collect(),
                         exit_on_failure: plan_config.robot_config.exit_on_failure,
+                        environment_variables_rendered_obfuscated: plan_config
+                            .robot_config
+                            .environment_variables_rendered_obfuscated,
                     },
                     plan_config.execution_config.n_attempts_max,
                     plan_config.execution_config.retry_strategy,
@@ -200,6 +203,7 @@ mod tests {
                 variable_files: vec![],
                 argument_files: vec!["args.txt".into(), "more_args.txt".into()],
                 exit_on_failure: false,
+                environment_variables_rendered_obfuscated: vec![],
             },
             execution_config: ExecutionConfig {
                 n_attempts_max: 1,
@@ -235,6 +239,7 @@ mod tests {
                 variable_files: vec!["vars.txt".into()],
                 argument_files: vec![],
                 exit_on_failure: false,
+                environment_variables_rendered_obfuscated: vec![],
             },
             execution_config: ExecutionConfig {
                 n_attempts_max: 1,
@@ -317,6 +322,7 @@ mod tests {
                     "--variablefile".into(),
                     "/synthetic_tests/rcc/vars.txt".into()
                 ],
+                envs_rendered_obfuscated: vec![],
                 n_attempts_max: 1,
                 retry_strategy: RetryStrategy::Complete,
             }
@@ -378,6 +384,7 @@ mod tests {
                     "--argumentfile".into(),
                     "/synthetic_tests/system/more_args.txt".into()
                 ],
+                envs_rendered_obfuscated: vec![],
                 n_attempts_max: 1,
                 retry_strategy: RetryStrategy::Incremental,
             }

src/command_spec.rs

@@ -7,18 +7,29 @@ use std::process::Command;
 pub struct CommandSpec {
     pub executable: String,
     pub arguments: Vec<String>,
-    pub envs: Vec<(String, String)>,
+    pub envs_rendered_plain: Vec<(String, String)>,
+    pub envs_rendered_obfuscated: Vec<(String, String)>,
 }
 
 impl Display for CommandSpec {
     fn fmt(&self, f: &mut Formatter<'_>) -> Result {
-        let env_str = self
-            .envs
+        let rendered_plain_envs_iter = self
+            .envs_rendered_plain
             .iter()
-            .map(|(k, _)| format!("{k}=***"))
-            .collect::<Vec<_>>()
-            .join(" ");
-        write!(f, "{env_str} {}", self.to_command_string())
+            .map(|(k, v)| format!("{k}=\"{v}\""));
+        let rendered_obfuscated_envs_iter = self
+            .envs_rendered_obfuscated
+            .iter()
+            .map(|(k, _)| format!("{k}=***"));
+        write!(
+            f,
+            "{env_str} {cmd_string}",
+            env_str = rendered_plain_envs_iter
+                .chain(rendered_obfuscated_envs_iter)
+                .collect::<Vec<_>>()
+                .join(" "),
+            cmd_string = self.to_command_string()
+        )
     }
 }
 
@@ -28,8 +39,9 @@ impl From<&CommandSpec> for Command {
         command.args(&command_spec.arguments);
         command.envs(
             command_spec
-                .envs
+                .envs_rendered_plain
                 .iter()
+                .chain(command_spec.envs_rendered_obfuscated.iter())
                 .map(|(k, v)| (OsString::from(&k), OsString::from(&v))),
         );
         command
@@ -47,7 +59,8 @@ impl CommandSpec {
         Self {
             executable: executable.as_ref().into(),
             arguments: vec![],
-            envs: vec![],
+            envs_rendered_plain: vec![],
+            envs_rendered_obfuscated: vec![],
         }
     }
 
@@ -65,8 +78,21 @@ impl CommandSpec {
         self
     }
 
-    pub fn add_env(&mut self, key: String, value: String) -> &mut Self {
-        self.envs.push((key, value));
+    pub fn add_plain_env<T>(&mut self, key: T, value: T) -> &mut Self
+    where
+        T: AsRef<str>,
+    {
+        self.envs_rendered_plain
+            .push((key.as_ref().into(), value.as_ref().into()));
+        self
+    }
+
+    pub fn add_obfuscated_env<T>(&mut self, key: T, value: T) -> &mut Self
+    where
+        T: AsRef<str>,
+    {
+        self.envs_rendered_obfuscated
+            .push((key.as_ref().into(), value.as_ref().into()));
         self
     }
 
@@ -91,10 +117,11 @@ mod tests {
                 String::from("--option"),
                 String::from("value"),
             ],
-            envs: vec![("RCC_REMOTE_ORIGIN".into(), "http://1.com".into())],
+            envs_rendered_plain: vec![("ROBOCORP_HOME".into(), "/opt/rc_home".into())],
+            envs_rendered_obfuscated: vec![("RCC_REMOTE_ORIGIN".into(), "http://1.com".into())],
         };
         let expected =
-            "RCC_REMOTE_ORIGIN=*** \"/my/binary\" \"mandatory\" \"--flag\" \"--option\" \"value\"";
+            "ROBOCORP_HOME=\"/opt/rc_home\" RCC_REMOTE_ORIGIN=*** \"/my/binary\" \"mandatory\" \"--flag\" \"--option\" \"value\"";
         assert_eq!(format!("{command_spec}"), expected);
     }
 
@@ -106,7 +133,8 @@ mod tests {
             .arg("--flag")
             .arg("--option")
             .arg("value")
-            .env("key", "val");
+            .env("plain_key", "plain_val")
+            .env("obfuscated_key", "obfuscated_val");
         let command = Command::from(&CommandSpec {
             executable: String::from("/my/binary"),
             arguments: vec![
@@ -115,7 +143,11 @@ mod tests {
                 String::from("--option"),
                 String::from("value"),
             ],
-            envs: vec![(String::from("key"), String::from("val"))],
+            envs_rendered_plain: vec![(String::from("plain_key"), String::from("plain_val"))],
+            envs_rendered_obfuscated: vec![(
+                String::from("obfuscated_key"),
+                String::from("obfuscated_val"),
+            )],
         });
         assert_eq!(command.get_program(), expected.get_program());
         assert_eq!(
@@ -135,7 +167,8 @@ mod tests {
             CommandSpec {
                 executable: String::from("/my/binary"),
                 arguments: vec![],
-                envs: vec![],
+                envs_rendered_plain: vec![],
+                envs_rendered_obfuscated: vec![],
             }
         )
     }
@@ -145,25 +178,37 @@ mod tests {
         let mut command_spec = CommandSpec {
             executable: String::from("/my/binary"),
             arguments: vec![],
-            envs: vec![],
+            envs_rendered_plain: vec![],
+            envs_rendered_obfuscated: vec![],
         };
         command_spec.add_argument("arg");
         assert_eq!(
             command_spec,
             CommandSpec {
                 executable: String::from("/my/binary"),
                 arguments: vec!["arg".into()],
-                envs: vec![],
+                envs_rendered_plain: vec![],
+                envs_rendered_obfuscated: vec![],
             }
         );
     }
 
     #[test]
-    fn add_env() {
+    fn add_plain_env() {
+        let mut command_spec = CommandSpec::new("/my/binary");
+        command_spec.add_plain_env("key", "val");
+        assert_eq!(
+            command_spec.envs_rendered_plain,
+            [(String::from("key"), String::from("val"))]
+        );
+    }
+
+    #[test]
+    fn add_obfuscated_env() {
         let mut command_spec = CommandSpec::new("/my/binary");
-        command_spec.add_env("key".to_string(), "val".to_string());
+        command_spec.add_obfuscated_env("key", "val");
         assert_eq!(
-            command_spec.envs,
+            command_spec.envs_rendered_obfuscated,
             [(String::from("key"), String::from("val"))]
         );
     }
@@ -173,15 +218,17 @@ mod tests {
         let mut command_spec = CommandSpec {
             executable: String::from("/my/binary"),
             arguments: vec![],
-            envs: vec![],
+            envs_rendered_plain: vec![],
+            envs_rendered_obfuscated: vec![],
         };
         command_spec.add_arguments(vec!["arg1", "arg2"]);
         assert_eq!(
             command_spec,
             CommandSpec {
                 executable: String::from("/my/binary"),
                 arguments: vec!["arg1".into(), "arg2".into()],
-                envs: vec![],
+                envs_rendered_plain: vec![],
+                envs_rendered_obfuscated: vec![],
             }
         );
     }

src/config.rs

@@ -78,6 +78,7 @@ pub struct RobotConfig {
     pub variable_files: Vec<Utf8PathBuf>,
     pub argument_files: Vec<Utf8PathBuf>,
     pub exit_on_failure: bool,
+    pub environment_variables_rendered_obfuscated: Vec<RobotFrameworkObfuscatedEnvVar>,
 }
 
 #[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
@@ -86,6 +87,12 @@ pub struct RobotFrameworkVariable {
     pub value: String,
 }
 
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+pub struct RobotFrameworkObfuscatedEnvVar {
+    pub name: String,
+    pub value: String,
+}
+
 #[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
 pub struct ExecutionConfig {
     pub n_attempts_max: usize,

src/environment.rs

@@ -100,7 +100,7 @@ impl RCCEnvironment {
     pub fn bundled_command_spec(binary_path: &Utf8Path, robocorp_home: String) -> CommandSpec {
         let mut command_spec = CommandSpec::new(binary_path);
         command_spec.add_argument("--bundled");
-        command_spec.add_env("ROBOCORP_HOME".to_string(), robocorp_home);
+        command_spec.add_obfuscated_env("ROBOCORP_HOME", &robocorp_home);
         command_spec
     }
 
@@ -121,8 +121,7 @@ impl RCCEnvironment {
             .add_argument("script");
         self.apply_current_settings(&mut build_command_spec);
         if let Some(remote_origin) = &self.remote_origin {
-            build_command_spec
-                .add_env(String::from("RCC_REMOTE_ORIGIN"), remote_origin.to_string());
+            build_command_spec.add_obfuscated_env("RCC_REMOTE_ORIGIN", remote_origin);
         }
         build_command_spec.add_argument("--").add_argument(
             #[cfg(unix)]
@@ -221,7 +220,7 @@ mod tests {
                 #[cfg(windows)]
                 "cmd.exe",
             )
-            .add_env(String::from("ROBOCORP_HOME"), String::from("~/.robocorp/"));
+            .add_obfuscated_env("ROBOCORP_HOME", "~/.robocorp/");
 
         assert_eq!(
             RCCEnvironment {
@@ -284,7 +283,7 @@ mod tests {
             .add_argument("--flag")
             .add_argument("--option")
             .add_argument("option_value")
-            .add_env(String::from("ROBOCORP_HOME"), String::from("~/.robocorp/"));
+            .add_obfuscated_env("ROBOCORP_HOME", "~/.robocorp/");
         assert_eq!(
             RCCEnvironment {
                 binary_path: Utf8PathBuf::from("C:\\bin\\z.exe"),