From 6498903a7c623e799deb89d4aae3a130b1846061 Mon Sep 17 00:00:00 2001
From: cnbugs <717192502@qq.com>
Date: Fri, 24 Jul 2026 19:16:35 +0800
Subject: [PATCH] fix: credential data corruption - Create handler mutating
 store pointer

- CreateCredential was setting cred.Data = cred.Masked directly on the
  store pointer, corrupting stored credentials with masked data
- Fixed by using a value copy for API response
- Also fix nextID starts at 1 to avoid ID=0 issue
---
 backend/config/credential_store.go | 5 +++--
 backend/handlers/credential.go     | 7 ++++---
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/backend/config/credential_store.go b/backend/config/credential_store.go
index ce4d898..0e52118 100644
--- a/backend/config/credential_store.go
+++ b/backend/config/credential_store.go
@@ -71,8 +71,9 @@ var CredStore *CredentialStore
 // InitCredentialStore initializes the credential store
 func InitCredentialStore(cfg *Config) {
 	CredStore = &CredentialStore{
-		data: make(map[uint]*Credential),
-		path: cfg.DataDir + "/credentials.json",
+		data:   make(map[uint]*Credential),
+		path:   cfg.DataDir + "/credentials.json",
+		nextID: 1,
 	}
 
 	if err := CredStore.Load(); err != nil {
diff --git a/backend/handlers/credential.go b/backend/handlers/credential.go
index 74cf912..6ea2554 100644
--- a/backend/handlers/credential.go
+++ b/backend/handlers/credential.go
@@ -89,9 +89,10 @@ func (h *CredentialHandler) CreateCredential(c *gin.Context) {
 		return
 	}
 
-	// Return without secrets
-	cred.Data = cred.Masked
-	c.JSON(http.StatusCreated, cred)
+	// Return without secrets (use a copy to avoid mutating store)
+	resp := *cred
+	resp.Data = cred.Masked
+	c.JSON(http.StatusCreated, &resp)
 }
 
 // UpdateCredential updates a credential