feat(settings): let users clear stored secrets from the UI

Redacted secrets (SMTP password, Telegram bot token, LDAP password) are always served blank to the browser, so the update path treats a blank submission as "unchanged" and silently restores the stored value. That made a once-set secret impossible to remove without editing the database — e.g. switching to a passwordless localhost SMTP relay kept sending the old credentials forever. Blank stays "unchanged"; clearing is now its own signal. The update request carries explicit clear flags (request-scoped fields on the controller form, so they are never persisted as settings rows), and preserveRedactedSecrets skips the restore for a flagged secret. Each secret field gets a Clear/Undo button that arms the flag; typing a new value disarms it. The 2FA token keeps its existing behavior: it is already clearable by disabling 2FA. Closes #5724
2026-07-20 19:46:09 +00:00 · 2026-07-02 13:57:34 +02:00
parent fb3a1559b2
commit 92303094fd
21 changed files with 188 additions and 34 deletions
@@ -1399,7 +1399,9 @@
      "remarkTemplateDesc": "Если задан, заменяет модель примечания для каждой ссылки подписки — задайте собственный формат с помощью токенов переменных (используйте кнопку для их вставки). Оставьте пустым, чтобы использовать модель выше.",
      "validation": {
        "pathLeadingSlash": "Путь должен начинаться с /"
-      }
+      },
+      "secretClear": "Очистить",
+      "secretClearUndo": "Отменить очистку"
    },
    "xray": {
      "importRules": "Импорт правил",