fix(api): avoid lazy loading nested server secrets

app/Http/Controllers/Api/ApplicationsController.php

@@ -69,7 +69,6 @@ class ApplicationsController extends Controller
             $application->makeHidden([
                 'private_key_id',
             ]);
-            $this->hideNestedServerSecrets($application);
         }
 
         if ($application->is_shown_once ?? false) {
@@ -79,31 +78,6 @@ class ApplicationsController extends Controller
         return serializeApiResponse($application);
     }
 
-    private function hideNestedServerSecrets($model): void
-    {
-        $server = $model->destination?->server ?? null;
-        if (! $server) {
-            return;
-        }
-
-        $server->makeHidden([
-            'logdrain_axiom_api_key',
-            'logdrain_newrelic_license_key',
-        ]);
-
-        $settings = $server->settings ?? null;
-        if ($settings) {
-            $settings->makeHidden([
-                'sentinel_token',
-                'sentinel_custom_url',
-                'logdrain_newrelic_license_key',
-                'logdrain_axiom_api_key',
-                'logdrain_custom_config',
-                'logdrain_custom_config_parser',
-            ]);
-        }
-    }
-
     /**
      * Expose sensitive fields on eager-loaded nested Server + ServerSetting
      * relations for callers with the `read:sensitive` or `root` token ability.
@@ -184,8 +158,12 @@ class ApplicationsController extends Controller
         }
 
         $tagName = $request->query('tag');
+        $applicationRelations = $request->attributes->get('can_read_sensitive', false) === true
+            ? ['destination.server.settings']
+            : [];
 
         $applications = Application::ownedByCurrentTeamAPI($teamId)
+            ->with($applicationRelations)
             ->when($tagName, function ($query, $tagName) {
                 $query->whereHas('tags', function ($query) use ($tagName) {
                     $query->where('name', $tagName);