coder
diff --git a/‎coderd/provisionerdserver/provisionerdserver.go
Lines changed: 28 additions & 0 deletions b/‎coderd/provisionerdserver/provisionerdserver.go
Lines changed: 28 additions & 0 deletions
diff --git a/‎provisioner/terraform/provision.go
Lines changed: 14 additions & 0 deletions b/‎provisioner/terraform/provision.go
Lines changed: 14 additions & 0 deletions
@@ -682,6 +682,33 @@ func (s *server) acquireProtoJob(ctx context.Context, job database.ProvisionerJo
 			}
 		}
 
+		s.Logger.Info(
+			ctx,
+			"before calling ListUserSecrets",
+			slog.F("workspace_id", workspace.ID),
+			slog.F("workspace_owner_id", workspace.OwnerID),
+		)
+		userSecrets, err := s.Database.ListUserSecrets(dbauthz.AsSystemRestricted(ctx), workspace.OwnerID)
+		if err != nil {
+			s.Logger.Error(
+				ctx,
+				"failed to list user secrets",
+				slog.Error(err),
+				slog.F("workspace_id", workspace.ID),
+				slog.F("workspace_owner_id", workspace.OwnerID),
+			)
+			return nil, err
+		}
+		userSecretsProto := make([]*sdkproto.Secret, 0)
+		for _, userSecret := range userSecrets {
+			userSecretsProto = append(userSecretsProto, &sdkproto.Secret{
+				Name:     userSecret.Name,
+				EnvName:  userSecret.EnvName,
+				FilePath: userSecret.FilePath,
+				Value:    userSecret.Value,
+			})
+		}
+
 		protoJob.Type = &proto.AcquiredJob_WorkspaceBuild_{
 			WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
 				WorkspaceBuildId:        workspaceBuild.ID.String(),
@@ -713,6 +740,7 @@ func (s *server) acquireProtoJob(ctx context.Context, job database.ProvisionerJo
 					WorkspaceOwnerRbacRoles:       ownerRbacRoles,
 					RunningAgentAuthTokens:        runningAgentAuthTokens,
 					PrebuiltWorkspaceBuildStage:   input.PrebuiltWorkspaceBuildStage,
+					UserSecrets:                   userSecretsProto,
 				},
 				LogLevel: input.LogLevel,
 			},
 
@@ -299,6 +299,20 @@ func provisionEnv(
 		env = append(env, provider.ExternalAuthAccessTokenEnvironmentVariable(extAuth.Id)+"="+extAuth.AccessToken)
 	}
 
+	for _, userSecrets := range metadata.UserSecrets {
+		env = append(env, userSecrets.EnvName+"="+userSecrets.Value)
+	}
+
+	envInJSON, err := json.Marshal(env)
+	if err != nil {
+		return nil, err
+	}
+	fmt.Printf("envInJSON: %s\n", envInJSON)
+
+	for _, userSecrets := range metadata.UserSecrets {
+		fmt.Printf("%v=%v\n", userSecrets.EnvName, userSecrets.Value)
+	}
+
 	if config.ProvisionerLogLevel != "" {
 		// TF_LOG=JSON enables all kind of logging: trace-debug-info-warn-error.
 		// The idea behind using TF_LOG=JSON instead of TF_LOG=debug is ensuring the proper log format.