fix(settings): reconcile secret status and model drafts

web/tests/settings-secret-status.test.mjs

@@ -0,0 +1,99 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import {
+  applyAuthoritativeSecretStatus
+} from '../src/utils/settingsModelHelper.js'
+
+test('server secret status overrides stale configured flags from the session draft', () => {
+  const modelRows = [
+    {
+      slot: 'main',
+      provider: 'Ali',
+      url: 'https://example.com',
+      apiKey: 'unsaved-main-key',
+      modelId: 'main',
+      type: 'llm'
+    },
+    { slot: 'backup', provider: 'GLM', url: 'https://example.com', modelId: 'backup', type: 'llm' },
+    { slot: 'embedding', provider: 'GLM', url: 'https://example.com', modelId: 'embedding', type: 'embedding' },
+    { slot: 'reranker', provider: 'Ali', url: 'https://example.com', modelId: 'reranker', type: 'rerank' }
+  ]
+  const staleDraft = {
+    companyForm: {},
+    appearanceForm: {},
+    adminForm: { adminPasswordConfigured: true },
+    sessionForm: {},
+    hermesForm: {},
+    llmForm: {
+      embeddingApiKeyConfigured: true,
+      rerankerApiKeyConfigured: true,
+      models: [
+        ...modelRows.map((model) => ({
+          ...model,
+          apiKeyConfigured: true
+        })),
+        {
+          slot: 'server_deleted',
+          provider: 'Ali',
+          url: 'https://stale.example.com',
+          modelId: 'stale',
+          type: 'llm',
+          apiKeyConfigured: true
+        }
+      ]
+    },
+    renderForm: { jwtSecretConfigured: true },
+    logForm: {},
+    mailForm: { passwordConfigured: true }
+  }
+  const serverSnapshot = {
+    adminForm: { adminPasswordConfigured: true },
+    llmForm: {
+      mainApiKeyConfigured: true,
+      backupApiKeyConfigured: true,
+      embeddingApiKeyConfigured: false,
+      rerankerApiKeyConfigured: false,
+      models: [
+        ...modelRows.map((model) => ({
+          ...model,
+          apiKey: '',
+          apiKeyConfigured: ['main', 'backup'].includes(model.slot)
+        })),
+        {
+          slot: 'server_only',
+          provider: 'GLM',
+          url: 'https://server.example.com',
+          apiKey: '',
+          modelId: 'server-model',
+          type: 'llm',
+          apiKeyConfigured: true
+        }
+      ]
+    },
+    renderForm: { jwtSecretConfigured: false },
+    mailForm: { passwordConfigured: false }
+  }
+
+  const resolved = applyAuthoritativeSecretStatus(staleDraft, serverSnapshot)
+  const configuredBySlot = new Map(
+    resolved.llmForm.models.map((model) => [model.slot, model.apiKeyConfigured])
+  )
+
+  assert.equal(resolved.llmForm.mainApiKeyConfigured, true)
+  assert.equal(resolved.llmForm.embeddingApiKeyConfigured, false)
+  assert.equal(resolved.llmForm.rerankerApiKeyConfigured, false)
+  assert.equal(configuredBySlot.get('main'), true)
+  assert.equal(configuredBySlot.get('embedding'), false)
+  assert.equal(configuredBySlot.get('reranker'), false)
+  assert.equal(configuredBySlot.get('server_only'), true)
+  assert.equal(configuredBySlot.has('server_deleted'), false)
+  assert.equal(
+    resolved.llmForm.models.find((model) => model.slot === 'main')?.apiKey,
+    'unsaved-main-key'
+  )
+  assert.equal(resolved.llmForm.mainApiKey, 'unsaved-main-key')
+  assert.equal(resolved.adminForm.adminPasswordConfigured, true)
+  assert.equal(resolved.renderForm.jwtSecretConfigured, false)
+  assert.equal(resolved.mailForm.passwordConfigured, false)
+})