fix(central-ui): never render DB connection strings on Integration Definitions list

Connection strings carry credentials; the Database Connections tab rendered the full string (text + title tooltip) for any Design/Admin user. Replace with a non-sensitive 'hidden — edit to view' hint so it never reaches the browser DOM. Connection strings remain editable on the create/edit form. Adds a bUnit regression guard asserting the seeded secret is absent from the rendered list.
2026-06-17 10:44:43 -04:00
parent af54c8ad11
commit c2e89e9d40
2 changed files with 75 additions and 1 deletions
@@ -245,7 +245,8 @@
                                        </div>
                                    </div>
                                </div>
-                                <p class="small text-muted text-truncate mb-1" title="@dc.ConnectionString">@dc.ConnectionString</p>
+                                @* Connection strings carry credentials — never rendered here (not even for admins). Shown only on the create/edit form. *@
+                                <p class="small text-muted fst-italic mb-1">Connection string hidden — edit to view</p>
                                <div>
                                    <span class="badge bg-light text-dark me-1">Max @dc.MaxRetries retries</span>
                                    <span class="badge bg-light text-dark">Delay @dc.RetryDelay.TotalSeconds s</span>