stacklok / toolhive-studio / 23748251730

60%

push

github

fix(remote-auth): re-saving server config corrupts client_secret on OAuth servers (#1860)

* fix(remote-auth): use secret name field to identify existing secrets on re-save
When loading an existing remote server for editing, convertCreateRequestToFormData
was using client_secret.target (e.g. "oauth_secret") to both populate value.secret
and check isFromStore. Since target is a config property name — not a secret store
key — the check always returned false, so every re-save treated the existing secret
as new plaintext. A duplicate was created with the wrong value and a collision
suffix (_2), and both name and target were set to this new key.
Fix: use client_secret.name (the actual store key) for both value.secret and
the isFromStore check. Same fix applied to bearer_token.
Closes #1821

* test(e2e): add remote server re-save regression spec

* refactor: remove unneeded fields on test overried

2974 of 5202 branches covered (57.17%)

Branch coverage included in aggregate %.

4855 of 7763 relevant lines covered (62.54%)

126.23 hits per line