From e962b81c4e615deabfc6e0c27abb2f3a3935d14e Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 21 Jul 2026 21:07:16 +0200
Subject: [PATCH] fix(gitlab): reload application secret after save

The secret was always stored encrypted, but the setup form wiped the
input on every load. Load it back for admins (GitHub App parity) so a
reload no longer looks like a failed save.
---
 app/Livewire/Source/Gitlab/Change.php           |  4 +++-
 .../livewire/source/gitlab/change.blade.php     |  8 +++++---
 tests/Feature/GitlabSourceChangeViewTest.php    | 17 +++++++++++++++++
 3 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/app/Livewire/Source/Gitlab/Change.php b/app/Livewire/Source/Gitlab/Change.php
index 2e36a1e1f..5a386b429 100644
--- a/app/Livewire/Source/Gitlab/Change.php
+++ b/app/Livewire/Source/Gitlab/Change.php
@@ -173,7 +173,9 @@ class Change extends Component
             $this->customUser = $this->gitlab_app->custom_user;
             $this->customPort = $this->gitlab_app->custom_port;
             $this->clientId = $this->gitlab_app->client_id;
-            $this->clientSecretInput = null;
+            // Decrypt and surface for authorized editors (same pattern as GitHub App client_secret).
+            $this->gitlab_app->makeVisible(['client_secret', 'webhook_token', 'access_token', 'refresh_token']);
+            $this->clientSecretInput = $this->gitlab_app->client_secret;
             $this->webhookToken = $this->gitlab_app->webhook_token;
             $this->groupName = $this->gitlab_app->group_name;
             $this->isSystemWide = $this->gitlab_app->is_system_wide;
diff --git a/resources/views/livewire/source/gitlab/change.blade.php b/resources/views/livewire/source/gitlab/change.blade.php
index caedc88de..5cb859ec5 100644
--- a/resources/views/livewire/source/gitlab/change.blade.php
+++ b/resources/views/livewire/source/gitlab/change.blade.php
@@ -46,7 +46,8 @@
 
                 <h3 class="pt-4">OAuth Credentials</h3>
                 <x-forms.input canGate="update" :canResource="$gitlab_app" id="clientId" label="Application ID" />
-                <x-forms.input canGate="update" :canResource="$gitlab_app" id="clientSecretInput" label="Application Secret" type="password" />
+                <x-forms.input canGate="update" :canResource="$gitlab_app" id="clientSecretInput" label="Application Secret" type="password"
+                    helper="Stored encrypted. Leave empty and save other fields without changing the existing secret." />
                 <x-forms.input canGate="update" :canResource="$gitlab_app" id="groupName" label="Group Name"
                     helper="Comma-separated group names to filter visible repositories." />
 
@@ -171,8 +172,9 @@
                 <x-forms.input id="name" label="Name" />
                 <x-forms.input id="clientId" label="Application ID" required
                     helper="The Application ID from your GitLab OAuth Application." />
-                <x-forms.input id="clientSecretInput" label="Application Secret" type="password" required
-                    helper="The Secret from your GitLab OAuth Application." />
+                <x-forms.input id="clientSecretInput" label="Application Secret" type="password"
+                    :required="blank($clientSecretInput) && blank(data_get($gitlab_app, 'client_secret'))"
+                    helper="The Secret from your GitLab OAuth Application. Saved encrypted and shown again after reload." />
                 <x-forms.input id="groupName" label="Group Name"
                     helper="Optional. Comma-separated group names to filter repositories." />
 
diff --git a/tests/Feature/GitlabSourceChangeViewTest.php b/tests/Feature/GitlabSourceChangeViewTest.php
index 60f8f0d96..a5e43a1cc 100644
--- a/tests/Feature/GitlabSourceChangeViewTest.php
+++ b/tests/Feature/GitlabSourceChangeViewTest.php
@@ -56,4 +56,21 @@ describe('GitLab source setup view', function () {
             ->set('htmlUrl', 'https://gitlab.example.com')
             ->assertSet('apiUrl', 'https://gitlab.example.com/api/v4');
     });
+
+    test('saves and reloads the application secret after refresh', function () {
+        Livewire::withQueryParams(['gitlab_app_uuid' => $this->gitlabApp->uuid])
+            ->test(Change::class)
+            ->set('clientId', 'gitlab-app-id')
+            ->set('clientSecretInput', 'super-secret-value')
+            ->call('submit')
+            ->assertDispatched('success');
+
+        $this->gitlabApp->refresh()->makeVisible(['client_secret']);
+        expect($this->gitlabApp->client_secret)->toBe('super-secret-value');
+
+        Livewire::withQueryParams(['gitlab_app_uuid' => $this->gitlabApp->uuid])
+            ->test(Change::class)
+            ->assertSet('clientId', 'gitlab-app-id')
+            ->assertSet('clientSecretInput', 'super-secret-value');
+    });
 });