@open-mercato/core 0.6.8-develop.7037.1.ea0277b01e → 0.6.8-develop.7038.1.ea954afd80

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 4326 entry points
+[build:core] found 4328 entry points
 [build:core] built successfully
 [build:core:generated] found 218 entry points
 [build:core:generated] built successfully

package/dist/modules/integrations/api/[id]/credentials/route.js

@@ -162,7 +162,12 @@ async function PUT(req, ctx) {
   }
   try {
     const existing = await credentialsService.resolve(integration.id, scope);
-    const credentialsToSave = mergeMaskedSecretCredentials(schema, payloadData.credentials, existing ?? {});
+    const credentialsToSave = mergeMaskedSecretCredentials(
+      schema,
+      payloadData.credentials,
+      existing ?? {},
+      payloadData.unchangedSecretFields
+    );
     await credentialsService.save(integration.id, credentialsToSave, scope);
   } catch (error) {
     if (isCredentialsEncryptionUnavailableError(error)) {

package/dist/modules/integrations/api/[id]/credentials/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/integrations/api/%5Bid%5D/credentials/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { emitIntegrationsEvent } from '../../../events'\nimport { saveCredentialsSchema } from '../../../data/validators'\nimport {\n  isCredentialsEncryptionUnavailableError,\n  type CredentialsService,\n} from '../../../lib/credentials-service'\nimport { collectCredentialUrlValidationErrors } from '../../../lib/credentials-field-validation'\nimport {\n  maskSecretCredentials,\n  mergeMaskedSecretCredentials,\n} from '../../../lib/credentials-masking'\nimport {\n  resolveUserFeatures,\n  runIntegrationMutationGuardAfterSuccess,\n  runIntegrationMutationGuards,\n} from '../../guards'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\n\nconst idParamsSchema = z.object({ id: z.string().min(1) })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['integrations.credentials.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['integrations.credentials.manage'] },\n}\n\nexport const openApi = {\n  tags: ['Integrations'],\n  summary: 'Get or save integration credentials',\n}\n\nfunction resolveParams(ctx: { params?: Promise<{ id?: string }> | { id?: string } }): Promise<{ id?: string } | undefined> | { id?: string } | undefined {\n  if (!ctx.params) return undefined\n  if (typeof (ctx.params as Promise<unknown>).then === 'function') {\n    return ctx.params as Promise<{ id?: string }>\n  }\n  return ctx.params as { id?: string }\n}\n\nexport async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const rawParams = await resolveParams(ctx)\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const container = await createRequestContainer()\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const scope = { organizationId: organizationId, tenantId: auth.tenantId }\n\n  let values: Record<string, unknown> | null\n  let updatedAt: Date | null\n  try {\n    values = await credentialsService.resolve(integration.id, scope)\n    updatedAt = await credentialsService.resolveUpdatedAt(integration.id, scope)\n  } catch (error) {\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  const schema = credentialsService.getSchema(integration.id)\n  const { credentials, secretFieldsConfigured } = maskSecretCredentials(schema, values ?? {})\n\n  return NextResponse.json({\n    integrationId: integration.id,\n    schema,\n    credentials,\n    secretFieldsConfigured,\n    updatedAt: updatedAt?.toISOString() ?? null,\n  })\n}\n\nexport async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const rawParams = await resolveParams(ctx)\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const payload = await req.json().catch(() => null)\n  const parsedBody = saveCredentialsSchema.safeParse(payload)\n  if (!parsedBody.success) {\n    return NextResponse.json({ error: 'Invalid credentials payload', details: parsedBody.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const guardResult = await runIntegrationMutationGuards(\n    container,\n    {\n    tenantId: auth.tenantId,\n    organizationId,\n    userId: auth.sub ?? '',\n    resourceKind: 'integrations.integration',\n    resourceId: integration.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsedBody.data as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n  }\n\n  let payloadData = parsedBody.data\n  if (guardResult.modifiedPayload) {\n    const mergedPayload = { ...parsedBody.data, ...guardResult.modifiedPayload }\n    const reparsed = saveCredentialsSchema.safeParse(mergedPayload)\n    if (!reparsed.success) {\n      return NextResponse.json({ error: 'Invalid credentials payload after guard transform', details: reparsed.error.flatten() }, { status: 422 })\n    }\n    payloadData = reparsed.data\n  }\n\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const scope = { organizationId: organizationId, tenantId: auth.tenantId }\n  const schema = credentialsService.getSchema(integration.id)\n\n  try {\n    const currentUpdatedAt = await credentialsService.resolveUpdatedAt(integration.id, scope)\n    enforceCommandOptimisticLock({\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      current: currentUpdatedAt,\n      request: req,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  const credentialFieldErrors = collectCredentialUrlValidationErrors(\n    schema,\n    payloadData.credentials,\n  )\n  if (Object.keys(credentialFieldErrors).length > 0) {\n    return NextResponse.json(\n      { error: 'Invalid credentials payload', details: { fieldErrors: credentialFieldErrors } },\n      { status: 422 },\n    )\n  }\n\n  try {\n    // Secret fields are returned masked on GET; when the client round-trips the\n    // mask sentinel it means \"unchanged\", so restore the existing stored secret\n    // instead of overwriting it with the placeholder.\n    const existing = await credentialsService.resolve(integration.id, scope)\n    const credentialsToSave = mergeMaskedSecretCredentials(schema, payloadData.credentials, existing ?? {})\n    await credentialsService.save(integration.id, credentialsToSave, scope)\n  } catch (error) {\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  await emitIntegrationsEvent('integrations.credentials.updated', {\n    integrationId: integration.id,\n    tenantId: auth.tenantId,\n    organizationId,\n    userId: auth.sub,\n  })\n\n  await runIntegrationMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n\n  return NextResponse.json({ ok: true })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,oCAAoC;AAC7C,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,4CAA4C;AACrD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mCAAmC,mCAAmC;AAE/E,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAElD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AAAA,EAC/E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AACjF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,cAAc;AAAA,EACrB,SAAS;AACX;AAEA,SAAS,cAAc,KAAkI;AACvJ,MAAI,CAAC,IAAI,OAAQ,QAAO;AACxB,MAAI,OAAQ,IAAI,OAA4B,SAAS,YAAY;AAC/D,WAAO,IAAI;AAAA,EACb;AACA,SAAO,IAAI;AACb;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAY,MAAM,cAAc,GAAG;AACzC,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,QAAQ,EAAE,gBAAgC,UAAU,KAAK,SAAS;AAExE,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,mBAAmB,QAAQ,YAAY,IAAI,KAAK;AAC/D,gBAAY,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,KAAK;AAAA,EAC7E,SAAS,OAAO;AACd,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,QAAM,SAAS,mBAAmB,UAAU,YAAY,EAAE;AAC1D,QAAM,EAAE,aAAa,uBAAuB,IAAI,sBAAsB,QAAQ,UAAU,CAAC,CAAC;AAE1F,SAAO,aAAa,KAAK;AAAA,IACvB,eAAe,YAAY;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,WAAW,YAAY,KAAK;AAAA,EACzC,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAY,MAAM,cAAc,GAAG;AACzC,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,aAAa,sBAAsB,UAAU,OAAO;AAC1D,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,SAAS,WAAW,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzH;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACA,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,WAAW;AAAA,IAC5B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,EACvI;AAEA,MAAI,cAAc,WAAW;AAC7B,MAAI,YAAY,iBAAiB;AAC/B,UAAM,gBAAgB,EAAE,GAAG,WAAW,MAAM,GAAG,YAAY,gBAAgB;AAC3E,UAAM,WAAW,sBAAsB,UAAU,aAAa;AAC9D,QAAI,CAAC,SAAS,SAAS;AACrB,aAAO,aAAa,KAAK,EAAE,OAAO,qDAAqD,SAAS,SAAS,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7I;AACA,kBAAc,SAAS;AAAA,EACzB;AAEA,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,QAAQ,EAAE,gBAAgC,UAAU,KAAK,SAAS;AACxE,QAAM,SAAS,mBAAmB,UAAU,YAAY,EAAE;AAE1D,MAAI;AACF,UAAM,mBAAmB,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,KAAK;AACxF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,SAAS;AAAA,MACT,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,QAAM,wBAAwB;AAAA,IAC5B;AAAA,IACA,YAAY;AAAA,EACd;AACA,MAAI,OAAO,KAAK,qBAAqB,EAAE,SAAS,GAAG;AACjD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,+BAA+B,SAAS,EAAE,aAAa,sBAAsB,EAAE;AAAA,MACxF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI;AAIF,UAAM,WAAW,MAAM,mBAAmB,QAAQ,YAAY,IAAI,KAAK;AACvE,UAAM,oBAAoB,6BAA6B,QAAQ,YAAY,aAAa,YAAY,CAAC,CAAC;AACtG,UAAM,mBAAmB,KAAK,YAAY,IAAI,mBAAmB,KAAK;AAAA,EACxE,SAAS,OAAO;AACd,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,QAAM,sBAAsB,oCAAoC;AAAA,IAC9D,eAAe,YAAY;AAAA,IAC3B,UAAU,KAAK;AAAA,IACf;AAAA,IACA,QAAQ,KAAK;AAAA,EACf,CAAC;AAED,QAAM,wCAAwC,YAAY,uBAAuB;AAAA,IAC7E,UAAU,KAAK;AAAA,IACf;AAAA,IACA,QAAQ,KAAK,OAAO;AAAA,IACpB,cAAc;AAAA,IACd,YAAY,YAAY;AAAA,IACxB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AAEH,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { emitIntegrationsEvent } from '../../../events'\nimport { saveCredentialsSchema } from '../../../data/validators'\nimport {\n  isCredentialsEncryptionUnavailableError,\n  type CredentialsService,\n} from '../../../lib/credentials-service'\nimport { collectCredentialUrlValidationErrors } from '../../../lib/credentials-field-validation'\nimport {\n  maskSecretCredentials,\n  mergeMaskedSecretCredentials,\n} from '../../../lib/credentials-masking'\nimport {\n  resolveUserFeatures,\n  runIntegrationMutationGuardAfterSuccess,\n  runIntegrationMutationGuards,\n} from '../../guards'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\n\nconst idParamsSchema = z.object({ id: z.string().min(1) })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['integrations.credentials.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['integrations.credentials.manage'] },\n}\n\nexport const openApi = {\n  tags: ['Integrations'],\n  summary: 'Get or save integration credentials',\n}\n\nfunction resolveParams(ctx: { params?: Promise<{ id?: string }> | { id?: string } }): Promise<{ id?: string } | undefined> | { id?: string } | undefined {\n  if (!ctx.params) return undefined\n  if (typeof (ctx.params as Promise<unknown>).then === 'function') {\n    return ctx.params as Promise<{ id?: string }>\n  }\n  return ctx.params as { id?: string }\n}\n\nexport async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const rawParams = await resolveParams(ctx)\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const container = await createRequestContainer()\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const scope = { organizationId: organizationId, tenantId: auth.tenantId }\n\n  let values: Record<string, unknown> | null\n  let updatedAt: Date | null\n  try {\n    values = await credentialsService.resolve(integration.id, scope)\n    updatedAt = await credentialsService.resolveUpdatedAt(integration.id, scope)\n  } catch (error) {\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  const schema = credentialsService.getSchema(integration.id)\n  const { credentials, secretFieldsConfigured } = maskSecretCredentials(schema, values ?? {})\n\n  return NextResponse.json({\n    integrationId: integration.id,\n    schema,\n    credentials,\n    secretFieldsConfigured,\n    updatedAt: updatedAt?.toISOString() ?? null,\n  })\n}\n\nexport async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const rawParams = await resolveParams(ctx)\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const payload = await req.json().catch(() => null)\n  const parsedBody = saveCredentialsSchema.safeParse(payload)\n  if (!parsedBody.success) {\n    return NextResponse.json({ error: 'Invalid credentials payload', details: parsedBody.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const guardResult = await runIntegrationMutationGuards(\n    container,\n    {\n    tenantId: auth.tenantId,\n    organizationId,\n    userId: auth.sub ?? '',\n    resourceKind: 'integrations.integration',\n    resourceId: integration.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsedBody.data as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n  }\n\n  let payloadData = parsedBody.data\n  if (guardResult.modifiedPayload) {\n    const mergedPayload = { ...parsedBody.data, ...guardResult.modifiedPayload }\n    const reparsed = saveCredentialsSchema.safeParse(mergedPayload)\n    if (!reparsed.success) {\n      return NextResponse.json({ error: 'Invalid credentials payload after guard transform', details: reparsed.error.flatten() }, { status: 422 })\n    }\n    payloadData = reparsed.data\n  }\n\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const scope = { organizationId: organizationId, tenantId: auth.tenantId }\n  const schema = credentialsService.getSchema(integration.id)\n\n  try {\n    const currentUpdatedAt = await credentialsService.resolveUpdatedAt(integration.id, scope)\n    enforceCommandOptimisticLock({\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      current: currentUpdatedAt,\n      request: req,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  const credentialFieldErrors = collectCredentialUrlValidationErrors(\n    schema,\n    payloadData.credentials,\n  )\n  if (Object.keys(credentialFieldErrors).length > 0) {\n    return NextResponse.json(\n      { error: 'Invalid credentials payload', details: { fieldErrors: credentialFieldErrors } },\n      { status: 422 },\n    )\n  }\n\n  try {\n    const existing = await credentialsService.resolve(integration.id, scope)\n    const credentialsToSave = mergeMaskedSecretCredentials(\n      schema,\n      payloadData.credentials,\n      existing ?? {},\n      payloadData.unchangedSecretFields,\n    )\n    await credentialsService.save(integration.id, credentialsToSave, scope)\n  } catch (error) {\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  await emitIntegrationsEvent('integrations.credentials.updated', {\n    integrationId: integration.id,\n    tenantId: auth.tenantId,\n    organizationId,\n    userId: auth.sub,\n  })\n\n  await runIntegrationMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n\n  return NextResponse.json({ ok: true })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,oCAAoC;AAC7C,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,4CAA4C;AACrD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mCAAmC,mCAAmC;AAE/E,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAElD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AAAA,EAC/E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AACjF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,cAAc;AAAA,EACrB,SAAS;AACX;AAEA,SAAS,cAAc,KAAkI;AACvJ,MAAI,CAAC,IAAI,OAAQ,QAAO;AACxB,MAAI,OAAQ,IAAI,OAA4B,SAAS,YAAY;AAC/D,WAAO,IAAI;AAAA,EACb;AACA,SAAO,IAAI;AACb;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAY,MAAM,cAAc,GAAG;AACzC,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,QAAQ,EAAE,gBAAgC,UAAU,KAAK,SAAS;AAExE,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,mBAAmB,QAAQ,YAAY,IAAI,KAAK;AAC/D,gBAAY,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,KAAK;AAAA,EAC7E,SAAS,OAAO;AACd,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,QAAM,SAAS,mBAAmB,UAAU,YAAY,EAAE;AAC1D,QAAM,EAAE,aAAa,uBAAuB,IAAI,sBAAsB,QAAQ,UAAU,CAAC,CAAC;AAE1F,SAAO,aAAa,KAAK;AAAA,IACvB,eAAe,YAAY;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,WAAW,YAAY,KAAK;AAAA,EACzC,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAY,MAAM,cAAc,GAAG;AACzC,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,aAAa,sBAAsB,UAAU,OAAO;AAC1D,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,SAAS,WAAW,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzH;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACA,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,WAAW;AAAA,IAC5B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,EACvI;AAEA,MAAI,cAAc,WAAW;AAC7B,MAAI,YAAY,iBAAiB;AAC/B,UAAM,gBAAgB,EAAE,GAAG,WAAW,MAAM,GAAG,YAAY,gBAAgB;AAC3E,UAAM,WAAW,sBAAsB,UAAU,aAAa;AAC9D,QAAI,CAAC,SAAS,SAAS;AACrB,aAAO,aAAa,KAAK,EAAE,OAAO,qDAAqD,SAAS,SAAS,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7I;AACA,kBAAc,SAAS;AAAA,EACzB;AAEA,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,QAAQ,EAAE,gBAAgC,UAAU,KAAK,SAAS;AACxE,QAAM,SAAS,mBAAmB,UAAU,YAAY,EAAE;AAE1D,MAAI;AACF,UAAM,mBAAmB,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,KAAK;AACxF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,SAAS;AAAA,MACT,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,QAAM,wBAAwB;AAAA,IAC5B;AAAA,IACA,YAAY;AAAA,EACd;AACA,MAAI,OAAO,KAAK,qBAAqB,EAAE,SAAS,GAAG;AACjD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,+BAA+B,SAAS,EAAE,aAAa,sBAAsB,EAAE;AAAA,MACxF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,mBAAmB,QAAQ,YAAY,IAAI,KAAK;AACvE,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,YAAY;AAAA,MACZ,YAAY,CAAC;AAAA,MACb,YAAY;AAAA,IACd;AACA,UAAM,mBAAmB,KAAK,YAAY,IAAI,mBAAmB,KAAK;AAAA,EACxE,SAAS,OAAO;AACd,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,QAAM,sBAAsB,oCAAoC;AAAA,IAC9D,eAAe,YAAY;AAAA,IAC3B,UAAU,KAAK;AAAA,IACf;AAAA,IACA,QAAQ,KAAK;AAAA,EACf,CAAC;AAED,QAAM,wCAAwC,YAAY,uBAAuB;AAAA,IAC7E,UAAU,KAAK;AAAA,IACf;AAAA,IACA,QAAQ,KAAK,OAAO;AAAA,IACpB,cAAc;AAAA,IACd,YAAY,YAAY;AAAA,IACxB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AAEH,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;",
   "names": []
 }

package/dist/modules/integrations/backend/integrations/[id]/page.js

@@ -46,6 +46,10 @@ import {
   refreshIntegrationDetailPanels,
   refreshIntegrationRunActivityPanels
 } from "../detail-page-refresh.js";
+import {
+  buildCredentialEditValues,
+  buildIntegrationCredentialSavePayload
+} from "../credential-secret-fields.js";
 import { isValidCredentialUrl } from "../../../lib/credentials-field-validation.js";
 const UNSUPPORTED_CREDENTIAL_FIELD_TYPES = /* @__PURE__ */ new Set(["oauth", "ssh_keypair"]);
 function isEditableCredentialField(field) {
@@ -170,17 +174,22 @@ function resolvePathnameId(pathname) {
   if (!integrationId || integrationId === "integrations" || integrationId === "bundle") return void 0;
   return decodeURIComponent(integrationId);
 }
-function buildCredentialFields(credFields) {
+function buildCredentialFields(credFields, secretFieldsConfigured, t) {
   return credFields.map((field) => {
+    const baseDescription = field.helpDetails ? /* @__PURE__ */ jsxs("div", { className: "space-y-1", children: [
+      field.helpText ? /* @__PURE__ */ jsx("div", { children: field.helpText }) : null,
+      /* @__PURE__ */ jsx(WebhookSetupGuide, { guide: field.helpDetails })
+    ] }) : field.helpText;
+    const description = field.type === "secret" && secretFieldsConfigured[field.key] ? /* @__PURE__ */ jsxs("div", { className: "space-y-1", children: [
+      baseDescription ? /* @__PURE__ */ jsx("div", { children: baseDescription }) : null,
+      /* @__PURE__ */ jsx("p", { className: "text-xs text-muted-foreground", children: t("integrations.detail.credentials.secretConfigured") })
+    ] }) : baseDescription;
     const shared = {
       id: field.key,
       label: field.label,
-      description: field.helpDetails ? /* @__PURE__ */ jsxs("div", { className: "space-y-1", children: [
-        field.helpText ? /* @__PURE__ */ jsx("div", { children: field.helpText }) : null,
-        /* @__PURE__ */ jsx(WebhookSetupGuide, { guide: field.helpDetails, buttonLabel: "Show details" })
-      ] }) : field.helpText,
+      description,
       placeholder: field.placeholder,
-      required: field.required,
+      required: field.required && !(field.type === "secret" && secretFieldsConfigured[field.key]),
       visibleWhen: field.visibleWhen
     };
     if (field.type === "secret") {
@@ -194,7 +203,8 @@ function buildCredentialFields(credFields) {
             placeholder: field.placeholder,
             value: typeof value === "string" ? value : "",
             onChange: (event) => setValue(event.target.value),
-            disabled
+            disabled,
+            autoComplete: "new-password"
           }
         )
       };
@@ -280,6 +290,7 @@ function IntegrationDetailPage({ params }) {
   const [error, setError] = React.useState(null);
   const [isNotFound, setIsNotFound] = React.useState(false);
   const [credValues, setCredValues] = React.useState({});
+  const [secretFieldsConfigured, setSecretFieldsConfigured] = React.useState({});
   const [credentialsUpdatedAt, setCredentialsUpdatedAt] = React.useState(null);
   const [credentialsFormKey, setCredentialsFormKey] = React.useState(0);
   const [isSavingCredentials, setIsSavingCredentials] = React.useState(false);
@@ -341,6 +352,7 @@ function IntegrationDetailPage({ params }) {
     );
     if (call.ok && call.result) {
       setCredentialsUpdatedAt(call.result.updatedAt ?? null);
+      setSecretFieldsConfigured(call.result.secretFieldsConfigured ?? {});
     }
     if (call.ok && call.result?.credentials) {
       const next = { ...call.result.credentials };
@@ -546,34 +558,27 @@ function IntegrationDetailPage({ params }) {
     if (!currentIntegrationId) return;
     setIsSavingCredentials(true);
     try {
-      const sanitizedValues = { ...values };
-      if (currentIntegrationId === "storage_s3") {
-        const authMode = sanitizedValues.authMode;
-        if (authMode !== "access_keys" && authMode !== "ambient") {
-          const hasKeys = Boolean(sanitizedValues.accessKeyId || sanitizedValues.secretAccessKey);
-          sanitizedValues.authMode = hasKeys ? "access_keys" : "ambient";
-        }
-        if (sanitizedValues.authMode === "ambient") {
-          delete sanitizedValues.accessKeyId;
-          delete sanitizedValues.secretAccessKey;
-          delete sanitizedValues.sessionToken;
-        }
-      }
+      const credentialFields = detail?.integration.credentials?.fields ?? detail?.bundle?.credentials?.fields ?? [];
+      const savePayload = buildIntegrationCredentialSavePayload(
+        currentIntegrationId,
+        values,
+        credentialFields,
+        secretFieldsConfigured
+      );
       const call = await runMutationWithContext({
         actionId: "save-credentials",
         tabId: "credentials",
-        mutationPayload: { integrationId: currentIntegrationId, credentials: sanitizedValues },
+        mutationPayload: { integrationId: currentIntegrationId, ...savePayload },
         operation: () => withScopedApiRequestHeaders(
           buildOptimisticLockHeader(credentialsUpdatedAt),
           () => apiCall(`/api/integrations/${encodeURIComponent(currentIntegrationId)}/credentials`, {
             method: "PUT",
             headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ credentials: sanitizedValues })
+            body: JSON.stringify(savePayload)
           }, { fallback: null })
         )
       });
       if (call.ok) {
-        setCredValues(sanitizedValues);
         setCredentialsFormKey((current) => current + 1);
         flash(t("integrations.detail.credentials.saved"), "success");
         void loadCredentials();
@@ -586,7 +591,7 @@ function IntegrationDetailPage({ params }) {
     } finally {
       setIsSavingCredentials(false);
     }
-  }, [credentialsUpdatedAt, loadCredentials, resolveCurrentIntegrationId, runMutationWithContext, t]);
+  }, [credentialsUpdatedAt, detail, loadCredentials, resolveCurrentIntegrationId, runMutationWithContext, secretFieldsConfigured, t]);
   const handleVersionChange = React.useCallback(async (version) => {
     const currentIntegrationId = resolveCurrentIntegrationId();
     if (!currentIntegrationId) return;
@@ -661,8 +666,12 @@ function IntegrationDetailPage({ params }) {
     [detail?.bundle?.credentials?.fields, detail?.integration.credentials?.fields]
   );
   const credentialFormFields = React.useMemo(
-    () => buildCredentialFields(editableCredentialFields),
-    [editableCredentialFields]
+    () => buildCredentialFields(editableCredentialFields, secretFieldsConfigured, t),
+    [editableCredentialFields, secretFieldsConfigured, t]
+  );
+  const credentialFormValues = React.useMemo(
+    () => buildCredentialEditValues(credValues, secretFieldsConfigured),
+    [credValues, secretFieldsConfigured]
   );
   const credentialSchema = React.useMemo(() => z.object({}).passthrough().superRefine((rawValues, ctx) => {
     const values = rawValues;
@@ -698,7 +707,7 @@ function IntegrationDetailPage({ params }) {
         return;
       }
       const normalizedValue = typeof value === "string" ? value : "";
-      if (field.required && normalizedValue.trim().length === 0) {
+      if (field.required && normalizedValue.trim().length === 0 && !(field.type === "secret" && secretFieldsConfigured[field.key])) {
         ctx.addIssue({
           code: z.ZodIssueCode.custom,
           path: [field.key],
@@ -727,7 +736,7 @@ function IntegrationDetailPage({ params }) {
         });
       }
     });
-  }), [editableCredentialFields, t]);
+  }), [editableCredentialFields, secretFieldsConfigured, t]);
   const latestHealthLog = React.useMemo(() => logs.find(isHealthLog) ?? null, [logs]);
   const latestOperationalLog = React.useMemo(
     () => logs.find((log) => typeof log.payload?.operationalStatus === "string" || typeof log.payload?.summary === "string") ?? null,
@@ -939,7 +948,7 @@ function IntegrationDetailPage({ params }) {
             entityId: "integrations.integration",
             schema: credentialSchema,
             fields: credentialFormFields,
-            initialValues: credValues,
+            initialValues: credentialFormValues,
             onSubmit: handleSaveCredentials,
             embedded: true,
             hideFooterActions: true