Q169: saved cloud and custom endpoints refill their form and keep the saved key

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/provider-endpoint.test.ts

@@ -0,0 +1,37 @@
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import { DatabaseConnection } from "../../src/main/database/connection";
+import { OrganizationService } from "../../src/main/services/organization-service";
+import { ProviderService } from "../../src/main/services/provider-service";
+import { providerAdapters } from "../../src/main/services/provider-adapters";
+import { AuthBrokerService } from "../../src/main/services/auth-broker-service";
+import { loadCredential, type ProviderRow } from "../../src/main/services/provider-internal";
+
+const vault = { encryptSecret: (secret: string) => Buffer.from(secret, "utf8"), decryptSecret: (ciphertext: Buffer) => ciphertext.toString("utf8") };
+
+describe("a saved cloud endpoint", () => {
+  test("refills its form without the key, and a blank key keeps the saved one", () => {
+    const connection = new DatabaseConnection(join(tmpdir(), `ac-endpoint-${randomUUID()}.db`));
+    const db = connection.db;
+    const providers = new ProviderService(db, providerAdapters, vault);
+    let orgId = "";
+    connection.transaction(() => {
+      orgId = new OrganizationService(db).createOrganization({ organizationName: "Acme", employeeName: "Dana", mission: "m", goal: "g" });
+    });
+    const azure = (db.prepare("select id from providers where org_id = ? and provider_key = 'azure-openai'").get(orgId) as { id: string }).id;
+    const storedSecret = () => JSON.parse(loadCredential(new AuthBrokerService(db, vault), orgId, db.prepare("select * from providers where id = ?").get(azure) as unknown as ProviderRow).secret) as Record<string, unknown>;
+
+    expect(providers.endpoint(orgId, azure)).toBeNull();
+    const keep = (deployment: string) => JSON.stringify({ baseUrl: "https://acme.openai.azure.com", region: "", projectId: "", deployment, secret: "", keepSavedSecret: true });
+    expect(() => providers.saveCredential({ orgId, providerId: azure, secret: keep("d1"), model: "d1" })).toThrow("There is no saved key to keep; enter the key.");
+
+    providers.saveCredential({ orgId, providerId: azure, secret: JSON.stringify({ baseUrl: "https://acme.openai.azure.com", region: "", projectId: "", deployment: "d1", secret: "az-key" }), model: "d1" });
+    expect(providers.endpoint(orgId, azure)).toEqual({ baseUrl: "https://acme.openai.azure.com", region: "", projectId: "", deployment: "d1" });
+
+    providers.saveCredential({ orgId, providerId: azure, secret: keep("d2"), model: "d2" });
+    expect(providers.endpoint(orgId, azure)?.deployment).toBe("d2");
+    expect(storedSecret()).toEqual({ baseUrl: "https://acme.openai.azure.com", region: "", projectId: "", deployment: "d2", secret: "az-key" });
+  });
+});