feat(link): hide secret shared_credentials fields from the link form (PLEN-2392)

@zen-agentchecks n/achecks…zen/shared-params-hide-secret-fields-zfw7f0 → main1 files · +18 −13updated 1mo ago

▸Description · 4 noise

Description

Linear: PLEN-2392 — Shared Params, pre-fill params for end users

Closes gap #3 from the Shared Params PLEN-2392 plan. The backend (ComposioHQ/hermes#9911) now sends:

is_secret: true | false per field (sourced from Mercury's config.ts).
is_available_as_shared_credentials: true when an auth config covers the field via shared_credentials.
default: \"<value>\" populated for non-secret fields with a shared value.

FormInputScreen already uses field.default for defaultValues, so non-secret shared fields auto-pre-fill once the matching Apollo change lands (gap #2 falls out for free).

This PR handles secret fields. When a field is both is_available_as_shared_credentials AND is_secret, the developer has already supplied the value via shared_credentials and the backend will merge it into the connected account during link submit. The user should not see (and never types) the secret — filter the field out of the form entirely.

How did I test this PR

pnpm lint — no new warnings on the touched file (1 pre-existing unused-arg warning unaffected by this diff).
pnpm build (with OPENAPI_URL pointing at local Apollo carrying the matching backend change) — ✓ Compiled successfully. The remaining build error during page-data collection is pre-existing on main and unrelated to this change.
End-to-end against local Apollo with a Shopify API_KEY auth_config carrying shared_credentials: { subdomain: \"acme-test\", generic_api_key: \"shppa_test_key_123\" }. Backend returns:
- subdomain → default: \"acme-test\", is_secret: false, is_available_as_shared_credentials: true → form auto-pre-fills (user can override).
- generic_api_key → is_secret: true, is_available_as_shared_credentials: true, no default → filtered out of the rendered fields by this PR.

Triggered by: palash@composio.dev | Source: slack Session: https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-c65c336afeef

▸ 4 bot/status comments hidden

@linear-code[bot]1mo ago

Overview

Allow developers to pre-fill connection parameters via shared_credentials on AuthConfig, so end users don't have to enter them manually.

Interactive Explorer: https://shared-params-explorer.preview.composio.dev

Decisions Made

Decision	Choice
Philosophy	Shared Credentials - allow API keys (not just params)
API Key Display	Masked (●●●●●●●●) with Clear button
User Override	Yes - user can clear and enter their own
Naming	Keep current name (`shared_credentials`) - avoid migration
Anshu's PRs	Build on top of #9759 backend PR
Primary Use Case	Zendesk-style subdomain pre-fill

Key UX Decision

Non-secrets (subdomain, base_url): Pre-fill, user can edit
Secrets (API keys): Show masked ●●●●●●●● with "✕ Clear" button
- User can clear to enter their own API key
- If left masked, backend uses shared_credentials value

Current State

Component	Status
Backend: Store shared_credentials	✅ Done
Backend: Merge on submit	✅ Done (Anshu's PR #9759)
Backend: Send `is_secret` flag	⚠️ Verify
Frontend: Pre-fill non-secrets	❌ Not done
Frontend: Mask secrets + Clear button

loading diff…

Description

Closes gap #3 from the Shared Params PLEN-2392 plan. The backend (ComposioHQ/hermes#9911) now sends:

is_secret: true | false per field (sourced from Mercury's config.ts).

is_available_as_shared_credentials: true when an auth config covers the field via shared_credentials.

default: \"<value>\" populated for non-secret fields with a shared value.

FormInputScreen already uses field.default for defaultValues, so non-secret shared fields auto-pre-fill once the matching Apollo change lands (gap #2 falls out for free).

How did I test this PR

pnpm lint — no new warnings on the touched file (1 pre-existing unused-arg warning unaffected by this diff).

pnpm build (with OPENAPI_URL pointing at local Apollo carrying the matching backend change) — ✓ Compiled successfully. The remaining build error during page-data collection is pre-existing on main and unrelated to this change.

End-to-end against local Apollo with a Shopify API_KEY auth_config carrying shared_credentials: { subdomain: \"acme-test\", generic_api_key: \"shppa_test_key_123\" }. Backend returns:

subdomain → default: \"acme-test\", is_secret: false, is_available_as_shared_credentials: true → form auto-pre-fills (user can override).
generic_api_key → is_secret: true, is_available_as_shared_credentials: true, no default → filtered out of the rendered fields by this PR.

Decisions Made

Decision

Choice

Philosophy

Shared Credentials - allow API keys (not just params)

API Key Display

Masked (●●●●●●●●) with Clear button

User Override

Yes - user can clear and enter their own

Naming

Keep current name (shared_credentials) - avoid migration

Anshu's PRs

Build on top of #9759 backend PR

Primary Use Case

Zendesk-style subdomain pre-fill

Key UX Decision

Non-secrets (subdomain, base_url): Pre-fill, user can edit

Secrets (API keys): Show masked ●●●●●●●● with "✕ Clear" button

User can clear to enter their own API key
If left masked, backend uses shared_credentials value

Component

Status

Backend: Store shared_credentials

✅ Done

Backend: Merge on submit

✅ Done (Anshu's PR #9759)

Backend: Send is_secret flag

⚠️ Verify

Frontend: Pre-fill non-secrets

❌ Not done

Frontend: Mask secrets + Clear button

feat(link): hide secret shared_credentials fields from the link form (PLEN-2392)

Description

How did I test this PR

Overview

Decisions Made

Key UX Decision

Current State

Description

How did I test this PR

Overview

Decisions Made

Key UX Decision

Current State

Implementation Plan

Phase 1: Backend (on top of Anshu's PR #9759)

Phase 2: Frontend

Acceptance Criteria

Notes

Playwright Test Results

Playwright Test Results