fix(sso): reject a blank replacement instead of overwriting the stored secret

Author: waleedlatif1

apps/sim/ee/sso/components/sso-settings.test.tsx

@@ -221,6 +221,20 @@ describe('SSO client secret preservation', () => {
     return container.querySelector<HTMLInputElement>('#sso-client-secret')
   }
 
+  /** Sets the input through the native setter so React's onChange fires. */
+  function typeSecret(value: string) {
+    const input = secretInput()
+    expect(input).not.toBeNull()
+    act(() => {
+      const setter = Object.getOwnPropertyDescriptor(
+        window.HTMLInputElement.prototype,
+        'value'
+      )?.set
+      setter?.call(input, value)
+      input?.dispatchEvent(new Event('input', { bubbles: true }))
+    })
+  }
+
   it('shows the saved secret as a masked hint rather than the sentinel', () => {
     renderSso('org-a')
     startEditing()
@@ -252,16 +266,7 @@ describe('SSO client secret preservation', () => {
     startEditing()
     act(() => findButton('Replace')?.click())
 
-    const input = secretInput()
-    expect(input).not.toBeNull()
-    act(() => {
-      const setter = Object.getOwnPropertyDescriptor(
-        window.HTMLInputElement.prototype,
-        'value'
-      )?.set
-      setter?.call(input, 'brand-new-secret')
-      input?.dispatchEvent(new Event('input', { bubbles: true }))
-    })
+    typeSecret('brand-new-secret')
 
     await act(async () => {
       findButton('Update')?.click()
@@ -271,6 +276,28 @@ describe('SSO client secret preservation', () => {
     expect(mutateAsync.mock.calls[0][0].clientSecret).toBe('brand-new-secret')
   })
 
+  /**
+   * A whitespace-only value must not reach the server. Validation is skipped only
+   * while the stored secret is being kept; once Replace is clicked the field is a
+   * real input, so blank input has to fail rather than overwrite a working secret.
+   */
+  it('refuses to submit a whitespace-only replacement', async () => {
+    const mutateAsync = vi.fn().mockResolvedValue({})
+    mockUseConfigureSSO.mockReturnValue({ isPending: false, mutateAsync })
+
+    renderSso('org-a')
+    startEditing()
+    act(() => findButton('Replace')?.click())
+    typeSecret('   ')
+
+    await act(async () => {
+      findButton('Update')?.click()
+    })
+
+    expect(mutateAsync).not.toHaveBeenCalled()
+    expect(container).toHaveTextContent('Client Secret is required.')
+  })
+
   /**
    * The label is deliberately not "Cancel": the header already uses that to discard
    * the whole edit, and matching it here would make two very different actions

apps/sim/ee/sso/components/sso-settings.tsx

@@ -350,9 +350,13 @@ function OrganizationSsoSettings({ organizationId }: SSOProps) {
 
     if (providerType === 'oidc') {
       newErrors.clientId = validateRequired('Client ID', data.clientId)
-      newErrors.clientSecret = hasStoredClientSecret
-        ? []
-        : validateRequired('Client Secret', data.clientSecret)
+      // Skipped only while the stored secret is being kept. Once Replace is
+      // clicked the field is a real input again, so a blank or whitespace-only
+      // value has to fail rather than quietly overwrite a working secret.
+      newErrors.clientSecret =
+        hasStoredClientSecret && !isReplacingClientSecret
+          ? []
+          : validateRequired('Client Secret', data.clientSecret)
       if (!data.scopes || !data.scopes.trim()) {
         newErrors.scopes = ['Scopes are required for OIDC providers']
       }
@@ -409,11 +413,13 @@ function OrganizationSsoSettings({ organizationId }: SSOProps) {
               },
               clientId: formData.clientId,
               // Blank on an edit means the admin did not retype it: send the
-              // sentinel so the server keeps the stored secret.
+              // sentinel so the server keeps the stored secret. Trimmed because a
+              // pasted secret often carries a trailing newline, and because a
+              // whitespace-only value must never be stored as the secret.
               clientSecret:
-                hasStoredClientSecret && !formData.clientSecret
+                hasStoredClientSecret && !formData.clientSecret.trim()
                   ? REDACTED_MARKER
-                  : formData.clientSecret,
+                  : formData.clientSecret.trim(),
               scopes: formData.scopes.split(',').map((s) => s.trim()),
               ...(formData.authorizationEndpoint.trim()
                 ? { authorizationEndpoint: formData.authorizationEndpoint.trim() }