WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

internal/types/secret.go

@@ -0,0 +1,32 @@
+// Package types — shared secret redaction helpers.
+//
+// VectorStore connection configs and tenant KV configs (web search, parser
+// engine, storage engine) use the redacted-placeholder round-trip pattern:
+//
+//   - GET responses replace set secrets with RedactedSecretPlaceholder (or
+//     empty string when unset).
+//   - PUT requests treat "", or RedactedSecretPlaceholder as "preserve
+//     existing"; any other value replaces the stored secret.
+//
+// MCP / Model / WebSearch provider / DataSource credentials use a dedicated
+// /credentials subresource instead; see internal/handler/dto/mcp.go.
+package types
+
+// RedactedSecretPlaceholder is the fixed value returned in API responses
+// whenever a sensitive field is set but withheld from the client.
+const RedactedSecretPlaceholder = "***"
+
+// IsRedactedOrEmpty reports whether s should be treated as "no change
+// requested" in an Update request.
+func IsRedactedOrEmpty(s string) bool {
+	return s == "" || s == RedactedSecretPlaceholder
+}
+
+// PreserveIfRedacted returns existing when incoming is empty or the redacted
+// placeholder, otherwise returns incoming.
+func PreserveIfRedacted(incoming, existing string) string {
+	if IsRedactedOrEmpty(incoming) {
+		return existing
+	}
+	return incoming
+}