Skip to content

chore: surface token when applying auth, allow named secret creation#285

Open
usman-khalid wants to merge 3 commits intomainfrom
auth
Open

chore: surface token when applying auth, allow named secret creation#285
usman-khalid wants to merge 3 commits intomainfrom
auth

Conversation

@usman-khalid
Copy link
Copy Markdown
Collaborator

@usman-khalid usman-khalid commented Apr 14, 2026

Updates Site Admin tool to:

  • allow creation of named secrets
  • surface the token when applying authentication to a site
  • fix some styling for dark mode

Test URLs:

@aem-code-sync
Copy link
Copy Markdown

aem-code-sync bot commented Apr 14, 2026

Hello, I'm the AEM Code Sync Bot and I will run some actions to deploy your branch and validate page speed.
In case there are problems, just click a checkbox below to rerun the respective action.

  • Re-run PSI checks
  • Re-sync branch
Commits

@aem-code-sync
Copy link
Copy Markdown

aem-code-sync bot commented Apr 14, 2026

Page Scores Audits Google
📱 /tools/site-admin/index.html PERFORMANCE A11Y SEO BEST PRACTICES SI FCP LCP TBT CLS PSI
🖥️ /tools/site-admin/index.html PERFORMANCE A11Y SEO BEST PRACTICES SI FCP LCP TBT CLS PSI

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
<input type="text" id="secret-name" placeholder="e.g. my-secret-name" />
</div>
<div class="form-field">
<label for="secret-value">Value (optional)</label>
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SHOULD FIX: Secret value input should use type="password" to mask the value on screen.

The auth token display in the same PR correctly uses type="password". Per AGENTS.md: Consider that everything you do is client-side code served on the public web.

Suggested change
<label for="secret-value">Value (optional)</label>
<input type="password" id="secret-value" placeholder="e.g. secret from external service" />

@claude
Copy link
Copy Markdown
Contributor

claude bot commented Apr 14, 2026

Code Review Summary

Issues Found

SHOULD FIX:

  • tools/site-admin/helpers/modals.js — Secret value input for named secret creation uses type="text" instead of type="password", exposing the value in plaintext on screen. The auth token display added in this same PR correctly uses type="password". (AGENTS.md security)

One-Click Fixes

I have added a GitHub Suggestion for the fixable issue. Go to Files changed and click Commit suggestion to apply.

Verdict

COMMENT — one security hygiene fix recommended before merge.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant