From 7c18e4c93790833135a5f12575863efdf45aa3d0 Mon Sep 17 00:00:00 2001
From: LTbinglingfeng <tan13318527080@163.com>
Date: Mon, 1 Jun 2026 00:01:35 +0800
Subject: [PATCH] fix(forms): prevent browser autofill for API key fields

---
 .../providers/sheets/forms/AmpcodeForm.tsx        |  4 ++++
 .../providers/sheets/forms/BaseProviderForm.tsx   | 15 +++++++++++++--
 src/pages/LoginPage.tsx                           |  2 ++
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/src/features/providers/sheets/forms/AmpcodeForm.tsx b/src/features/providers/sheets/forms/AmpcodeForm.tsx
index 7e62f543..c1de3ed1 100644
--- a/src/features/providers/sheets/forms/AmpcodeForm.tsx
+++ b/src/features/providers/sheets/forms/AmpcodeForm.tsx
@@ -152,6 +152,10 @@ export function AmpcodeForm({
             onChange={(e) =>
               setForm((s) => ({ ...s, upstreamApiKey: e.target.value }))
             }
+            autoComplete="new-password"
+            data-1p-ignore="true"
+            data-lpignore="true"
+            data-bwignore="true"
             disabled={mutating}
           />
         </div>
diff --git a/src/features/providers/sheets/forms/BaseProviderForm.tsx b/src/features/providers/sheets/forms/BaseProviderForm.tsx
index 96bbd93c..f45c622b 100644
--- a/src/features/providers/sheets/forms/BaseProviderForm.tsx
+++ b/src/features/providers/sheets/forms/BaseProviderForm.tsx
@@ -127,8 +127,11 @@ function buildInitialForm(
   const disabled = hasDisableAllModelsRule(cfg.excludedModels);
   const excludedList = stripDisableAllRule(cfg.excludedModels);
   return {
-    // Populate apiKey from resource.raw in edit mode so the field is not empty
-    apiKey: cfg.apiKey ?? '',
+    // Keep the API key blank in edit mode. Pre-filling the real key makes this
+    // password field a browser-autofill target (the saved management key can
+    // overwrite it) and defeats the "leave empty = keep unchanged" contract; an
+    // empty field is preserved on save via buildProviderKeyConfig's existing fallback.
+    apiKey: '',
     name: '',
     baseUrl: cfg.baseUrl ?? '',
     proxyUrl: cfg.proxyUrl ?? '',
@@ -489,6 +492,10 @@ export function BaseProviderForm({
                 type={showSingleApiKey ? 'text' : 'password'}
                 value={form.apiKey}
                 onChange={(e) => updateField('apiKey', e.target.value)}
+                autoComplete="new-password"
+                data-1p-ignore="true"
+                data-lpignore="true"
+                data-bwignore="true"
                 placeholder={
                   mode === 'edit'
                     ? t('providersPage.form.apiKeyEditPlaceholder')
@@ -769,6 +776,10 @@ export function BaseProviderForm({
                             )
                           )
                         }
+                        autoComplete="new-password"
+                        data-1p-ignore="true"
+                        data-lpignore="true"
+                        data-bwignore="true"
                         disabled={mutating}
                         placeholder={t('providersPage.form.apiKeyCreatePlaceholder')}
                       />
diff --git a/src/pages/LoginPage.tsx b/src/pages/LoginPage.tsx
index bf610a10..fa899123 100644
--- a/src/pages/LoginPage.tsx
+++ b/src/pages/LoginPage.tsx
@@ -272,6 +272,8 @@ export function LoginPage() {
                 label={t('login.management_key_label')}
                 placeholder={t('login.management_key_placeholder')}
                 type={showKey ? 'text' : 'password'}
+                name="cpa-management-key"
+                autoComplete="current-password"
                 value={managementKey}
                 onChange={(e) => setManagementKey(e.target.value)}
                 onKeyDown={handleSubmitKeyDown}