Improve .env File Handling

[yusufkandemir]

app-vite v2 and app-webpack v4 introduced a built-in .env file handling mechanism. It is a nice addition, but it comes with a few quirks that make it less useful (or even problematic) in certain cases. This issue serves as a central place to track discussions and improvements related to .env handling. Here are the main points:

1. All .env variables are exposed by default - The variables in .env files should not be exposed by default #17914

   • Any variable you define in .env is automatically made available into the client-side app, which is considered a security risk.
   • It should only exposed if it follows a specific pattern like QUASAR_/Q_CLI or if explicitly defined to be exposed.

2. .env variables are auto-converted into non-string types - The variables in .env files should not be auto-parsed into non-string types #17915

   • It auto-parses values like "false" into false for convenience, but this can lead to unexpected behavior, especially when using TypeScript.
   • .env values should always remain strings to match standard Node.js and dotenv behavior. This is important for consistency and to avoid confusion.
   • For convenience, flexibility, and increased distinction between statically replaced(in client-side code) and dynamic usage(in Node based parts like SSR, Electron main process, etc.), we can introduce import.meta.env support. Then, use it for static replacements allowing multiple types, while keeping process.env for dynamic usage only string. This way, we can have the best of both worlds.

3. You can't use .env variables in quasar.config - The env variables loaded from .env file cannot be used inside quasar.config file #17917

   • Quasar loads quasar.config before it processes the .env file, so process.env.* isn’t available inside the config file.
   • CI/CI, Docker, etc. usage requires the ability to passthrough process.env.* variables inside quasar.config to be used in the build process.
   • The workaround is to manually load dotenv at the top of the file, just like before, making the built-in feature pointless for those cases.