Virtual Registry upstream edit fails when password field is not re-entered

Problem

When editing a Virtual Registry upstream that has existing credentials, users encounter a validation error if they modify any field other than the password field and attempt to save.

Steps to reproduce

  1. Create an upstream with Maven Central URL, username, and password
  2. Edit that upstream - the username is displayed, but the password field shows placeholder *****
  3. Change any field (e.g., name, description) without re-entering the password
  4. Save the changes
  5. Result: password can't be blank validation error

Expected behavior

Users should be able to edit non-credential fields without being forced to re-enter the password, as long as the existing credentials remain unchanged.

Root cause

The form sends the username field but not the password (since it's masked), causing the backend validation to fail when both username and password are expected together.

Proposed solution

Implement conditional field sending logic:

  • Only send username/password fields if they were actually modified by the user
  • Preserve existing credentials when only non-credential fields are updated
  • Consider using a "change password" checkbox or similar UX pattern

Impact

This affects the user experience for Virtual Registry management, forcing users to re-enter passwords unnecessarily when making simple edits to upstream configurations.

Implementation

Backend:

  • Update Maven upstream model validation. Check if it's a new record, if not, check if username or password has changed before running validation
  • Ensure existing password does not get overwritten with an empty string when updating non credential field
  • Update frontend form to remove credentials if url is changed.
  • Nice to have, if url is back to original, restore creds.

Frontend:

On edit, we currently send through all form values, whether they have been changed or not.

Only send through username/password if they have changed

-[ ] Update ee/app/assets/javascripts/packages_and_registries/virtual_registries/pages/maven/upstreams/edit.vue to check password username form fields before sending through as part of the payload.

  • [TBC question below] If the url changes, how do we want to handle credentials? Do these reset or do we want to keep the existing creds. We want to keep the existing behaviour to reset creds. Potential UX improvement here is to reset the credential fields in the form if the url changes, currently the form keeps and displays the username and pw placeholder and sends through in the payload, which get reset on the backend anyway.
Edited by Fiona McCawley