added envvar resolution, fixed UI for the data drains, added screenshots to docs

Author: waleedlatif1

apps/docs/content/docs/en/enterprise/data-drains.mdx

@@ -15,6 +15,10 @@ Drains are independent of [Data Retention](/enterprise/data-retention) but desig
 
 Go to **Settings → Enterprise → Data Drains** in your workspace, then click **New drain**.
 
+![Data Drains settings page showing two configured drains — one exporting workflow logs to Amazon S3 daily, another exporting Copilot chats to an HTTPS webhook hourly](/static/enterprise/data-drains-list.png)
+
+![New data drain dialog with fields for name, source, cadence, destination, and S3 credentials](/static/enterprise/data-drains-new.png)
+
 Each drain has four pieces:
 
 1. A **source** — the category of data to export

apps/docs/public/static/enterprise/data-drains-list.png

@@ -12,7 +12,11 @@ import {
 } from '@/lib/api/contracts/data-drains'
 import { parseRequest, validationErrorResponse } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { authorizeDrainAccess, loadDrain } from '@/lib/data-drains/access'
+import {
+  authorizeDrainAccess,
+  loadDrain,
+  validateDrainEnvironmentWorkspace,
+} from '@/lib/data-drains/access'
 import { getDestination } from '@/lib/data-drains/destinations/registry'
 import { encryptCredentials } from '@/lib/data-drains/encryption'
 import { serializeDrain } from '@/lib/data-drains/serializers'
@@ -75,10 +79,19 @@ export const PUT = withRouteHandler(async (request: NextRequest, context: RouteC
     return NextResponse.json({ error: 'source cannot be changed after creation' }, { status: 400 })
   }
 
+  const envWorkspaceError = await validateDrainEnvironmentWorkspace(
+    organizationId,
+    body.environmentWorkspaceId
+  )
+  if (envWorkspaceError) return envWorkspaceError
+
   const updates: Partial<typeof dataDrains.$inferInsert> = { updatedAt: new Date() }
   if (body.name !== undefined) updates.name = body.name
   if (body.scheduleCadence !== undefined) updates.scheduleCadence = body.scheduleCadence
   if (body.enabled !== undefined) updates.enabled = body.enabled
+  if (body.environmentWorkspaceId !== undefined) {
+    updates.environmentWorkspaceId = body.environmentWorkspaceId
+  }
 
   if (body.destinationType !== undefined && body.destinationType !== drain.destinationType) {
     return NextResponse.json(
@@ -141,6 +154,7 @@ export const PUT = withRouteHandler(async (request: NextRequest, context: RouteC
         source: body.source,
         scheduleCadence: body.scheduleCadence,
         enabled: body.enabled,
+        environmentWorkspaceId: body.environmentWorkspaceId,
         destinationConfigChanged: body.destinationConfig !== undefined,
         destinationCredentialsChanged: body.destinationCredentials !== undefined,
       },

apps/docs/public/static/enterprise/data-drains-new.png

@@ -8,6 +8,7 @@ import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { authorizeDrainAccess, loadDrain } from '@/lib/data-drains/access'
 import { getDestination } from '@/lib/data-drains/destinations/registry'
 import { decryptCredentials } from '@/lib/data-drains/encryption'
+import { resolveDataDrainDestinationEnvVars } from '@/lib/data-drains/resolve-config'
 
 const logger = createLogger('DataDrainTestAPI')
 
@@ -36,10 +37,16 @@ export const POST = withRouteHandler(async (request: NextRequest, context: Route
     )
   }
 
-  const config = destination.configSchema.parse(drain.destinationConfig)
-  const credentials = destination.credentialsSchema.parse(
-    await decryptCredentials(drain.destinationCredentials)
+  const unresolvedConfig = destination.configSchema.parse(drain.destinationConfig)
+  const unresolvedCredentials = await decryptCredentials(drain.destinationCredentials)
+  const resolved = await resolveDataDrainDestinationEnvVars(
+    unresolvedConfig,
+    unresolvedCredentials,
+    drain.createdBy,
+    drain.environmentWorkspaceId ?? undefined
   )
+  const config = destination.configSchema.parse(resolved.config)
+  const credentials = destination.credentialsSchema.parse(resolved.credentials)
 
   const controller = new AbortController()
   const timeout = setTimeout(() => controller.abort(), TEST_TIMEOUT_MS)

apps/sim/app/api/organizations/[id]/data-drains/[drainId]/route.ts

@@ -9,7 +9,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { createDataDrainContract, listDataDrainsContract } from '@/lib/api/contracts/data-drains'
 import { parseRequest, validationErrorResponse } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { authorizeDrainAccess } from '@/lib/data-drains/access'
+import { authorizeDrainAccess, validateDrainEnvironmentWorkspace } from '@/lib/data-drains/access'
 import { getDestination } from '@/lib/data-drains/destinations/registry'
 import { encryptCredentials } from '@/lib/data-drains/encryption'
 import { serializeDrain } from '@/lib/data-drains/serializers'
@@ -45,6 +45,12 @@ export const POST = withRouteHandler(async (request: NextRequest, context: Route
 
   const body = parsed.data.body
 
+  const envWorkspaceError = await validateDrainEnvironmentWorkspace(
+    organizationId,
+    body.environmentWorkspaceId
+  )
+  if (envWorkspaceError) return envWorkspaceError
+
   if (!body.destinationCredentials) {
     return NextResponse.json(
       { error: 'destinationCredentials is required when creating a drain' },
@@ -84,6 +90,7 @@ export const POST = withRouteHandler(async (request: NextRequest, context: Route
         destinationType: body.destinationType,
         destinationConfig: configResult.data as Record<string, unknown>,
         destinationCredentials: encryptedCredentials,
+        environmentWorkspaceId: body.environmentWorkspaceId,
         scheduleCadence: body.scheduleCadence,
         enabled: body.enabled ?? true,
         cursor: null,