fix(gitlab): reload application secret after save

The secret was always stored encrypted, but the setup form wiped the
input on every load. Load it back for admins (GitHub App parity) so a
reload no longer looks like a failed save.

app/Livewire/Source/Gitlab/Change.php

@@ -173,7 +173,9 @@ class Change extends Component
             $this->customUser = $this->gitlab_app->custom_user;
             $this->customPort = $this->gitlab_app->custom_port;
             $this->clientId = $this->gitlab_app->client_id;
-            $this->clientSecretInput = null;
+            // Decrypt and surface for authorized editors (same pattern as GitHub App client_secret).
+            $this->gitlab_app->makeVisible(['client_secret', 'webhook_token', 'access_token', 'refresh_token']);
+            $this->clientSecretInput = $this->gitlab_app->client_secret;
             $this->webhookToken = $this->gitlab_app->webhook_token;
             $this->groupName = $this->gitlab_app->group_name;
             $this->isSystemWide = $this->gitlab_app->is_system_wide;

resources/views/livewire/source/gitlab/change.blade.php

@@ -46,7 +46,8 @@
 
                 <h3 class="pt-4">OAuth Credentials</h3>
                 <x-forms.input canGate="update" :canResource="$gitlab_app" id="clientId" label="Application ID" />
-                <x-forms.input canGate="update" :canResource="$gitlab_app" id="clientSecretInput" label="Application Secret" type="password" />
+                <x-forms.input canGate="update" :canResource="$gitlab_app" id="clientSecretInput" label="Application Secret" type="password"
+                    helper="Stored encrypted. Leave empty and save other fields without changing the existing secret." />
                 <x-forms.input canGate="update" :canResource="$gitlab_app" id="groupName" label="Group Name"
                     helper="Comma-separated group names to filter visible repositories." />
 
@@ -171,8 +172,9 @@
                 <x-forms.input id="name" label="Name" />
                 <x-forms.input id="clientId" label="Application ID" required
                     helper="The Application ID from your GitLab OAuth Application." />
-                <x-forms.input id="clientSecretInput" label="Application Secret" type="password" required
-                    helper="The Secret from your GitLab OAuth Application." />
+                <x-forms.input id="clientSecretInput" label="Application Secret" type="password"
+                    :required="blank($clientSecretInput) && blank(data_get($gitlab_app, 'client_secret'))"
+                    helper="The Secret from your GitLab OAuth Application. Saved encrypted and shown again after reload." />
                 <x-forms.input id="groupName" label="Group Name"
                     helper="Optional. Comma-separated group names to filter repositories." />
 

tests/Feature/GitlabSourceChangeViewTest.php

@@ -56,4 +56,21 @@ describe('GitLab source setup view', function () {
             ->set('htmlUrl', 'https://gitlab.example.com')
             ->assertSet('apiUrl', 'https://gitlab.example.com/api/v4');
     });
+
+    test('saves and reloads the application secret after refresh', function () {
+        Livewire::withQueryParams(['gitlab_app_uuid' => $this->gitlabApp->uuid])
+            ->test(Change::class)
+            ->set('clientId', 'gitlab-app-id')
+            ->set('clientSecretInput', 'super-secret-value')
+            ->call('submit')
+            ->assertDispatched('success');
+
+        $this->gitlabApp->refresh()->makeVisible(['client_secret']);
+        expect($this->gitlabApp->client_secret)->toBe('super-secret-value');
+
+        Livewire::withQueryParams(['gitlab_app_uuid' => $this->gitlabApp->uuid])
+            ->test(Change::class)
+            ->assertSet('clientId', 'gitlab-app-id')
+            ->assertSet('clientSecretInput', 'super-secret-value');
+    });
 });