From 58e2fcbeee66f3f9096e9e434d4b69d975ddaac3 Mon Sep 17 00:00:00 2001
From: Nick O'Leary <nick.oleary@gmail.com>
Date: Mon, 15 Jan 2024 16:44:43 +0000
Subject: [PATCH] Ensure global-config credential env vars are merged on deploy
 Fixes #4508

---
 .../editor-client/src/js/ui/env-var.js        |  2 +-
 .../runtime/lib/nodes/credentials.js          | 25 ++++++++++++++++---
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/packages/node_modules/@node-red/editor-client/src/js/ui/env-var.js b/packages/node_modules/@node-red/editor-client/src/js/ui/env-var.js
index 998484858d..79c626af4c 100644
--- a/packages/node_modules/@node-red/editor-client/src/js/ui/env-var.js
+++ b/packages/node_modules/@node-red/editor-client/src/js/ui/env-var.js
@@ -71,7 +71,7 @@ RED.envVar = (function() {
                 };
                 if (item.name.trim() !== "") {
                     new_env.push(item);
-                    if ((item.type === "cred") && (item.value !== "__PWRD__")) {
+                    if (item.type === "cred") {
                         credentials.map[item.name] = item.value;
                         credentials.map["has_"+item.name] = (item.value !== "");
                         item.value = "__PWRD__";
diff --git a/packages/node_modules/@node-red/runtime/lib/nodes/credentials.js b/packages/node_modules/@node-red/runtime/lib/nodes/credentials.js
index 73567f7c4f..856e5561b9 100644
--- a/packages/node_modules/@node-red/runtime/lib/nodes/credentials.js
+++ b/packages/node_modules/@node-red/runtime/lib/nodes/credentials.js
@@ -384,10 +384,27 @@ var api = module.exports = {
                     }
                 }
             } else if (nodeType === "global-config") {
-                if (JSON.stringify(savedCredentials.map) !== JSON.stringify(newCreds.map)) {
-                    savedCredentials.map = newCreds.map;
-                    dirty = true;
-                }
+                const existingCredentialKeys = Object.keys(savedCredentials?.map || [])
+                const newCredentialKeys = Object.keys(newCreds?.map || [])
+                existingCredentialKeys.forEach(key => {
+                    if (!newCreds.map?.[key]) {
+                        // This key doesn't exist in the new credentials list - remove
+                        delete savedCredentials.map[key]
+                        delete savedCredentials.map[`has_${key}`]
+                        dirty = true
+                    }
+                })
+                newCredentialKeys.forEach(key => {
+                    if (!/^has_/.test(key)) {
+                        if (!savedCredentials.map?.[key] || newCreds.map[key] !== '__PWRD__') {
+                            // This key either doesn't exist in current saved, or the
+                            // value has been changed
+                            savedCredentials.map[key] = newCreds.map[key]
+                            savedCredentials.map[`has_${key}`] = newCreds.map[`has_${key}`]
+                            dirty = true
+                        }
+                    }
+                })
             } else {
                 var dashedType = nodeType.replace(/\s+/g, '-');
                 var definition = credentialsDef[dashedType];