fix(sso): show the saved client secret as a masked fact with an explicit Replace action

[waleedlatif1]

Summary

• The Client Secret field showed the literal string [REDACTED]. It now renders empty with a •••••••••••• placeholder, and says a secret is saved
• Leaving the field blank on an edit keeps the stored secret; typing replaces it
• Blank no longer fails validation when a secret is already stored

The API deliberately never returns the secret: GET /api/auth/sso/providers substitutes REDACTED_MARKER, and the register route treats that same sentinel on the way back in as "keep what is stored". That contract is correct and is unchanged here — the bug was purely that the client dropped the sentinel straight into a visible input, so the field read [REDACTED] and an admin re-saving had no way to tell whether their secret was intact.

Note on the eye toggle: it reveals what the admin types, not the stored secret. Revealing the saved value would require sending it to the browser, which is exactly what the obfuscation work removed — so it is deliberately not done here.

Type of Change

• Bug fix

Testing

Typecheck, lint, and bunx vitest run app/api/auth/sso app/api/organizations (106 passed) all clean. The SSO settings form has no test suite; this change is UI-only and needs a visual check against a configured OIDC provider.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 6, 2026 9:25am

[cursor]

PR Summary

Medium Risk
Touches SSO credential handling and register/update payloads; behavior is constrained by existing sentinel contract but wrong client logic could still corrupt stored secrets.

Overview
Fixes SSO OIDC settings where editing showed the literal [REDACTED] sentinel in the Client Secret field and made it unclear whether a saved secret would survive an update.

API: GET /api/auth/sso/providers still redacts clientSecret but now may attach clientSecretHint (last four characters when the stored secret is long enough that the hint is not a meaningful leak).

UI: A new ClientSecretField shows a fixed-width masked row (optional suffix from the hint), Replace / Keep saved flows, validation that skips “required” while keeping the stored secret, and submit logic that sends REDACTED_MARKER when the admin saves without replacing—trimming typed values and rejecting whitespace-only replacements.

Tests: sso-settings.test.tsx adds coverage for hint display, sentinel preservation on update, replace flow, validation, and backing out of replace.

^{Reviewed by Cursor Bugbot for commit 707c675. Configure here.}

[greptile-apps]

Greptile Summary

The PR changes stored OIDC client secrets from visible sentinel values to masked, explicitly replaceable UI state while preserving unchanged secrets during edits.

• Adds a display-only suffix hint to the redacted provider response.
• Adds explicit Replace and Keep saved interactions with replacement validation.
• Adds component coverage for preservation, replacement, masking, and replacement cancellation.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/app/api/auth/sso/providers/route.ts	Adds a length-gated, four-character display hint while continuing to redact the stored client secret.
apps/sim/ee/sso/components/sso-settings.tsx	Implements masked saved-secret state, explicit replacement, required replacement validation, and sentinel-based preservation.
apps/sim/ee/sso/components/sso-settings.test.tsx	Adds regression coverage for the saved-secret UI and submission paths.

_{Reviews (5): Last reviewed commit: "fix(sso): clear the required-error when ..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 707c675. Configure here.}