fix switching an Infisical provider back to a static token

src/lib/utils/provider-form-config.ts

@@ -0,0 +1,27 @@
+/**
+ * Build the config payload the secret-provider edit form POSTs from its field values.
+ *
+ * - A filled field is sent as-is.
+ * - A blank SECRET field is omitted (blank = keep the stored secret).
+ * - A blank NON-SECRET field that WAS in the loaded config is sent as an explicit '' so
+ *   the server can tell "user cleared it" from "unchanged/absent". Clearing a non-secret
+ *   partner (e.g. Infisical clientId) is what drops its orphaned paired secret
+ *   (clientSecret) server-side; without the explicit '', the stale secret is merged back
+ *   and validation wedges on "Client ID is required when a client secret is set" (#1448).
+ */
+export function collectProviderFormConfig(
+	fieldDefs: Array<{ key: string; isSecret: boolean }>,
+	formValues: Record<string, string>,
+	loadedKeys: ReadonlySet<string>
+): Record<string, string> {
+	const config: Record<string, string> = {};
+	for (const field of fieldDefs) {
+		const value = (formValues[field.key] ?? '').trim();
+		if (value) {
+			config[field.key] = value;
+		} else if (!field.isSecret && loadedKeys.has(field.key)) {
+			config[field.key] = '';
+		}
+	}
+	return config;
+}

src/routes/settings/secrets/ProviderModal.svelte

@@ -133,6 +133,7 @@
 	import { scale } from 'svelte/transition';
 	import { backOut, cubicIn } from 'svelte/easing';
 	import { getProviderIcon } from '$lib/components/provider-icons';
+	import { collectProviderFormConfig } from '$lib/utils/provider-form-config';
 	import { toast } from 'svelte-sonner';
 	import { focusFirstInput } from '$lib/utils';
 
@@ -156,6 +157,11 @@
 	let formType = $state('op-service-account');
 	// One value per config field; blank means 'unset' (on edit: keep existing).
 	let formConfig = $state<Record<string, string>>({});
+	// Non-secret keys that were present in the stored config when the edit form loaded. If
+	// the user clears one, we must send an explicit '' so the server knows it was cleared
+	// (a merely absent key means "unchanged"). This is what lets clearing Infisical's
+	// clientId drop its orphaned clientSecret (#1448).
+	let loadedConfigKeys = $state<Set<string>>(new Set());
 	let formError = $state('');
 	let formSaving = $state(false);
 	let formTesting = $state(false);
@@ -172,6 +178,7 @@
 
 	function resetConfig() {
 		formConfig = {};
+		loadedConfigKeys = new Set();
 	}
 
 	function resetForm() {
@@ -211,20 +218,21 @@
 				if (value != null) next[key] = String(value);
 			}
 			formConfig = next; // secret fields (token) are absent -> stay blank
+			loadedConfigKeys = new Set(Object.keys(next));
 		} catch {
 			// leave fields blank on failure - the user can re-enter them
 		}
 	}
 
-	// A blank secret field on edit means "keep the stored value"; non-secret fields are
-	// pre-filled (loadProviderConfig). Collect only the fields the user actually filled.
+	// See collectProviderFormConfig: a blank secret field means "keep stored"; a cleared
+	// non-secret field that was loaded is sent as an explicit '' so the server can drop it
+	// (and any paired secret, e.g. Infisical clientSecret when clientId is cleared). #1448
 	function collectConfig(): Record<string, string> {
-		const config: Record<string, string> = {};
-		for (const field of fields) {
-			const value = (formConfig[field.key] ?? '').trim();
-			if (value) config[field.key] = value;
-		}
-		return config;
+		return collectProviderFormConfig(
+			fields.map((f) => ({ key: f.key, isSecret: f.type === 'password' })),
+			formConfig,
+			loadedConfigKeys
+		);
 	}
 
 	function fieldRequired(field: ProviderField, config: Record<string, string>): boolean {