Stefan AgnerandClaude Fable 5.1 64ea3be432 Keep "!secret" references when persisting app options (#7237) ...

Since #6203 the set-options endpoint stores the value returned by the
options validator. The validator replaces "!secret x" with the resolved
secret before type-checking, so the plaintext secret ended up in the
persisted app options instead of the reference (#7152).

Make the validator non-destructive on request instead of restoring the
references afterwards: AppOptions gains a resolve_secrets flag. When it
is False, a "!secret x" value is still validated against the resolved
secret (including the pwned hash and type coercion) but the reference is
returned. The set-options endpoint validates with resolve_secrets=False,
while write_options and the self options config endpoint keep resolving
secrets for the container.

Fixes #7152

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

2026-09-17 15:27:39 +02:00

..

__init__.py

Rename addon/addons to app/apps in filenames and imports (#6837)

2026-05-13 20:55:46 +02:00

test_app.py

Skip redundant inspect calls when constructing Docker container handles (#7175)

2026-09-01 00:52:00 +02:00

test_build.py

Rename addon/addons to app/apps in filenames and imports (#6837)

2026-05-13 20:55:46 +02:00

test_config.py

Reduce app config schema warning noise for regular users (#7071)

2026-07-22 10:22:26 +02:00

test_manager.py

Forward Core API proxy paths byte-for-byte and match deny rules on decoded path (#7225)

2026-09-15 13:11:08 +02:00

test_options.py

Keep "!secret" references when persisting app options (#7237)

2026-09-17 15:27:39 +02:00

test_utils.py

Fix security rating for apps without a web interface (#7165)

2026-08-25 21:04:16 +02:00