From 7fa53d90bd035fef56dfb2e7a8ad91f671cd6ccf Mon Sep 17 00:00:00 2001
From: Matthew Kent <matthew@37signals.com>
Date: Tue, 28 Nov 2023 15:51:32 -0800
Subject: [PATCH] Merge hashes to de-dupe the app and role envs.

This is better then adding them together which confusingly results in
both ENV vars in the same file, though based on the load order, they
worked anyway.
---
 lib/kamal/configuration/role.rb |  2 +-
 test/configuration/role_test.rb | 28 ++++++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/lib/kamal/configuration/role.rb b/lib/kamal/configuration/role.rb
index da88d406..84787a2f 100644
--- a/lib/kamal/configuration/role.rb
+++ b/lib/kamal/configuration/role.rb
@@ -239,7 +239,7 @@ class Kamal::Configuration::Role
         clear_app_env  = config.env["secret"] ? Array(config.env["clear"]) : Array(config.env["clear"] || config.env)
         clear_role_env = specialized_env["secret"] ? Array(specialized_env["clear"]) : Array(specialized_env["clear"] || specialized_env)
 
-        new_env["clear"] = (clear_app_env + clear_role_env).uniq
+        new_env["clear"] = clear_app_env.to_h.merge(clear_role_env.to_h)
       end
     end
 
diff --git a/test/configuration/role_test.rb b/test/configuration/role_test.rb
index 6aa4b343..9c1afc56 100644
--- a/test/configuration/role_test.rb
+++ b/test/configuration/role_test.rb
@@ -176,6 +176,34 @@ class ConfigurationRoleTest < ActiveSupport::TestCase
     ENV["REDIS_PASSWORD"] = nil
   end
 
+  test "env overwritten by role with secrets" do
+    @deploy_with_roles[:env] = {
+      "clear" => {
+        "REDIS_URL" => "redis://a/b"
+      },
+      "secret" => [
+        "REDIS_PASSWORD"
+      ]
+    }
+
+    @deploy_with_roles[:servers]["workers"]["env"] = {
+      "clear" => {
+        "REDIS_URL" => "redis://c/d",
+      },
+    }
+
+    ENV["REDIS_PASSWORD"] = "secret456"
+
+    expected = <<~ENV
+      REDIS_PASSWORD=secret456
+      REDIS_URL=redis://c/d
+    ENV
+
+    assert_equal expected, @config_with_roles.role(:workers).env_file.to_s
+  ensure
+    ENV["REDIS_PASSWORD"] = nil
+  end
+
   test "host_env_directory" do
     assert_equal ".kamal/env/roles", @config_with_roles.role(:workers).host_env_directory
   end