fix(security): redact PasswordInput-masked field values from inline rows (#504)

The inline half of the #504 detail-view fix (#522). A field an inline
masks with `forms.PasswordInput` (typically
`formfield_overrides = {CharField: {"widget": PasswordInput}}`) was
serialized into the inline row payload **with its stored value intact** —
so a secret kept on that field shipped as plaintext in the detail JSON
(visible in the network tab), even though Django's admin renders a
PasswordInput with `render_value=False` and never echoes it back.

- `inlines.py`: `_password_redacted_fields` reads the inline's own bound
  form widgets (the source of truth Django already applied via
  `get_formset`, so `formfield_overrides` and a custom inline `form` are
  both honoured) and `_rows_for_inline` ships `null` for those fields —
  never reading or serializing the secret. `render_value=True` opts back
  in, matching the top-level fix. Degrades to no-redaction on any error
  (never 500s the parent detail).

This is the value-redaction (security) half — no wire-contract change
(the value was already nullable). Masking the inline input itself
(`widget: "password"` on `InlineFieldMeta`) is a wire-contract addition
left as a separate Tier-5 follow-up; the secret no longer leaks either way.

Tests (`tests/test_inlines.py`): a CharField masked via formfield_overrides
ships `null` for every row; a plain inline still ships the value (no
read-path regression); `render_value=True` preserves it. Inline + detail +
security + create + update suites green (102). ruff / mypy / black clean.

Refs #504, #522

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: martin-castro-laminr-ai

django_admin_react/api/inlines.py

@@ -32,6 +32,7 @@
 from django.db.models import ForeignKey
 from django.db.models import ManyToManyField
 from django.db.models import Model
+from django.forms.widgets import PasswordInput
 from django.http import HttpRequest
 
 from django_admin_react.api.serializers import field_type_for
@@ -293,6 +294,36 @@ def _fields_meta(
     return out
 
 
+def _password_redacted_fields(
+    inline: InlineModelAdmin, parent: Model, request: HttpRequest
+) -> set[str]:
+    """Inline field names whose stored value must be redacted from the row
+    payload because the admin masks them with ``forms.PasswordInput`` (#504
+    — the inline half of the detail-view fix in #522).
+
+    Django's admin renders a ``PasswordInput`` with ``render_value=False``
+    by default, so a secret kept on a field the inline routes through it
+    (typically ``formfield_overrides = {CharField: {"widget":
+    PasswordInput}}``) is never echoed back into the form. The SPA reads
+    inline values over the wire, so the equivalent is to drop the value
+    from the payload. Detection reads the inline's own bound form widgets
+    (the source of truth Django already applied), so ``formfield_overrides``
+    and a custom inline ``form`` are both honoured; a field the admin opted
+    into echoing (``render_value=True``) is left alone. Degrades to an empty
+    set on any error — never 500s the parent detail.
+    """
+    try:
+        base_fields = inline.get_formset(request, parent).form.base_fields
+    except Exception:  # pragma: no cover - defensive, mirrors this module
+        return set()
+    redacted: set[str] = set()
+    for name, field in base_fields.items():
+        widget = getattr(field, "widget", None)
+        if isinstance(widget, PasswordInput) and not getattr(widget, "render_value", False):
+            redacted.add(name)
+    return redacted
+
+
 def _rows_for_inline(
     inline: InlineModelAdmin,
     parent: Model,
@@ -306,10 +337,18 @@ def _rows_for_inline(
         queryset = inline.get_queryset(request).filter(**{fk_name: parent.pk})
     except Exception:  # pragma: no cover
         return []
+    # Fields the admin masks with PasswordInput: redact their value (#504),
+    # computed once for the whole inline rather than per row.
+    redacted = _password_redacted_fields(inline, parent, request)
     rows: list[dict[str, Any]] = []
     for obj in queryset:
         fields_payload: dict[str, Any] = {}
         for name in visible_fields:
+            if name in redacted:
+                # Never read or serialize a masked field's secret — ship
+                # null, matching PasswordInput(render_value=False).
+                fields_payload[name] = None
+                continue
             model_field = None
             try:
                 model_field = inline.model._meta.get_field(name)

tests/test_inlines.py

@@ -349,3 +349,86 @@ class _LinkedInline(TabularInline):
                 admin.site.unregister(Permission)
     assert spec is not None
     assert spec["show_change_link"] is False
+
+
+@pytest.mark.django_db
+def test_inline_passwordinput_field_value_is_redacted() -> None:
+    """A field an inline masks with ``forms.PasswordInput`` (via
+    ``formfield_overrides``) must NOT ship its stored value in the inline
+    row payload — the inline half of the #504 detail-view fix (#522).
+
+    Mirrors Django's default ``render_value=False``: the secret is never
+    echoed back. A plain inline (no override) still ships the value, so
+    there's no read-path regression.
+    """
+    from django import forms
+    from django.contrib.auth import get_user_model
+    from django.contrib.auth.models import Permission
+    from django.contrib.contenttypes.models import ContentType
+    from django.db import models
+    from django.test import RequestFactory
+
+    from django_admin_react.api.inlines import _rows_for_inline
+
+    ct = ContentType.objects.create(app_label="dar_test", model="vault")
+    Permission.objects.create(content_type=ct, codename="open", name="top-secret-value")
+
+    request = RequestFactory().get("/")
+    request.user = get_user_model().objects.create_superuser(
+        username="inline-pwd-su", email="pwd@example.com", password="x"  # noqa: S106
+    )
+
+    class _MaskedInline(TabularInline):
+        model = Permission
+        fk_name = "content_type"
+        formfield_overrides = {models.CharField: {"widget": forms.PasswordInput}}
+
+    masked = _rows_for_inline(
+        _MaskedInline(ContentType, admin.site), ct, "content_type", ["name", "codename"], request
+    )
+    assert len(masked) == 1
+    # The secret never leaves the server — value redacted to null.
+    assert masked[0]["fields"]["name"] is None
+    assert masked[0]["fields"]["codename"] is None
+
+    class _PlainInline(TabularInline):
+        model = Permission
+        fk_name = "content_type"
+
+    plain = _rows_for_inline(
+        _PlainInline(ContentType, admin.site), ct, "content_type", ["name", "codename"], request
+    )
+    # No override → value ships unredacted (no regression).
+    assert plain[0]["fields"]["name"] == "top-secret-value"
+
+
+@pytest.mark.django_db
+def test_inline_passwordinput_render_value_true_preserves_value() -> None:
+    """An inline that opts into ``PasswordInput(render_value=True)`` keeps
+    the value — same escape hatch as the top-level detail view (#522)."""
+    from django import forms
+    from django.contrib.auth import get_user_model
+    from django.contrib.auth.models import Permission
+    from django.contrib.contenttypes.models import ContentType
+    from django.db import models
+    from django.test import RequestFactory
+
+    from django_admin_react.api.inlines import _rows_for_inline
+
+    ct = ContentType.objects.create(app_label="dar_test", model="echo")
+    Permission.objects.create(content_type=ct, codename="show", name="kept-value")
+
+    request = RequestFactory().get("/")
+    request.user = get_user_model().objects.create_superuser(
+        username="inline-echo-su", email="echo@example.com", password="x"  # noqa: S106
+    )
+
+    class _EchoInline(TabularInline):
+        model = Permission
+        fk_name = "content_type"
+        formfield_overrides = {models.CharField: {"widget": forms.PasswordInput(render_value=True)}}
+
+    rows = _rows_for_inline(
+        _EchoInline(ContentType, admin.site), ct, "content_type", ["name"], request
+    )
+    assert rows[0]["fields"]["name"] == "kept-value"