Inject app variables into deployments

scripts/deploy-app.sh

@@ -17,6 +17,8 @@ mkdir -p "$DOCKER_CONFIG"
 DB_FILE="/opt/appfactory/data/appfactory/appfactory.db"
 APP_SOURCE_DIR="$WORKSPACE_DIR/$APP_ID"
 TOOLS_DIR="$WORKSPACE_DIR/appfactory-tools"
+APP_DATA_DIR="$APPFACTORY_DIR/data/apps/$APP_ID"
+APP_ENV_FILE="$APP_DATA_DIR/.env"
 
 TRIGGER_SOURCE="${APPFACTORY_TRIGGER_SOURCE:-cli}"
 TRIGGERED_BY_USER_ID="${APPFACTORY_TRIGGERED_BY_USER_ID:-}"
@@ -179,6 +181,73 @@ fi
 
 RESULT=$?
 
+if [ "$RESULT" -eq 0 ]; then
+  run_step "Generating app environment file" bash -c "
+mkdir -p '$APP_DATA_DIR'
+
+python3 - '$DB_FILE' '$APP_ID' '$APP_ENV_FILE' <<'PY'
+import os
+import re
+import sqlite3
+import sys
+from pathlib import Path
+
+db_file = sys.argv[1]
+app_id = sys.argv[2]
+env_file = Path(sys.argv[3])
+
+key_pattern = re.compile(r'^[A-Za-z_][A-Za-z0-9_]*$')
+
+con = sqlite3.connect(db_file)
+con.row_factory = sqlite3.Row
+
+rows = con.execute(
+    '''
+    SELECT key, value, is_secret, required
+    FROM app_variables
+    WHERE app_id = ?
+    ORDER BY key
+    ''',
+    (app_id,),
+).fetchall()
+
+missing_required = []
+
+lines = [
+    '# Generated by AppFactory. Do not edit manually.',
+    f'APP_ID={app_id}',
+]
+
+for row in rows:
+    key = row['key']
+    value = row['value'] or ''
+    required = int(row['required'] or 0)
+
+    if not key_pattern.match(key):
+        raise SystemExit(f'Invalid environment variable key: {key}')
+
+    if required and value == '':
+        missing_required.append(key)
+
+    escaped = value.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n')
+    lines.append(f'{key}=\"{escaped}\"')
+
+if missing_required:
+    raise SystemExit('Missing required variables: ' + ', '.join(missing_required))
+
+env_file.parent.mkdir(parents=True, exist_ok=True)
+env_file.write_text('\\n'.join(lines) + '\\n', encoding='utf-8')
+os.chmod(env_file, 0o600)
+
+con.close()
+PY
+
+echo 'Generated env file: $APP_ENV_FILE'
+"
+
+  RESULT=$?
+fi
+
 if [ "$RESULT" -eq 0 ]; then
   run_step "Building Docker image" \
     docker build --pull --no-cache \