Icu 6800 api is secret data modeling (#1448)

* refactor: 💡 Add isSecret option for model attributes

Move secret attribute logic to application serializer that will remove
the key/value pair if the value is null or empty

✅ Closes: ICU-6800

* refactor: 💡 Add isSecret option to credential store token

* Update addons/api/addon/serializers/credential.js

Remove unneeded serialize method for credentials

Co-authored-by: Randall Morey <randall@randallmorey.com>

* refactor: 💡 add type check for serializing secret attributes

Co-authored-by: Randall Morey <randall@randallmorey.com>

addons/api/addon/generated/models/credential-store.js

@@ -82,6 +82,7 @@ export default class GeneratedCredentialStoreModel extends BaseModel {
   @attr('string', {
     for: 'vault',
     isNestedAttribute: true,
+    isSecret: true,
     description: 'A token used for accessing Vault.',
   })
   token;

addons/api/addon/generated/models/credential.js

@@ -58,6 +58,7 @@ export default class GeneratedCredentialModel extends BaseModel {
   @attr('string', {
     for: 'username_password',
     isNestedAttribute: true,
+    isSecret: true,
     description: 'The password for credential.',
   })
   password;
@@ -66,6 +67,7 @@ export default class GeneratedCredentialModel extends BaseModel {
   @attr('string', {
     for: 'ssh_private_key',
     isNestedAttribute: true,
+    isSecret: true,
     description: 'The private key for credential.',
   })
   private_key;
@@ -73,6 +75,7 @@ export default class GeneratedCredentialModel extends BaseModel {
   @attr('string', {
     for: 'ssh_private_key',
     isNestedAttribute: true,
+    isSecret: true,
     description: 'The private key passphrase for credential.',
   })
   private_key_passphrase;

addons/api/addon/serializers/application.js

@@ -39,6 +39,10 @@ export default class ApplicationSerializer extends RESTSerializer {
   serializeAttribute(snapshot, json, key, attribute) {
     const { type, options } = attribute;
     let value = super.serializeAttribute(...arguments);
+    // Remove secret attributes that are null or empty
+    if (options.isSecret) {
+      if (type === 'string' && !json[key]) delete json[key];
+    }
     // Convert empty strings to null.
     if (type === 'string' && json[key] === '') json[key] = null;
     // Do not serialize read-only attributes.

addons/api/addon/serializers/credential-store.js

@@ -20,8 +20,6 @@ export default class CredentialStoreSerializer extends ApplicationSerializer {
   serializeVault() {
     const serialized = super.serialize(...arguments);
     if (serialized.attributes) {
-      // Token cannot be unset.  If it's falsy, it must be removed.
-      if (!serialized.attributes?.token) delete serialized.attributes.token;
       // Client certificate key cannot be unset when certificate is set.
       // If it's falsy, it must be removed.
       if (

addons/api/addon/serializers/credential.js

@@ -13,46 +13,6 @@ export default class CredentialSerializer extends ApplicationSerializer {
    */
   serializeScopeID = false;
 
-  serialize(snapshot) {
-    switch (snapshot.record.type) {
-      case 'username_password':
-        return this.serializeUsernamePassword(...arguments);
-      case 'ssh_private_key':
-      default:
-        return this.serializeSSHPrivateKey(...arguments);
-    }
-  }
-
-  serializeUsernamePassword() {
-    const serialized = super.serialize(...arguments);
-    // Remove non-username_password type attributes
-    delete serialized.attributes.private_key;
-    delete serialized.attributes.private_key_passphrase;
-    // Remove password from the payload if null
-    // or empty string. This allows the user to only update
-    // the username without providing the password again.
-    // Users cannot unset the password, they would have
-    // to delete the credential entirely.
-    if (!serialized?.attributes?.password)
-      delete serialized.attributes.password;
-    return serialized;
-  }
-
-  serializeSSHPrivateKey() {
-    const serialized = super.serialize(...arguments);
-    // Remove non-ssh_private_key type attributes
-    delete serialized.attributes.password;
-    // Remove private_key and/or private_key_passphrase from the payload
-    // if null or empty string. This allows the user to only update
-    // the username without providing the private key and passphrase again.
-    // Users cannot unset the private key or passphrase, they would have
-    // to delete the credential entirely.
-    if (!serialized?.attributes?.private_key_passphrase)
-      delete serialized.attributes.private_key_passphrase;
-    if (!serialized?.attributes?.private_key)
-      delete serialized.attributes.private_key;
-    return serialized;
-  }
 
   normalize(typeClass, hash, ...rest) {
     const normalizedHash = copy(hash, true);

addons/api/tests/unit/serializers/application-test.js

@@ -107,6 +107,33 @@ module('Unit | Serializer | application', function (hooks) {
     });
   });
 
+  test('it serializes secret attributes correctly', function (assert) {
+    assert.expect(1);
+    const store = this.owner.lookup('service:store');
+    const record = store.createRecord('credential', {
+      private_key_passphrase: undefined,
+      private_key: null,
+      password: '',
+      username: 'user',
+      credential_store_id: 'csst_i7p1eu0Nw8',
+      type: 'username_password',
+      name: 'Name',
+      description: 'Description',
+      version: 1,
+    });
+    const serializedRecord = record.serialize();
+    assert.deepEqual(serializedRecord, {
+      attributes: {
+        username: 'user',
+      },
+      credential_store_id: 'csst_i7p1eu0Nw8',
+      type: 'username_password',
+      name: 'Name',
+      description: 'Description',
+      version: 1,
+    });
+  });
+
   test('it normalizes array records from an `items` root key', function (assert) {
     assert.expect(1);
     const store = this.owner.lookup('service:store');

addons/api/tests/unit/serializers/credential-test.js

@@ -97,7 +97,7 @@ module('Unit | Serializer | credential', function (hooks) {
     const store = this.owner.lookup('service:store');
     const serializer = store.serializerFor('credential');
     const record = store.createRecord('credential', {
-      private_key_passphrase: '',
+      private_key_passphrase: null,
       private_key: '',
       username: 'user',
       credential_store_id: 'csst_i7p1eu0Nw8',