validate secret provider config before save

src/routes/api/secret-providers/[id]/test/+server.ts

@@ -3,9 +3,17 @@ import type { RequestHandler } from './$types';
 import { getSecretProviderById } from '$lib/server/db';
 import { authorize } from '$lib/server/authorize';
 import { testProviderConnection } from '$lib/server/secretproviders';
+import { mergeProviderConfigForWrite } from '$lib/server/secretproviders/shared';
+import type { SecretProviderConfig } from '$lib/server/secretproviders/shared';
 
-/** Test a stored provider using its persisted (decrypted) config. */
-export const POST: RequestHandler = async ({ params, cookies }) => {
+/**
+ * Test a stored provider. With no body it tests the persisted config. With an optional
+ * `{ config }` override (the edit form's typed non-secret fields) it tests exactly what a
+ * Save would persist: the incoming config merged over the stored one, with a blank token
+ * falling back to the stored secret. The secret is NEVER supplied by the client - it comes
+ * from storage server-side - so this stays a `secrets:view` operation.
+ */
+export const POST: RequestHandler = async ({ params, cookies, request }) => {
 	const auth = await authorize(cookies);
 	if (auth.authEnabled && !(await auth.can('secrets', 'view'))) {
 		return json({ error: 'Permission denied' }, { status: 403 });
@@ -21,7 +29,20 @@ export const POST: RequestHandler = async ({ params, cookies }) => {
 		return json({ error: 'Secret provider not found' }, { status: 404 });
 	}
 
-	const result = await testProviderConnection(provider.type, provider.config);
+	let configToTest: SecretProviderConfig = provider.config;
+	try {
+		const body = await request.json();
+		if (body && typeof body.config === 'object' && body.config !== null) {
+			configToTest = mergeProviderConfigForWrite(
+				body.config as Record<string, unknown>,
+				provider.config as unknown as Record<string, unknown>
+			) as unknown as SecretProviderConfig;
+		}
+	} catch {
+		// No/invalid body: test the stored config as-is.
+	}
+
+	const result = await testProviderConnection(provider.type, configToTest);
 	if (!result.ok) {
 		return json({ ok: false, error: result.error }, { status: 200 });
 	}