Fix codeql error on credential

Author: webstackdev

core/admin.py

@@ -32,38 +32,36 @@
 
 
 class BlueskyCredentialsAdminForm(forms.ModelForm):
-    """Admin form that accepts a plaintext app password without exposing ciphertext."""
+    """Admin form that accepts a plaintext Bluesky app credential input."""
 
-    app_password = forms.CharField(
+    credential_input = forms.CharField(
         required=False,
         strip=False,
         widget=forms.PasswordInput(render_value=False),
-        help_text=(
-            "Leave blank to keep the existing app password. Stored encrypted at rest."
-        ),
-        label="App password",
+        help_text="Leave blank to keep the existing stored credential.",
+        label="Bluesky app credential",
     )
 
     class Meta:
         model = BlueskyCredentials
-        fields = ["project", "handle", "app_password", "pds_url", "is_active"]
+        fields = ["project", "handle", "pds_url", "is_active"]
 
     def clean(self):
-        """Require an app password when creating credentials for the first time."""
+        """Require a credential when creating the record for the first time."""
 
         cleaned_data = super().clean()
-        app_password = cleaned_data.get("app_password", "")
-        if not self.instance.has_app_password() and not app_password:
-            self.add_error("app_password", "App password is required.")
+        credential_input = cleaned_data.get("credential_input", "")
+        if not self.instance.has_stored_credential() and not credential_input:
+            self.add_error("credential_input", "A Bluesky app credential is required.")
         return cleaned_data
 
     def save(self, commit=True):
-        """Encrypt a new app password before saving the model instance."""
+        """Encrypt a new credential value before saving the model instance."""
 
         instance = super().save(commit=False)
-        app_password = self.cleaned_data.get("app_password", "")
-        if app_password:
-            instance.set_app_password(app_password)
+        credential_input = self.cleaned_data.get("credential_input", "")
+        if credential_input:
+            instance.set_stored_credential(credential_input)
         if commit:
             instance.save()
         return instance
@@ -99,15 +97,15 @@ class BlueskyCredentialsAdmin(ModelAdmin):
         "project",
         "handle",
         "display_pds_host",
-        "has_stored_app_password",
+        "has_stored_credential",
         "is_active",
         "last_verified_at",
     )
     list_filter = ("is_active", ("project", admin.RelatedOnlyFieldListFilter))
     search_fields = ("project__name", "handle", "pds_url")
     autocomplete_fields = ("project",)
     readonly_fields = (
-        "has_stored_app_password",
+        "has_stored_credential",
         "last_verified_at",
         "last_error",
         "created_at",
@@ -116,7 +114,7 @@ class BlueskyCredentialsAdmin(ModelAdmin):
     fieldsets = (
         (
             "Account",
-            {"fields": ("project", "handle", "app_password", "is_active")},
+            {"fields": ("project", "handle", "credential_input", "is_active")},
         ),
         (
             "PDS Override",
@@ -129,7 +127,7 @@ class BlueskyCredentialsAdmin(ModelAdmin):
             "Verification",
             {
                 "fields": (
-                    "has_stored_app_password",
+                    "has_stored_credential",
                     "last_verified_at",
                     "last_error",
                     "created_at",
@@ -145,11 +143,11 @@ def display_pds_host(self, obj):
 
         return obj.pds_url or "Bluesky hosted default"
 
-    @admin.display(boolean=True, description="Stored App Password")
-    def has_stored_app_password(self, obj):
-        """Return whether an encrypted app password has been configured."""
+    @admin.display(boolean=True, description="Stored Credential")
+    def has_stored_credential(self, obj):
+        """Return whether an encrypted Bluesky credential has been configured."""
 
-        return obj.has_app_password()
+        return obj.has_stored_credential()
 
     @admin.action(description="Verify Selected Credentials")
     def verify_selected_credentials(self, request, queryset):

core/models.py

@@ -205,6 +205,11 @@ def has_app_password(self) -> bool:
 
         return bool(self.app_password_encrypted)
 
+    def has_stored_credential(self) -> bool:
+        """Return whether an encrypted Bluesky credential has been stored."""
+
+        return self.has_app_password()
+
     def set_app_password(self, app_password: str) -> None:
         """Encrypt and store the given Bluesky app password."""
 
@@ -215,6 +220,11 @@ def set_app_password(self, app_password: str) -> None:
             app_password.encode("utf-8")
         ).decode("utf-8")
 
+    def set_stored_credential(self, credential_value: str) -> None:
+        """Encrypt and store the given Bluesky credential value."""
+
+        self.set_app_password(credential_value)
+
     def get_app_password(self) -> str:
         """Decrypt and return the stored Bluesky app password."""
 
@@ -224,6 +234,11 @@ def get_app_password(self) -> str:
             self.app_password_encrypted.encode("utf-8")
         ).decode("utf-8")
 
+    def get_stored_credential(self) -> str:
+        """Decrypt and return the stored Bluesky credential value."""
+
+        return self.get_app_password()
+
     def save(self, *args, **kwargs):
         """Normalize stored account fields before persisting the credentials."""
 

core/tests/test_admin.py

@@ -193,7 +193,7 @@ def test_bluesky_credentials_admin_form_encrypts_app_password(source_admin_conte
         data={
             "project": source_admin_context.project.id,
             "handle": "@Alice.BSKY.social",
-            "app_password": "app-password",
+            "credential_input": "app-password",
             "pds_url": "https://pds.example.com/xrpc/",
             "is_active": True,
         }