[comp] Production Deploy

[github-actions]

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

[cursor]

PR Summary

Medium Risk
Exposes encrypted OAuth credential fields via the admin integrations API and adds client-side decryption/display of client secrets, which is sensitive and could increase blast radius if UI/env configuration is misused. Also updates the OpenAPI schema to require a new deactivated member flag, which may affect API consumers expecting the previous contract.

Overview
Admin integrations listing now returns encryptedClientId/encryptedClientSecret alongside existing credential metadata.

The admin integrations page decrypts these fields client-side (when available) and shows a new in-card credentials summary with a toggle to reveal/hide the secret.

OpenAPI schema is updated to add a required deactivated boolean on the member model.

^{Written by Cursor Bugbot for commit f38dd50. This will update automatically on new commits. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
comp-framework-editor	Ready	Preview, Comment	Apr 3, 2026 6:34pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app (staging)	Skipped		Apr 3, 2026 6:34pm
portal (staging)	Skipped		Apr 3, 2026 6:34pm

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

API exposes encrypted credentials enabling full plaintext retrieval

High Severity

The listIntegrations endpoint now returns encryptedClientId and encryptedClientSecret to the browser. These are then decrypted via a 'use server' action and the full plaintext OAuth client secrets end up in browser memory, SWR cache, and the DOM. This contradicts the existing security design — the sibling getIntegration endpoint on line 114 explicitly says // don't expose actual credentials. Previously only masked clientIdHint/clientSecretHint values were sent. The full secrets are now accessible to any XSS vector, browser extension, or session-hijack targeting an admin user.

Additional Locations (2)

• apps/app/src/app/(app)/[orgId]/admin/integrations/page.tsx#L27-L49
• apps/app/src/app/(app)/[orgId]/admin/integrations/components/IntegrationCard.tsx#L367-L402