---
id: w4/m6.5/t004
title: "Edit mode: add / update / delete a variable, wired to setEnvVar / deleteEnvVar (+ rollout note)"
worker: worker4
status: done
estimate: 45m
depends_on: [w4/m6.5/t003]
---

## Objective

The write side of the Environment tab: an Edit affordance that lets a user add a variable, change a value, and remove a variable, wired to the mutations (`setEnvVar` for add/update-one, `deleteEnvVar` for remove; `setEnvVars` for a bulk replace-all Save). Refetch/update the keys list after a write, and surface that a write **rolls the service's pods** so the user knows the change is deploying.

## Context

- Depends on t003's table + t001's mutation hooks.
- bex-api semantics (docs/ADR006-bex-api.md#env-vars): every write stores to OpenBao, materializes the `<service>-env` Secret, and rolls the pods via `spec.restartedAt` — unlike Render, bex has no separate deploy step, so the value goes live once the rollout completes. Reflect this ("changes are deploying…") rather than implying an instant apply.
- 403 on write (tuple-less key) → surface as a permission error, not a silent failure.
- Keep values out of any logging/telemetry the dashboard emits; the API already never returns values except on explicit reveal.

## Steps

1. Add an Edit mode (add-row, editable value, delete-row) over the t003 table.
2. Wire add/update to `setEnvVar` and delete to `deleteEnvVar` (or `setEnvVars` for a batched Save); refetch keys after.
3. Show a "changes are deploying / rolling out" affordance; surface write errors (403).

## Files

- `dashboard/src/features/services/components/env-vars-table.tsx` (+ an editor/form component)
- `dashboard/src/features/services/hooks/*` (mutation wiring)

## Acceptance criteria

- [ ] Add, update, and delete each persist through the API and the list reflects the result after refetch.
- [ ] The rollout is surfaced to the user; a write 403 shows a permission error.

## Out of scope

- E2E against a real app (t005).
