fix(secrets): allow storing values shorter than 8 characters

Keep the 8-character floor only for log redaction so short MinIO keys can be saved.

Co-authored-by: Cursor <cursoragent@cursor.com>

packages/server/secret-value.js

@@ -1,6 +1,7 @@
 import { inspect } from "node:util";
 
 export const REDACTED = "[secret]";
+/** Short values are stored, but skipped in log redaction to avoid false positives. */
 export const MIN_SECRET_LENGTH = 8;
 
 /** @type {Set<string>} */

packages/server/secrets-store.js

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import { db } from "./db.js";
 import { assertOwner } from "./fs-store.js";
 import { decryptSecret, encryptSecret } from "./secrets.js";
-import { MIN_SECRET_LENGTH, registerPlaintext } from "./secret-value.js";
+import { registerPlaintext } from "./secret-value.js";
 
 const MAX_NAME_LENGTH = 128;
 const SECRET_NAME_RE = /^[A-Za-z0-9._-]+$/;
@@ -68,8 +68,8 @@ export async function getSecretById(id) {
  * @param {{ owner: string, name: string, value: string }} opts
  */
 export async function upsertSecret({ owner, name, value }) {
-  if (typeof value !== "string" || value.length < MIN_SECRET_LENGTH) {
-    const err = new Error(`value must be at least ${MIN_SECRET_LENGTH} characters`);
+  if (typeof value !== "string" || value.length === 0) {
+    const err = new Error("value is required");
     err.statusCode = 400;
     throw err;
   }

packages/server/src/api/secrets.js

@@ -6,7 +6,6 @@ import {
   listSecrets,
   upsertSecret,
 } from "../../secrets-store.js";
-import { MIN_SECRET_LENGTH } from "../../secret-value.js";
 
 /**
  * @param {import("fastify").FastifyInstance} fastify
@@ -37,10 +36,8 @@ export default async function secretsPlugin(fastify) {
     }
 
     const value = String(body.value ?? "");
-    if (value.length < MIN_SECRET_LENGTH) {
-      return reply
-        .code(400)
-        .send({ error: `value must be at least ${MIN_SECRET_LENGTH} characters` });
+    if (value.length === 0) {
+      return reply.code(400).send({ error: "value is required" });
     }
 
     try {

packages/web/src/pages/SecretsPage.jsx

@@ -180,11 +180,11 @@ export function SecretsPage() {
             value={form.value}
             onChange={(e) => setForm({ ...form, value: e.target.value })}
             required
-            minLength={8}
             autoComplete="new-password"
           />
           <p className="text-xs opacity-60 mt-1">
             Values are encrypted at rest and never shown again after save.
+            Values shorter than 8 characters are not redacted from logs.
           </p>
           {upsert.isError ? (
             <p className="text-error text-sm">{errorMessage(upsert.error)}</p>