Embeddings and Image generation have no connection test in V2, because the classic test route requires the raw secret in its payload

Summary

The V2 admin Connections card can test a model connection before saving it. The new Embeddings and Image generation sections cannot — there is no equivalent affordance, so an administrator configuring an embedding endpoint in V2 has no way to check it works short of indexing a document and watching for failure.

Why it was left out

The obvious fix — reuse the classic page's test button — does not transfer cleanly.

Connection testing in the classic admin page is not a set of per-capability routes. It is a single dispatching route, POST /api/admin/settings/test_connection, discriminated by a test_type field. Its payload is assembled by admin_settings.js from the current, unsaved form values, which necessarily includes the raw secret as typed into the form.

That is exactly the shape phase 3's new password field type is designed to avoid. It is a write-only control: a stored credential never occupies a form control, and a blank input means "keep what is stored" rather than travelling with the request. Wiring V2 into the existing test route would have meant reconstructing a payload with the credential in it, reintroducing the property the control was added to remove.

Rather than build a second payload shape around a live secret, phase 3 left testing on the classic page and flagged it.

What good would look like

A test endpoint that takes a reference to stored configuration rather than a bundle of form values — resolving the secret server-side the way resolve_admin_settings_secret_value already does for saves — so the credential never leaves the server. That would serve V2 for embeddings, image generation and any future capability, and would let the classic page stop shipping secrets in a test payload too.

An interim option is to test only already-saved configuration, which is the common case: configure, save, then test.

Worth noting the Connections card does not have this problem, because /api/models/test-connection accepts an endpoint payload and phase 1's editor holds an unsaved connection in memory by design. The asymmetry is between settings-document capabilities and connection resources, not an oversight in one of them.

Provenance

Found by the phase 3 session while implementing the Embeddings and Image generation sections. The brief assumed POST /api/admin/test-embedding-connection and /api/admin/test-image-connection existed; they do not. Recorded so the gap is a decision rather than an omission.

Related

• #1426 — Embeddings and Image generation (phase 3), which introduces the password field type
• #1415 — global model connections (phase 1, merged), whose Connections editor does have connection testing
• #1420, #1427 — other findings deliberately kept out of the AI Models stack

Start by tracing POST /api/admin/settings/test_connection in admin_settings.js, then inspect resolve_admin_settings_secret_value and the saved-settings flow. Define a stored-configuration test path covering Embeddings and Image generation without sending raw secrets; done means V2 can test saved configuration and the classic payload no longer carries credentials.