test(core): Pin exact-name semantics of the credential overwrite skip list (no-changelog) (#35310)

packages/cli/src/__tests__/credentials-overwrites.test.ts

@@ -186,6 +186,23 @@ describe('CredentialsOverwrites', () => {
 
 				expect(result).toEqual({ password: 'pass' });
 			});
+
+			it('should still apply overwrites to an extending type when only its parent is in the skip list', () => {
+				// The skip list is exact-name: a skip entry on 'parent' must not change how
+				// 'test' (which extends 'parent') is treated, even when 'test' has a
+				// customized field. This allows skipping a base type without affecting
+				// the concrete types that inherit its overwrite.
+				globalConfig.credentials.overwrite.skipTypes = [
+					'parent',
+				] as unknown as CommaSeparatedStringArray<string>;
+
+				const result = credentialsOverwrites.applyOverwrite('test', {
+					username: 'custom-user',
+					password: '',
+				});
+
+				expect(result).toEqual({ username: 'custom-user', password: 'pass' });
+			});
 		});
 	});
 

packages/cli/src/services/__tests__/frontend.service.test.ts

@@ -902,6 +902,50 @@ describe('FrontendService', () => {
 			expect(credential.__skipManagedCreation).toBeUndefined();
 		});
 
+		it('should not propagate __skipManagedCreation from a skip-listed parent to extending types', () => {
+			// An overwrite keyed at a base type is inherited by extending types
+			// (__overwrittenProperties), but the skip list is exact-name: skipping the
+			// base must not disable managed creation for the extending types.
+			const baseCredential = {
+				name: 'microsoftOAuth2Api',
+				displayName: 'Microsoft OAuth2 API',
+				properties: [],
+			} as ICredentialType;
+			const childCredential = {
+				name: 'microsoftOutlookOAuth2Api',
+				displayName: 'Microsoft Outlook OAuth2 API',
+				properties: [],
+			} as ICredentialType;
+
+			loadNodesAndCredentials.types = {
+				credentials: [baseCredential, childCredential],
+				nodes: [],
+			};
+			(globalConfig as any).credentials = {
+				overwrite: { skipTypes: ['microsoftOAuth2Api'] },
+			};
+			(credentialsOverwrites.getAll as Mock).mockReturnValue({
+				microsoftOAuth2Api: { clientId: 'id', clientSecret: 'secret' },
+			});
+			(credentialTypes.getParentTypes as Mock).mockImplementation((name: string) =>
+				name === 'microsoftOutlookOAuth2Api' ? ['microsoftOAuth2Api', 'oAuth2Api'] : ['oAuth2Api'],
+			);
+
+			const { service } = createMockService();
+			(service as any).overwriteCredentialsProperties();
+
+			// both are marked overwritten (the extending type inherits the base entry)
+			expect(baseCredential.__overwrittenProperties).toEqual(['clientId', 'clientSecret']);
+			expect(childCredential.__overwrittenProperties).toEqual(['clientId', 'clientSecret']);
+			// but only the exact skip-list entry loses managed creation
+			expect(baseCredential.__skipManagedCreation).toBe(true);
+			expect(childCredential.__skipManagedCreation).toBeUndefined();
+
+			// restore shared mock defaults for subsequent tests
+			(credentialsOverwrites.getAll as Mock).mockReturnValue({});
+			(credentialTypes.getParentTypes as Mock).mockReturnValue([]);
+		});
+
 		describe('JWKS URI injection', () => {
 			const expectedJwksUri = 'http://localhost:5678/rest/.well-known/jwks.json';