From d7a21ff3005f6d9a0bc266b61a625f7ce69ca969 Mon Sep 17 00:00:00 2001
From: Patrick Arminio <patrick.arminio@gmail.com>
Date: Tue, 13 Jan 2026 19:03:22 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20Fix=20`env=20list`=20for=20secre?=
 =?UTF-8?q?t=20environment=20variables?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The API does not return a `value` field for secret environment variables.
This caused a Pydantic validation error when listing env vars.

Make the `value` field optional to handle this case.
---
 src/fastapi_cloud_cli/commands/env.py |  4 ++--
 tests/test_env_list.py                | 29 +++++++++++++++++++++++++++
 2 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/src/fastapi_cloud_cli/commands/env.py b/src/fastapi_cloud_cli/commands/env.py
index e592fdb..f4de2cc 100644
--- a/src/fastapi_cloud_cli/commands/env.py
+++ b/src/fastapi_cloud_cli/commands/env.py
@@ -1,6 +1,6 @@
 import logging
 from pathlib import Path
-from typing import Annotated, Any, Union
+from typing import Annotated, Any, Optional, Union
 
 import typer
 from pydantic import BaseModel
@@ -16,7 +16,7 @@
 
 class EnvironmentVariable(BaseModel):
     name: str
-    value: str
+    value: Optional[str] = None
 
 
 class EnvironmentVariableResponse(BaseModel):
diff --git a/tests/test_env_list.py b/tests/test_env_list.py
index aa54b78..860cc92 100644
--- a/tests/test_env_list.py
+++ b/tests/test_env_list.py
@@ -85,3 +85,32 @@ def test_shows_environment_variables_names(
     assert result.exit_code == 0
     assert "SECRET_KEY" in result.output
     assert "API_KEY" in result.output
+
+
+@pytest.mark.respx(base_url=settings.base_api_url)
+def test_shows_secret_environment_variables_without_value(
+    logged_in_cli: None, respx_mock: respx.MockRouter, configured_app: ConfiguredApp
+) -> None:
+    """Test that secret env vars without a value field are handled correctly."""
+    respx_mock.get(f"/apps/{configured_app.app_id}/environment-variables/").mock(
+        return_value=Response(
+            200,
+            json={
+                "data": [
+                    {
+                        "name": "SECRET_KEY",
+                        "is_secret": True,
+                        "created_at": "2026-01-13T19:01:07.408378Z",
+                        "updated_at": "2026-01-13T19:01:07.408389Z",
+                        "connected_resource": None,
+                    },
+                ]
+            },
+        )
+    )
+
+    with changing_dir(configured_app.path):
+        result = runner.invoke(app, ["env", "list"])
+
+    assert result.exit_code == 0
+    assert "SECRET_KEY" in result.output