OAuth secret for Microsoft 365 email channel fails to save #480

On an inbound email channel (“Support”, currently disabled) using OAuth with Microsoft 365, the Client Secret is empty after I click Save Changes. The other fields (Client ID, Tenant ID, Mailbox address) are kept. Connect Mailbox then fails validation because the required Client Secret is empty, so the mailbox stays “Not Connected”.

Steps to reproduce

Open the inbound email channel configuration (Configuration tab).
Set Authentication Method to OAuth and Provider to Microsoft 365.
Fill in Client ID, Client Secret, Tenant ID and Mailbox address.
Click Save Changes.
Reopen or refresh the configuration. The Client Secret field is empty and shows only the “Client secret value” placeholder.
Click Connect Mailbox. Validation fails on the empty Client Secret field.

Expected behavior
The Client Secret is stored on save. The UI may show it masked or leave the field blank with a “secret saved” indicator. Connect Mailbox then uses the stored secret and starts the OAuth flow.

Actual behavior
The Client Secret is not persisted, and the field is empty after saving. The UI says “Save settings, then connect your mailbox”, but that sequence can’t succeed because the secret is lost on save. The Client Secret is marked as required, so Connect Mailbox validation fails.

Impact
The Microsoft 365 OAuth mailbox can’t be connected, so inbound email for this channel can’t be set up. There is no workaround.

Environment

Windshift version: 0.9.3
Provider: Microsoft 365 (OAuth), tenant ID is set
Not yet tested: whether the Google OAuth provider behaves the same

Already checked

• The secret was pasted from the Azure app registration (the secret Value, not the Secret ID).
• No leading or trailing whitespace.
• Same result on repeated attempts.