From 017d73f48cb184fba815525705bcf550c60829d5 Mon Sep 17 00:00:00 2001
From: Zac Gaetano <zgaetano@wilddragon.net>
Date: Mon, 6 Apr 2026 20:39:22 -0400
Subject: [PATCH] Fix S3 config form: autofill, region default, secret field

- Add readonly+onfocus trick to prevent browser autofilling secret key with garbage
- Set region value="us-east-1" so it always has a real default, not just placeholder
- loadS3Config always clears secret field and sets contextual placeholder
- Secret hint now clearly shows saved vs not-saved state

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 public/index.html | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/public/index.html b/public/index.html
index 53bfbb1..e694d99 100644
--- a/public/index.html
+++ b/public/index.html
@@ -532,13 +532,13 @@ body::before{content:'';position:fixed;inset:0;background:radial-gradient(ellips
         <div class="form-hint">For MinIO, Backblaze, Cloudflare R2, Wasabi, etc. enter the full endpoint URL. Leave blank to use standard AWS S3.</div>
       </div>
       <div class="form-row">
-        <div class="form-group"><label class="form-label">Region</label><input class="form-input" id="s3-region" type="text" placeholder="us-east-1"/></div>
-        <div class="form-group"><label class="form-label">Bucket Name</label><input class="form-input" id="s3-bucket" type="text" placeholder="mybucket"/></div>
+        <div class="form-group"><label class="form-label">Region</label><input class="form-input" id="s3-region" type="text" placeholder="us-east-1" value="us-east-1" autocomplete="off"/></div>
+        <div class="form-group"><label class="form-label">Bucket Name</label><input class="form-input" id="s3-bucket" type="text" placeholder="mybucket" autocomplete="off"/></div>
       </div>
-      <div class="form-group"><label class="form-label">Access Key ID</label><input class="form-input" id="s3-access-key" type="text" autocomplete="off"/></div>
+      <div class="form-group"><label class="form-label">Access Key ID</label><input class="form-input" id="s3-access-key" type="text" autocomplete="off" spellcheck="false"/></div>
       <div class="form-group">
         <label class="form-label">Secret Access Key</label>
-        <input class="form-input" id="s3-secret-key" type="password" placeholder="Leave blank to keep existing" autocomplete="new-password"/>
+        <input class="form-input" id="s3-secret-key" type="password" placeholder="Enter new secret — leave blank to keep existing" autocomplete="off" readonly onfocus="this.removeAttribute('readonly')"/>
         <div class="form-hint" id="s3-secret-hint"></div>
       </div>
       <div class="btn-row">
@@ -1153,7 +1153,11 @@ async function loadS3Config() {
     document.getElementById('s3-region').value=d.config.region||'us-east-1';
     document.getElementById('s3-bucket').value=d.config.bucket||'';
     document.getElementById('s3-access-key').value=d.config.accessKeyId||'';
-    document.getElementById('s3-secret-hint').textContent=d.config.secretKeyExists?'🔒 Secret saved — leave blank to keep.':'No secret saved.';
+    // Clear secret field and show status — never pre-fill passwords
+    const secretEl=document.getElementById('s3-secret-key');
+    secretEl.value='';
+    secretEl.placeholder=d.config.secretKeyExists?'Leave blank to keep existing secret':'Enter secret access key';
+    document.getElementById('s3-secret-hint').textContent=d.config.secretKeyExists?'🔒 Secret key is saved.':'⚠️ No secret saved yet.';
   } catch(_) {}
 }
 async function testS3() {