Allow STORYBOOK as env var

[snake-py]

Description

I am getting this error here:

error during build:
[vike:envVars] [vike][Wrong Usage] import.meta.env.STORYBOOK is used in client-side file /src/sentry/translation/utils.ts which means that the environment variable STORYBOOK will be included in client-side bundles and, therefore, STORYBOOK will be publicly exposed which can be a security leak. Use import.meta.env.STORYBOOK only in server-side files, or rename STORYBOOK to PUBLIC_ENV__STORYBOOK, see https://vike.dev/env
file: /Users/workdigital/work/hybrid-app/frontend2.0/src/sentry/translation/utils.ts
    at /Users/workdigital/work/hybrid-app/frontend2.0/node_modules/vike/dist/cjs/node/plugin/plugins/envVars.js:50:56
    at Array.forEach (<anonymous>)
    at Object.transform (/Users/workdigital/work/hybrid-app/frontend2.0/node_modules/vike/dist/cjs/node/plugin/plugins/envVars.js:36:18)
    at file:///Users/workdigital/work/hybrid-app/frontend2.0/node_modules/rollup/dist/es/shared/node-entry.js:19774:40

I know of the common prefix, however STORYBOOK is injected by the lib itself and I rather not make my own set up to detect if I run in storybook.

[brillout]

How about this:

• We whitelist STORYBOOK
• We create a new config env.public.

WDYT?

[snake-py]

@brillout - so basically all envs in .env.public are available everywhere? And STorybook gets a whitelabled everywhere as well?

I mean this would solve this. For me it would be enough to whitelist STORYBOOK

[brillout]

I meant that STORYBOOK is always available on the client-side. (I.e. treating STORYBOOK as if it were prefixed with PUBLIC_ENV__.)

all envs in .env.public are available everywhere?

Is that a common practice? I ain't familiar with it. I'm slightly reluctant to have a .env.public as it makes it a little easier to mistakenly leak secrets.

[snake-py]

@brillout I have seen people do this yes. But I have no fixed way of doing this. I mostly adjust to what the framework wants me to do. I just wasn't sure what you meant by adding a new config env.public

We create a new config env.public.

[brillout]

Ah, I see. I meant a new Vike setting:

// vike.config.js

export default {
  env: { public: ['STORYBOOK'] }
}

(The vike.config.js file is work-in-progress.)

As for .env.public, I'll think about it. In the meantime I'll whitelist STORYBOOK. ETA today.

[snake-py]

Okay thank you!

[brillout]

Pre-released as 0.4.177-commit-51d612a.

As for the rest, closing in favor of #1726.