feat: add user secrets management page by dylanhuff-at-coder · Pull Request #25371 · coder/coder

dylanhuff-at-coder · 2026-05-14T20:36:19Z

Adds the account settings UI for managing user secrets, including the table, add/edit/delete dialog, Storybook coverage, and route/sidebar entry.

Also updates the shared FeatureStageBadge early-access variant with dedicated Early Access styling, sizing, and label casing for the Secrets page.

Stacked on #25370.

This PR was generated by Coder Agents.

dylanhuff-at-coder · 2026-05-14T20:36:31Z

feat: auto-refresh user secrets page #25372
feat: add user secrets management page #25371 👈 (View in Graphite)
feat: add user secrets client utilities #25370
main

This stack of pull requests is managed by Graphite. Learn more about stacking.

github-actions · 2026-05-14T20:36:42Z

Docs preview

📖 View docs preview for docs/user-guides/user-secrets.md

…pload

…validation

… field errors

dylanhuff-at-coder · 2026-05-19T18:01:37Z

/coder-agents-review

coder-agents-review

Well-structured secrets management page with thorough Storybook coverage (15 stories, 14 with play functions). The component reuse is good: Dialog, Table, Badge, SettingsHeader, ErrorAlert, etc. The return-focus management for dialogs is genuine accessibility work. The FeatureStageBadge refactor is safe for existing consumers (verified all beta xs paths are unchanged).

1 P2, 8 P3, 7 Nit.

The P2 is a security misrepresentation: the dialog says "Secrets are encrypted" but this is only true with the enterprise dbcrypt layer. AGPL deployments store values in plaintext. A user reading this claim might skip using an external vault.

The most convergent P3 (7/19 reviewers flagged independently): the three new Promise wrappers around mutate() in SecretsPage.tsx. Every sibling page in UserSettingsPage/ uses mutateAsync with try/catch. The manual wrappers produce correct behavior but add ~45 lines of indirection that mutateAsync eliminates. This refactor also subsumes the unnecessary useCallback wrappers and the onMutationError helper.

A related P3: the create/update error path fires both a toast AND inline form errors for the same failure. The mutateAsync refactor is the right time to decide which channel owns error display.

"If the user presses Escape while the form is submitting, the dialog closes and the Radix portal unmounts the form. The mutation continues in the background. On error, the toast fires but the form-level error display is lost because the component is unmounted." (Mafuuu)

Process note: commit 939dc440 subject "address user secrets review feedback" tells a reader nothing about what changed. Good subjects elsewhere in the branch ("preserve secret API field errors", "use backend secret validation").

🤖 This review was automatically generated with Coder Agents.

Use mutateAsync for secret mutations, keep create and update errors inline, and keep delete failures toasted. Prevent closing the secret dialog while submitting, tighten warning copy, and expand Storybook coverage for dialog edge cases. Align feature badge and secret type labels without changing layout.

zedkipp · 2026-05-22T14:10:45Z

+				autoComplete="off"
+				className="placeholder:text-content-disabled"
+				data-lpignore="true"
+				data-1p-ignore="true"


what's the thinking behind telling password mangers to ignore this field? I use a password manager that can fill in things like this when configured.

This field is file path which seems less likely to be filled in by password managers, value (which is below) won't be ignored by password managers. Tracy and I were both having the experience of password managers being overly eager to fill in all the fields in this pop-out, which was a little annoying, so I added password manager ignore to a few fields to help

zedkipp

I don't think I can give a meaningful deep review of the frontend code, so you'll want some frontend folks eyes on this. I did some manual testing and it looks good functionality wise.

…log nits

coder-tasks · 2026-05-22T19:59:24Z

Documentation Check

Updates Needed

docs/user-guides/user-secrets.md - The existing docs cover only CLI and REST API usage (coder secret create, coder secret update, etc.). This PR adds a web UI for managing secrets via Account Settings > Secrets. The docs should mention that secrets can also be created, edited, and deleted from the Coder dashboard, with a brief description of how to navigate there (e.g., click your avatar > Account > Secrets).

Automated review via Coder Agents

Mention dashboard management in user secrets docs and wait for the Clear button to become visible in the Storybook interaction to avoid dialog animation races.

jakehwll

Big PR so I'm going to do another pass later 🙂

Nothing too scary, but this is a few pointers to get this closer

jakehwll · 2026-05-25T03:05:53Z

+};
+
+const infoText = "Secret values cannot be retrieved once saved.";
+const savedSecretValueDisplay = "••••••••••••••••••••";


Whynot just render the value as a type="password" ?

Yeah I did this so since type="password" was exacerbating the over eager password manager suggestions that we were seeing

jakehwll · 2026-05-25T03:19:57Z

+	useEffect(() => {
+		if (open) {
+			setClearValueRequested(false);
+		}
+	}, [open]);


I don't love this use of useEffect to keep another value in sync..

Good call, I removed the mirrored state/effect and made isShowingSavedValue derived from the current props plus a small piece of interaction state. The field remounts when the edit dialog opens, so the hidden-saved-value state resets without needing an effect to keep it in sync.

dylanhuff-at-coder mentioned this pull request May 14, 2026

feat: add user secrets client utilities #25370

Merged

github-actions Bot assigned dylanhuff-at-coder May 14, 2026

dylanhuff-at-coder mentioned this pull request May 14, 2026

feat: auto-refresh user secrets page #25372

Closed

dylanhuff-at-coder force-pushed the dylan/plat-102-user-secrets-client-utilities branch from afe1534 to d6ed353 Compare May 14, 2026 21:57

dylanhuff-at-coder force-pushed the dylan/plat-102-user-secrets-settings-page branch 4 times, most recently from 6ca38b7 to 8f346c5 Compare May 19, 2026 15:50

dylanhuff-at-coder force-pushed the dylan/plat-102-user-secrets-client-utilities branch from 2ed690a to 3515ca7 Compare May 19, 2026 15:50

Base automatically changed from dylan/plat-102-user-secrets-client-utilities to main May 19, 2026 16:30

dylanhuff-at-coder added 5 commits May 19, 2026 16:35

feat: add user secrets management page

74e8950

refactor: remove user secrets bulk import UI

ba03d68

refactor(site/src/pages/UserSettingsPage/SecretsPage): remove value u…

84ac165

…pload

fix(site/src/pages/UserSettingsPage/SecretsPage): use backend secret …

6568aeb

…validation

fix(site/src/pages/UserSettingsPage/SecretsPage): preserve secret API…

57e2ed5

… field errors

dylanhuff-at-coder force-pushed the dylan/plat-102-user-secrets-settings-page branch from 8f346c5 to 57e2ed5 Compare May 19, 2026 16:37

fix(site/src): address user secrets review feedback

939dc44

coder-agents-review Bot suggested changes May 19, 2026

View reviewed changes

dylanhuff-at-coder marked this pull request as ready for review May 20, 2026 00:53

dylanhuff-at-coder requested review from aslilac, tracyjohnsonux and zedkipp May 20, 2026 00:53

zedkipp reviewed May 20, 2026

View reviewed changes

dylanhuff-at-coder added 2 commits May 21, 2026 22:42

fix(site/src): update user secret dialog examples

319e987

zedkipp reviewed May 22, 2026

View reviewed changes

Comment thread site/src/pages/UserSettingsPage/SecretsPage/SecretDialog.tsx Outdated

zedkipp reviewed May 22, 2026

View reviewed changes

Comment thread site/src/pages/UserSettingsPage/SecretsPage/SecretDialog.tsx Outdated

zedkipp reviewed May 22, 2026

View reviewed changes

zedkipp approved these changes May 22, 2026

View reviewed changes

dylanhuff-at-coder added 2 commits May 22, 2026 14:47

fix(site/src/pages/UserSettingsPage/SecretsPage): address secrets dia…

0af92a9

…log nits

fix(site): allow clearing user secret values

a755d67

dylanhuff-at-coder added 2 commits May 22, 2026 20:17

fix: document user secrets dashboard

ffbf3f0

Mention dashboard management in user secrets docs and wait for the Clear button to become visible in the Storybook interaction to avoid dialog animation races.

test(site/e2e): wait for workspace update submit

4e4e809

aslilac reviewed May 22, 2026

View reviewed changes

Comment thread site/src/pages/UserSettingsPage/SecretsPage/SecretsTable.tsx Outdated

jakehwll reviewed May 25, 2026

View reviewed changes

dylanhuff-at-coder added 3 commits May 26, 2026 15:55

fix(site): address user secrets review feedback

1adb1af

fix(site): remove undocumented early access color tokens

27f2682

fix(site/src/pages/UserSettingsPage): update secrets stage badge

fa9550f

dylanhuff-at-coder merged commit 7887cff into main May 26, 2026
30 checks passed

dylanhuff-at-coder deleted the dylan/plat-102-user-secrets-settings-page branch May 26, 2026 18:51

github-actions Bot locked and limited conversation to collaborators May 26, 2026

Conversation

dylanhuff-at-coder commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dylanhuff-at-coder commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 14, 2026

Docs preview

Uh oh!

dylanhuff-at-coder commented May 19, 2026

Uh oh!

coder-agents-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zedkipp May 22, 2026

Choose a reason for hiding this comment

Uh oh!

dylanhuff-at-coder May 22, 2026

Choose a reason for hiding this comment

Uh oh!

zedkipp left a comment

Choose a reason for hiding this comment

Uh oh!

coder-tasks Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Check

Updates Needed

Uh oh!

Uh oh!

jakehwll left a comment

Choose a reason for hiding this comment

Uh oh!

jakehwll May 25, 2026

Choose a reason for hiding this comment

Uh oh!

dylanhuff-at-coder May 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jakehwll May 25, 2026

Choose a reason for hiding this comment

Uh oh!

dylanhuff-at-coder May 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

dylanhuff-at-coder commented May 14, 2026 •

edited

Loading

dylanhuff-at-coder commented May 14, 2026 •

edited

Loading

coder-tasks Bot commented May 22, 2026 •

edited

Loading