From a7cc32f249682a188deea80d336f6290157a2309 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 2 Oct 2026 17:03:55 +0200
Subject: [PATCH] fix(api): hide the legacy password quoting flag of KeyDB and
 Dragonfly

legacy_password_quoting is internal start-command state. Add it to the
hidden fields of both models, so the database API does not return it.
---
 app/Models/StandaloneDragonfly.php            |  2 +
 app/Models/StandaloneKeydb.php                |  2 +
 .../Api/LegacyPasswordQuotingApiTest.php      | 41 +++++++++++++++++++
 3 files changed, 45 insertions(+)
 create mode 100644 tests/Feature/Api/LegacyPasswordQuotingApiTest.php

diff --git a/app/Models/StandaloneDragonfly.php b/app/Models/StandaloneDragonfly.php
index 05bcba5d18..e3d70534dc 100644
--- a/app/Models/StandaloneDragonfly.php
+++ b/app/Models/StandaloneDragonfly.php
@@ -64,6 +64,8 @@ class StandaloneDragonfly extends BaseModel
         'dragonfly_password',
         'internal_db_url',
         'external_db_url',
+        // Internal start-command state, not part of the API.
+        'legacy_password_quoting',
     ];
 
     protected $casts = [
diff --git a/app/Models/StandaloneKeydb.php b/app/Models/StandaloneKeydb.php
index cb29dd612a..5961ead8ce 100644
--- a/app/Models/StandaloneKeydb.php
+++ b/app/Models/StandaloneKeydb.php
@@ -65,6 +65,8 @@ class StandaloneKeydb extends BaseModel
         'keydb_password',
         'internal_db_url',
         'external_db_url',
+        // Internal start-command state, not part of the API.
+        'legacy_password_quoting',
     ];
 
     protected $casts = [
diff --git a/tests/Feature/Api/LegacyPasswordQuotingApiTest.php b/tests/Feature/Api/LegacyPasswordQuotingApiTest.php
new file mode 100644
index 0000000000..549f955497
--- /dev/null
+++ b/tests/Feature/Api/LegacyPasswordQuotingApiTest.php
@@ -0,0 +1,41 @@
+<?php
+
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0], ['is_api_enabled' => true]));
+    Server::flushIdentityMap();
+
+    $this->team = Team::factory()->create();
+    $user = User::factory()->create();
+    $this->team->members()->attach($user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+    $this->bearerToken = $user->createToken('test-token', ['root'])->plainTextToken;
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $project->id]);
+});
+
+it('does not return the internal legacy password quoting flag in the database API', function (string $create) {
+    $database = $create($this->environment->id, $this->destination, []);
+    DB::table($database->getTable())->where('id', $database->id)->update(['legacy_password_quoting' => true]);
+
+    $headers = ['Authorization' => 'Bearer '.$this->bearerToken];
+    $single = $this->withHeaders($headers)->getJson("/api/v1/databases/{$database->uuid}")->assertOk();
+    $list = $this->withHeaders($headers)->getJson('/api/v1/databases')->assertOk();
+
+    expect($single->json())->not->toHaveKey('legacy_password_quoting')
+        ->and(collect($list->json())->firstWhere('uuid', $database->uuid))->not->toHaveKey('legacy_password_quoting');
+})->with(['keydb' => 'create_standalone_keydb', 'dragonfly' => 'create_standalone_dragonfly']);