@open-mercato/core 0.7.0 → 0.7.1-develop.7102.1.b41f7e3e51

package/src/modules/integrations/backend/integrations/[id]/page.tsx

@@ -52,6 +52,11 @@ import {
   refreshIntegrationDetailPanels,
   refreshIntegrationRunActivityPanels,
 } from '../detail-page-refresh'
+import {
+  buildCredentialEditValues,
+  buildIntegrationCredentialSavePayload,
+  type SecretFieldsConfigured,
+} from '../credential-secret-fields'
 import { isValidCredentialUrl } from '../../../lib/credentials-field-validation'
 
 type CredentialField = IntegrationCredentialField
@@ -290,19 +295,32 @@ function resolvePathnameId(pathname: string): string | undefined {
   return decodeURIComponent(integrationId)
 }
 
-function buildCredentialFields(credFields: CredentialField[]): CrudField[] {
+function buildCredentialFields(
+  credFields: CredentialField[],
+  secretFieldsConfigured: SecretFieldsConfigured,
+  t: ReturnType<typeof useT>,
+): CrudField[] {
   return credFields.map((field) => {
+    const baseDescription = field.helpDetails ? (
+      <div className="space-y-1">
+        {field.helpText ? <div>{field.helpText}</div> : null}
+        <WebhookSetupGuide guide={field.helpDetails} />
+      </div>
+    ) : field.helpText
+    const description = field.type === 'secret' && secretFieldsConfigured[field.key] ? (
+      <div className="space-y-1">
+        {baseDescription ? <div>{baseDescription}</div> : null}
+        <p className="text-xs text-muted-foreground">
+          {t('integrations.detail.credentials.secretConfigured')}
+        </p>
+      </div>
+    ) : baseDescription
     const shared = {
       id: field.key,
       label: field.label,
-      description: field.helpDetails ? (
-        <div className="space-y-1">
-          {field.helpText ? <div>{field.helpText}</div> : null}
-          <WebhookSetupGuide guide={field.helpDetails} buttonLabel="Show details" />
-        </div>
-      ) : field.helpText,
+      description,
       placeholder: field.placeholder,
-      required: field.required,
+      required: field.required && !(field.type === 'secret' && secretFieldsConfigured[field.key]),
       visibleWhen: field.visibleWhen,
     }
 
@@ -317,6 +335,7 @@ function buildCredentialFields(credFields: CredentialField[]): CrudField[] {
             value={typeof value === 'string' ? value : ''}
             onChange={(event) => setValue(event.target.value)}
             disabled={disabled}
+            autoComplete="new-password"
           />
         ),
       }
@@ -426,6 +445,7 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
   const [isNotFound, setIsNotFound] = React.useState(false)
 
   const [credValues, setCredValues] = React.useState<Record<string, unknown>>({})
+  const [secretFieldsConfigured, setSecretFieldsConfigured] = React.useState<SecretFieldsConfigured>({})
   const [credentialsUpdatedAt, setCredentialsUpdatedAt] = React.useState<string | null>(null)
   const [credentialsFormKey, setCredentialsFormKey] = React.useState(0)
   const [isSavingCredentials, setIsSavingCredentials] = React.useState(false)
@@ -490,13 +510,18 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
   const loadCredentials = React.useCallback(async () => {
     const currentIntegrationId = resolveCurrentIntegrationId()
     if (!currentIntegrationId) return
-    const call = await apiCall<{ credentials: Record<string, unknown>; updatedAt?: string | null }>(
+    const call = await apiCall<{
+      credentials: Record<string, unknown>
+      secretFieldsConfigured?: SecretFieldsConfigured
+      updatedAt?: string | null
+    }>(
       `/api/integrations/${encodeURIComponent(currentIntegrationId)}/credentials`,
       undefined,
       { fallback: null },
     )
     if (call.ok && call.result) {
       setCredentialsUpdatedAt(call.result.updatedAt ?? null)
+      setSecretFieldsConfigured(call.result.secretFieldsConfigured ?? {})
     }
     if (call.ok && call.result?.credentials) {
       const next = { ...call.result.credentials }
@@ -713,35 +738,32 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
     if (!currentIntegrationId) return
     setIsSavingCredentials(true)
     try {
-      const sanitizedValues = { ...values }
-      if (currentIntegrationId === 'storage_s3') {
-        const authMode = sanitizedValues.authMode
-        if (authMode !== 'access_keys' && authMode !== 'ambient') {
-          const hasKeys = Boolean(sanitizedValues.accessKeyId || sanitizedValues.secretAccessKey)
-          sanitizedValues.authMode = hasKeys ? 'access_keys' : 'ambient'
-        }
-        if (sanitizedValues.authMode === 'ambient') {
-          delete sanitizedValues.accessKeyId
-          delete sanitizedValues.secretAccessKey
-          delete sanitizedValues.sessionToken
-        }
-      }
+      const credentialFields = (
+        detail?.integration.credentials?.fields
+        ?? detail?.bundle?.credentials?.fields
+        ?? []
+      )
+      const savePayload = buildIntegrationCredentialSavePayload(
+        currentIntegrationId,
+        values,
+        credentialFields,
+        secretFieldsConfigured,
+      )
       const call = await runMutationWithContext({
         actionId: 'save-credentials',
         tabId: 'credentials',
-        mutationPayload: { integrationId: currentIntegrationId, credentials: sanitizedValues },
+        mutationPayload: { integrationId: currentIntegrationId, ...savePayload },
         operation: () => withScopedApiRequestHeaders(
           buildOptimisticLockHeader(credentialsUpdatedAt),
           () => apiCall(`/api/integrations/${encodeURIComponent(currentIntegrationId)}/credentials`, {
             method: 'PUT',
             headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ credentials: sanitizedValues }),
+            body: JSON.stringify(savePayload),
           }, { fallback: null }),
         ),
       })
 
       if (call.ok) {
-        setCredValues(sanitizedValues)
         setCredentialsFormKey((current) => current + 1)
         flash(t('integrations.detail.credentials.saved'), 'success')
         void loadCredentials()
@@ -759,7 +781,7 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
     } finally {
       setIsSavingCredentials(false)
     }
-  }, [credentialsUpdatedAt, loadCredentials, resolveCurrentIntegrationId, runMutationWithContext, t])
+  }, [credentialsUpdatedAt, detail, loadCredentials, resolveCurrentIntegrationId, runMutationWithContext, secretFieldsConfigured, t])
 
   const handleVersionChange = React.useCallback(async (version: string) => {
     const currentIntegrationId = resolveCurrentIntegrationId()
@@ -837,8 +859,12 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
     [detail?.bundle?.credentials?.fields, detail?.integration.credentials?.fields],
   )
   const credentialFormFields = React.useMemo(
-    () => buildCredentialFields(editableCredentialFields),
-    [editableCredentialFields],
+    () => buildCredentialFields(editableCredentialFields, secretFieldsConfigured, t),
+    [editableCredentialFields, secretFieldsConfigured, t],
+  )
+  const credentialFormValues = React.useMemo(
+    () => buildCredentialEditValues(credValues, secretFieldsConfigured),
+    [credValues, secretFieldsConfigured],
   )
   const credentialSchema = React.useMemo(() => (
     z.object({}).passthrough().superRefine((rawValues, ctx) => {
@@ -880,7 +906,11 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
 
         const normalizedValue = typeof value === 'string' ? value : ''
 
-        if (field.required && normalizedValue.trim().length === 0) {
+        if (
+          field.required
+          && normalizedValue.trim().length === 0
+          && !(field.type === 'secret' && secretFieldsConfigured[field.key])
+        ) {
           ctx.addIssue({
             code: z.ZodIssueCode.custom,
             path: [field.key],
@@ -922,7 +952,7 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
         }
       })
     })
-  ) as z.ZodType<Record<string, unknown>>, [editableCredentialFields, t])
+  ) as z.ZodType<Record<string, unknown>>, [editableCredentialFields, secretFieldsConfigured, t])
   const latestHealthLog = React.useMemo(() => logs.find(isHealthLog) ?? null, [logs])
   const latestOperationalLog = React.useMemo(
     () => logs.find((log) => (
@@ -1257,7 +1287,7 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
                     entityId="integrations.integration"
                     schema={credentialSchema}
                     fields={credentialFormFields}
-                    initialValues={credValues}
+                    initialValues={credentialFormValues}
                     onSubmit={handleSaveCredentials}
                     embedded
                     hideFooterActions

package/src/modules/integrations/backend/integrations/bundle/[id]/page.tsx

@@ -8,6 +8,7 @@ import { Badge } from '@open-mercato/ui/primitives/badge'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Switch } from '@open-mercato/ui/primitives/switch'
 import { Input } from '@open-mercato/ui/primitives/input'
+import { PasswordInput } from '@open-mercato/ui/primitives/password-input'
 import {
   Select,
   SelectContent,
@@ -23,6 +24,11 @@ import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import type { CredentialFieldType, IntegrationCredentialField } from '@open-mercato/shared/modules/integrations/types'
 import { LoadingMessage, ErrorMessage, RecordNotFoundState } from '@open-mercato/ui/backend/detail'
+import {
+  buildCredentialEditValues,
+  buildCredentialSavePayload,
+  type SecretFieldsConfigured,
+} from '../../credential-secret-fields'
 
 type CredentialField = IntegrationCredentialField
 
@@ -88,6 +94,7 @@ export default function BundleConfigPage({ params }: BundleConfigPageProps) {
   const [error, setError] = React.useState<string | null>(null)
   const [isNotFound, setIsNotFound] = React.useState(false)
   const [credValues, setCredValues] = React.useState<Record<string, unknown>>({})
+  const [secretFieldsConfigured, setSecretFieldsConfigured] = React.useState<SecretFieldsConfigured>({})
   const [credentialsUpdatedAt, setCredentialsUpdatedAt] = React.useState<string | null>(null)
   const [isSavingCreds, setIsSavingCreds] = React.useState(false)
   const [togglingIds, setTogglingIds] = React.useState<Set<string>>(new Set())
@@ -134,13 +141,18 @@ export default function BundleConfigPage({ params }: BundleConfigPageProps) {
     }
     setDetail(call.result)
 
-    const credCall = await apiCall<{ credentials: Record<string, unknown>; updatedAt?: string | null }>(
+    const credCall = await apiCall<{
+      credentials: Record<string, unknown>
+      secretFieldsConfigured?: SecretFieldsConfigured
+      updatedAt?: string | null
+    }>(
       `/api/integrations/${encodeURIComponent(currentBundleId)}/credentials`,
       undefined,
       { fallback: null },
     )
     if (credCall.ok && credCall.result) {
       setCredentialsUpdatedAt(credCall.result.updatedAt ?? null)
+      setSecretFieldsConfigured(credCall.result.secretFieldsConfigured ?? {})
     }
     if (credCall.ok && credCall.result?.credentials) {
       const next = { ...credCall.result.credentials }
@@ -151,7 +163,10 @@ export default function BundleConfigPage({ params }: BundleConfigPageProps) {
           next.authMode = hasKeys ? 'access_keys' : 'ambient'
         }
       }
-      setCredValues(next)
+      setCredValues(buildCredentialEditValues(
+        next,
+        credCall.result.secretFieldsConfigured ?? {},
+      ))
     }
     setIsLoading(false)
   }, [resolveCurrentBundleId, t])
@@ -163,8 +178,13 @@ export default function BundleConfigPage({ params }: BundleConfigPageProps) {
     if (!currentBundleId) return
     setIsSavingCreds(true)
     try {
+      const savePayload = buildCredentialSavePayload(
+        credValues,
+        detail?.bundle?.credentials?.fields ?? [],
+        secretFieldsConfigured,
+      )
       const call = await runMutation({
-        mutationPayload: { bundleId: currentBundleId, credentials: credValues },
+        mutationPayload: { bundleId: currentBundleId, ...savePayload },
         context: {
           formId: mutationContextId,
           operation: 'update',
@@ -179,7 +199,7 @@ export default function BundleConfigPage({ params }: BundleConfigPageProps) {
           () => apiCall(`/api/integrations/${encodeURIComponent(currentBundleId)}/credentials`, {
             method: 'PUT',
             headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ credentials: credValues }),
+            body: JSON.stringify(savePayload),
           }, { fallback: null }),
         ),
       })
@@ -194,7 +214,7 @@ export default function BundleConfigPage({ params }: BundleConfigPageProps) {
     } finally {
       setIsSavingCreds(false)
     }
-  }, [resolveCurrentBundleId, runMutation, mutationContextId, retryLastMutation, credValues, credentialsUpdatedAt, load, t])
+  }, [resolveCurrentBundleId, runMutation, mutationContextId, retryLastMutation, credValues, credentialsUpdatedAt, detail?.bundle?.credentials?.fields, load, secretFieldsConfigured, t])
 
   const handleToggle = React.useCallback(async (integrationId: string, enabled: boolean, updatedAt?: string | null) => {
     setTogglingIds((prev) => new Set(prev).add(integrationId))
@@ -295,15 +315,15 @@ export default function BundleConfigPage({ params }: BundleConfigPageProps) {
             <CardContent className="space-y-4">
               {credFields.filter(isFieldVisible).map((field) => (
                 <div key={field.key} className="space-y-1.5">
-                  <label className="text-sm font-medium">
-                    {field.label}{field.required && <span className="text-red-500 ml-0.5">*</span>}
+                  <label htmlFor={`bundle-credential-${field.key}`} className="text-sm font-medium">
+                    {field.label}{field.required && <span className="ml-0.5 text-destructive">*</span>}
                   </label>
                   {field.type === 'select' && field.options ? (
                     <Select
                       value={(credValues[field.key] as string) || undefined}
                       onValueChange={(value) => setCredValues((prev) => ({ ...prev, [field.key]: value ?? '' }))}
                     >
-                      <SelectTrigger>
+                      <SelectTrigger id={`bundle-credential-${field.key}`}>
                         <SelectValue placeholder="—" />
                       </SelectTrigger>
                       <SelectContent>
@@ -314,17 +334,32 @@ export default function BundleConfigPage({ params }: BundleConfigPageProps) {
                     </Select>
                   ) : field.type === 'boolean' ? (
                     <Switch
+                      id={`bundle-credential-${field.key}`}
                       checked={Boolean(credValues[field.key])}
                       onCheckedChange={(checked) => setCredValues((prev) => ({ ...prev, [field.key]: checked }))}
                     />
+                  ) : field.type === 'secret' ? (
+                    <PasswordInput
+                      id={`bundle-credential-${field.key}`}
+                      placeholder={field.placeholder}
+                      value={(credValues[field.key] as string) ?? ''}
+                      onChange={(event) => setCredValues((prev) => ({ ...prev, [field.key]: event.target.value }))}
+                      autoComplete="new-password"
+                    />
                   ) : (
                     <Input
-                      type={field.type === 'secret' ? 'password' : 'text'}
+                      id={`bundle-credential-${field.key}`}
+                      type="text"
                       placeholder={field.placeholder}
                       value={(credValues[field.key] as string) ?? ''}
                       onChange={(e) => setCredValues((prev) => ({ ...prev, [field.key]: e.target.value }))}
                     />
                   )}
+                  {field.type === 'secret' && secretFieldsConfigured[field.key] ? (
+                    <p className="text-xs text-muted-foreground">
+                      {t('integrations.detail.credentials.secretConfigured')}
+                    </p>
+                  ) : null}
                 </div>
               ))}
               <Button type="button" onClick={() => void handleSaveCredentials()} disabled={isSavingCreds}>

package/src/modules/integrations/backend/integrations/credential-secret-fields.ts

@@ -0,0 +1,84 @@
+import type { IntegrationCredentialField } from '@open-mercato/shared/modules/integrations/types'
+import { SECRET_CREDENTIAL_FIELD_TYPES } from '../../lib/credentials-masking'
+
+export type SecretFieldsConfigured = Record<string, boolean>
+
+export type CredentialSavePayload = {
+  credentials: Record<string, unknown>
+  unchangedSecretFields?: string[]
+}
+
+export function buildCredentialEditValues(
+  credentials: Record<string, unknown>,
+  secretFieldsConfigured: SecretFieldsConfigured,
+): Record<string, unknown> {
+  const editValues = { ...credentials }
+
+  for (const [fieldKey, configured] of Object.entries(secretFieldsConfigured)) {
+    if (configured) delete editValues[fieldKey]
+  }
+
+  return editValues
+}
+
+export function buildCredentialSavePayload(
+  values: Record<string, unknown>,
+  fields: readonly IntegrationCredentialField[],
+  secretFieldsConfigured: SecretFieldsConfigured,
+  deliberatelyClearedSecretFields: ReadonlySet<string> = new Set(),
+): CredentialSavePayload {
+  const credentials = { ...values }
+  const unchangedSecretFields = new Set<string>()
+
+  for (const field of fields) {
+    if (!SECRET_CREDENTIAL_FIELD_TYPES.has(field.type)) continue
+
+    if (deliberatelyClearedSecretFields.has(field.key)) {
+      delete credentials[field.key]
+      continue
+    }
+
+    if (!secretFieldsConfigured[field.key]) continue
+    const value = credentials[field.key]
+    if (value !== undefined && value !== '') continue
+
+    delete credentials[field.key]
+    unchangedSecretFields.add(field.key)
+  }
+
+  return unchangedSecretFields.size > 0
+    ? { credentials, unchangedSecretFields: [...unchangedSecretFields] }
+    : { credentials }
+}
+
+export function buildIntegrationCredentialSavePayload(
+  integrationId: string,
+  values: Record<string, unknown>,
+  fields: readonly IntegrationCredentialField[],
+  secretFieldsConfigured: SecretFieldsConfigured,
+): CredentialSavePayload {
+  const normalizedValues = { ...values }
+  const deliberatelyClearedSecretFields = new Set<string>()
+
+  if (integrationId === 'storage_s3') {
+    const authMode = normalizedValues.authMode
+    if (authMode !== 'access_keys' && authMode !== 'ambient') {
+      const hasKeys = Boolean(normalizedValues.accessKeyId || normalizedValues.secretAccessKey)
+      normalizedValues.authMode = hasKeys ? 'access_keys' : 'ambient'
+    }
+    if (normalizedValues.authMode === 'ambient') {
+      delete normalizedValues.accessKeyId
+      delete normalizedValues.secretAccessKey
+      delete normalizedValues.sessionToken
+      deliberatelyClearedSecretFields.add('secretAccessKey')
+      deliberatelyClearedSecretFields.add('sessionToken')
+    }
+  }
+
+  return buildCredentialSavePayload(
+    normalizedValues,
+    fields,
+    secretFieldsConfigured,
+    deliberatelyClearedSecretFields,
+  )
+}

package/src/modules/integrations/data/validators.ts

@@ -1,13 +1,23 @@
 import { z } from 'zod'
 
+const credentialFieldKeySchema = z.string().min(1).max(128)
+
 export const saveCredentialsSchema = z.object({
   credentials: z.record(
-    z.string().min(1).max(128),
+    credentialFieldKeySchema,
     z.union([z.string().max(20_000), z.number(), z.boolean(), z.null()]),
   ),
+  unchangedSecretFields: z.array(credentialFieldKeySchema).max(200).optional(),
 }).refine((value) => Object.keys(value.credentials).length <= 200, {
   message: 'At most 200 credential fields are allowed',
-})
+}).refine(
+  (value) => !value.unchangedSecretFields
+    || new Set(value.unchangedSecretFields).size === value.unchangedSecretFields.length,
+  {
+    message: 'Unchanged secret field names must be unique',
+    path: ['unchangedSecretFields'],
+  },
+)
 
 export type SaveCredentialsInput = z.infer<typeof saveCredentialsSchema>
 

package/src/modules/integrations/i18n/de.json

@@ -15,6 +15,7 @@
   "integrations.detail.credentials.save": "Zugangsdaten speichern",
   "integrations.detail.credentials.saveError": "Zugangsdaten konnten nicht gespeichert werden",
   "integrations.detail.credentials.saved": "Zugangsdaten gespeichert",
+  "integrations.detail.credentials.secretConfigured": "Konfiguriert. Geben Sie einen neuen Wert ein, um ihn zu ersetzen.",
   "integrations.detail.credentials.validation.boolean": "Select a valid value.",
   "integrations.detail.credentials.validation.option": "Select one of the available options.",
   "integrations.detail.credentials.validation.required": "{field} is required.",

package/src/modules/integrations/i18n/en.json

@@ -15,6 +15,7 @@
   "integrations.detail.credentials.save": "Save Credentials",
   "integrations.detail.credentials.saveError": "Failed to save credentials",
   "integrations.detail.credentials.saved": "Credentials saved",
+  "integrations.detail.credentials.secretConfigured": "Configured. Enter a new value to replace it.",
   "integrations.detail.credentials.validation.boolean": "Select a valid value.",
   "integrations.detail.credentials.validation.option": "Select one of the available options.",
   "integrations.detail.credentials.validation.required": "{field} is required.",

package/src/modules/integrations/i18n/es.json

@@ -15,6 +15,7 @@
   "integrations.detail.credentials.save": "Guardar credenciales",
   "integrations.detail.credentials.saveError": "No se pudieron guardar las credenciales",
   "integrations.detail.credentials.saved": "Credenciales guardadas",
+  "integrations.detail.credentials.secretConfigured": "Configurado. Introduce un valor nuevo para reemplazarlo.",
   "integrations.detail.credentials.validation.boolean": "Select a valid value.",
   "integrations.detail.credentials.validation.option": "Select one of the available options.",
   "integrations.detail.credentials.validation.required": "{field} is required.",

package/src/modules/integrations/i18n/ko.json

@@ -15,6 +15,7 @@
   "integrations.detail.credentials.save": "자격 증명 저장",
   "integrations.detail.credentials.saveError": "자격 증명 저장에 실패했습니다",
   "integrations.detail.credentials.saved": "자격 증명이 저장되었습니다",
+  "integrations.detail.credentials.secretConfigured": "구성됨. 바꾸려면 새 값을 입력하세요.",
   "integrations.detail.credentials.validation.boolean": "유효한 값을 선택하세요.",
   "integrations.detail.credentials.validation.option": "사용 가능한 옵션 중 하나를 선택하세요.",
   "integrations.detail.credentials.validation.required": "{field}은(는) 필수입니다.",

package/src/modules/integrations/i18n/pl.json

@@ -15,6 +15,7 @@
   "integrations.detail.credentials.save": "Zapisz dane",
   "integrations.detail.credentials.saveError": "Nie udało się zapisać danych",
   "integrations.detail.credentials.saved": "Dane zapisane",
+  "integrations.detail.credentials.secretConfigured": "Skonfigurowano. Wpisz nową wartość, aby ją zastąpić.",
   "integrations.detail.credentials.validation.boolean": "Select a valid value.",
   "integrations.detail.credentials.validation.option": "Select one of the available options.",
   "integrations.detail.credentials.validation.required": "{field} is required.",

package/src/modules/integrations/lib/credentials-masking.ts

@@ -84,22 +84,26 @@ export function maskSecretCredentials(
 }
 
 /**
- * Reverse of {@link maskSecretCredentials} for the save path. When the client
- * submits the mask sentinel for a secret field it means "leave it unchanged":
- * restore the existing stored secret, or drop the field entirely when nothing
- * was previously stored (so the literal sentinel is never persisted). Any other
- * value (including an empty string, which clears the secret) is written as-is.
+ * Reverse of {@link maskSecretCredentials} for the save path. The exact mask
+ * sentinel and explicitly listed omitted secret fields mean "leave unchanged".
+ * Explicit values win over the list, including an empty string used to clear a
+ * secret, while plain omission retains the full-replacement contract.
  */
 export function mergeMaskedSecretCredentials(
   schema: IntegrationCredentialsSchema | undefined,
   incoming: Record<string, unknown>,
   existing: Record<string, unknown>,
+  unchangedSecretFields: readonly string[] = [],
 ): Record<string, unknown> {
   const merged: Record<string, unknown> = { ...incoming }
+  const unchangedSecretFieldSet = new Set(unchangedSecretFields)
 
   for (const field of schema?.fields ?? []) {
     if (!isSecretField(field.type)) continue
-    if (merged[field.key] !== MASKED_SECRET_VALUE) continue
+    const hasIncomingValue = Object.prototype.hasOwnProperty.call(merged, field.key)
+    const submittedMask = merged[field.key] === MASKED_SECRET_VALUE
+    const explicitlyUnchanged = !hasIncomingValue && unchangedSecretFieldSet.has(field.key)
+    if (!submittedMask && !explicitlyUnchanged) continue
 
     if (hasPresentValue(existing[field.key])) {
       merged[field.key] = existing[field.key]

package/src/modules/messages/api/[id]/route.ts

@@ -2,6 +2,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { applyResponseEnricherToRecord } from '@open-mercato/shared/lib/crud/enricher-runner'
 import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { User } from '../../../auth/data/entities'
@@ -38,6 +39,36 @@ type MessageObjectPreviewPayload = {
   metadata?: Record<string, string>
 } | null
 
+type RbacServiceLike = {
+  getGrantedFeatures?: (
+    userId: string,
+    scope: { tenantId: string | null; organizationId: string | null },
+  ) => Promise<string[]>
+}
+
+/**
+ * Feature list for the enricher ACL gate, resolved from RBAC.
+ *
+ * Mirrors `customers/api/interactions/route.ts`. Returning `undefined` on
+ * failure is deliberate — the runner then treats every feature-gated enricher
+ * as denied, which is the safe direction.
+ */
+async function resolveGrantedFeatures(
+  container: { resolve: (name: string) => unknown },
+  scope: { tenantId: string; organizationId: string | null; userId: string },
+): Promise<string[] | undefined> {
+  try {
+    const rbac = container.resolve('rbacService') as RbacServiceLike | undefined
+    if (!rbac?.getGrantedFeatures) return undefined
+    return await rbac.getGrantedFeatures(scope.userId, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+    })
+  } catch {
+    return undefined
+  }
+}
+
 export async function GET(req: Request, { params }: { params: { id: string } }) {
   const { ctx, scope } = await resolveMessageContext(req)
   const em = ctx.container.resolve('em') as EntityManager
@@ -190,7 +221,7 @@ export async function GET(req: Request, { params }: { params: { id: string } })
     })
   }
 
-  return Response.json({
+  const detail: Record<string, unknown> = {
     id: message.id,
     updatedAt: message.updatedAt ?? null,
     type: message.type,
@@ -257,6 +288,9 @@ export async function GET(req: Request, { params }: { params: { id: string } })
         senderUserId: threadMessage.senderUserId,
         senderName: threadSenderName,
         senderEmail: sender?.email ?? null,
+        externalName: threadMessage.externalName ?? null,
+        externalEmail: threadMessage.externalEmail ?? null,
+        sourceEntityType: threadMessage.sourceEntityType ?? null,
         body: threadMessage.body,
         bodyFormat: threadMessage.bodyFormat,
         sentAt: threadMessage.sentAt,
@@ -265,7 +299,27 @@ export async function GET(req: Request, { params }: { params: { id: string } })
     isRead: recipient ? (autoMarkRead || recipient.status !== 'unread') : true,
     conversationArchived,
     conversationAllUnread,
+  }
+
+  // Mirrors `enrichSingleRecord` in `shared/lib/crud/factory.ts`, which every
+  // `makeCrudRoute` host gets for free: same `_meta` envelope, and no blanket
+  // catch so a `critical: true` enricher still surfaces as an HTTP error.
+  // Non-critical failures never escape the runner — it merges `fallback` and
+  // records the id in `_meta.enricherErrors`.
+  const enriched = await applyResponseEnricherToRecord(detail, 'messages.message', {
+    organizationId: scope.organizationId ?? '',
+    tenantId: scope.tenantId,
+    userId: scope.userId,
+    em,
+    container: ctx.container,
+    userFeatures: await resolveGrantedFeatures(ctx.container, scope),
   })
+
+  if (enriched._meta.enrichedBy.length > 0 || enriched._meta.enricherErrors?.length) {
+    return Response.json({ ...enriched.record, _meta: enriched._meta })
+  }
+
+  return Response.json(enriched.record)
 }
 
 export async function PATCH(req: Request, { params }: { params: { id: string } }) {