- Shipped
- September 5, 2026 at 1:52 AM UTC
- Author
- Kamo
- Commit
- b058af3
Every config panel posts only the fields it owns, flat, alongside the provider type -- the Google Workspace panel sends nothing but serviceAccountJson. PUT /api/email/provider collected those leftovers and wrote them as the WHOLE config blob, so saving mailbox access silently dropped any key another form had put there (a pinned customerId, an on-prem imapHost). Merge onto the stored config instead. The read side was the other half of the same complaint: the service-account key was write-only, posted in and never reported back, so an admin could not tell a key that saved from one that did not -- the box rendered empty either way. GET now reports whether a key is on file and names it by its two non-secret identifiers (client_email, and the client_id Google's Admin console asks for when authorizing domain-wide delegation). The private key is never returned.