environment API uses a write-only model for the tls key and hawser token

src/lib/server/environment-redact.ts

@@ -0,0 +1,24 @@
+/**
+ * Strip an environment's decrypted secrets before it leaves the server.
+ *
+ * `getEnvironment(s)` decrypt `tlsKey` (the private TLS client key) and `hawserToken`
+ * for internal use, but neither must ever reach an API response: the TLS key
+ * authenticates directly against the Docker daemon, bypassing Dockhand entirely and
+ * surviving a revoked login. `tlsCa`/`tlsCert` are the public CA + client cert and
+ * are NOT secret, so they stay. In their place we expose `hasTlsKey` / `hasHawserToken`
+ * booleans so the UI can show "configured" without holding the value.
+ */
+
+/** The two secret fields removed from every environment API response. */
+export type EnvironmentSecretField = 'tlsKey' | 'hawserToken';
+
+export function redactEnvironment<T extends { tlsKey?: string | null; hawserToken?: string | null }>(
+	env: T
+): Omit<T, EnvironmentSecretField> & { hasTlsKey: boolean; hasHawserToken: boolean } {
+	const { tlsKey, hawserToken, ...rest } = env;
+	return {
+		...rest,
+		hasTlsKey: !!(tlsKey && tlsKey.length > 0),
+		hasHawserToken: !!(hawserToken && hawserToken.length > 0)
+	};
+}