fix(configuration): treat empty secret as explicit clear

[ehooi]

What type of PR is this?

• Bug Fix

Description

When a user clears a password field in the UI and saves, the empty string is persisted to the data source options as-is. Downstream SDKs (e.g. boto3) then receive an explicit empty credential instead of falling back to the default credential chain, and authentication fails with empty keys (observed with the Athena data source's aws_secret_key).

Distinguish the placeholder ("--------", meaning "no change") from an empty string ("explicit clear") and drop the latter from the stored options.

How is this tested?

• Unit tests (pytest, jest)
• Manually

Related Tickets & Documents

N/A

Mobile & Desktop Screenshots/Recordings (if there are UI changes)

N/A - backend-only change.

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}

[greptile-apps]

Greptile Summary

This PR distinguishes unchanged secret placeholders from explicitly cleared secrets and adds a unit test for removing cleared values.

• Caches the schema’s secret-field collection during configuration updates.
• Preserves existing values for placeholder submissions.
• Omits secrets submitted as empty strings.
• Adds coverage for explicit secret clearing.

Confidence Score: 4/5

This PR should not merge until clearing a schema-required secret is rejected rather than persisted as an invalid configuration.

Empty required secrets pass input validation before being deleted, and the resulting invalid options are committed without a second validation step.

Files Needing Attention: redash/utils/configuration.py

Important Files Changed

Filename	Overview
redash/utils/configuration.py	Adds explicit secret-clearing behavior, but performs deletion after validation and can persist a configuration missing a required secret.
tests/test_configuration.py	Covers removal of an optional emptied secret but not rejection of an emptied required secret.

_{Reviews (1): Last reviewed commit: "Merge branch 'master' into fix/empty-sec..." | Re-trigger Greptile}

[greptile-apps]

Required secrets bypass validation

When Athena runs with ATHENA_OPTIONAL_CREDENTIALS=false and ATHENA_ASSUME_ROLE=false, an empty aws_secret_key satisfies the required-field validation and is then removed before persistence, leaving the stored configuration invalid and causing subsequent queries to fail authentication instead of rejecting the update.