From b04bd73f47fef3aa7ea7a5171601039093039ca6 Mon Sep 17 00:00:00 2001
From: "Maksym Hryzodub [DREAM]" <maksym.hryzodub@dreamvention.com>
Date: Mon, 24 Aug 2026 13:41:56 +0300
Subject: [PATCH] fix(admin): stop browser autofilling credential Label/API key
 as login (CLEAN-46)

Chrome ignores autocomplete="off" on password inputs and pairs the API
key field with the nearest text input (Label) as a username/password
form, injecting saved credentials. new-password on the key input plus
off + non-suggestive names on the label/form break the heuristic.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 admin/slices/llm/components/llm/item/Form.vue | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/admin/slices/llm/components/llm/item/Form.vue b/admin/slices/llm/components/llm/item/Form.vue
index 81b1833..60b61e8 100644
--- a/admin/slices/llm/components/llm/item/Form.vue
+++ b/admin/slices/llm/components/llm/item/Form.vue
@@ -90,7 +90,7 @@ function onSubmit(): void {
 </script>
 
 <template>
-  <form class="flex flex-col gap-6" @submit.prevent="onSubmit">
+  <form class="flex flex-col gap-6" autocomplete="off" @submit.prevent="onSubmit">
     <Card>
       <CardHeader>
         <CardTitle>Credential</CardTitle>
@@ -165,7 +165,13 @@ function onSubmit(): void {
           </div>
           <div class="grid gap-2">
             <Label for="label">Label (optional)</Label>
-            <Input id="label" v-model="form.label" placeholder="primary" />
+            <Input
+              id="label"
+              v-model="form.label"
+              name="credential-label"
+              autocomplete="off"
+              placeholder="primary"
+            />
           </div>
         </div>
 
@@ -219,7 +225,8 @@ function onSubmit(): void {
             id="apiKey"
             v-model="form.apiKey"
             type="password"
-            autocomplete="off"
+            name="credential-api-key"
+            autocomplete="new-password"
             placeholder="sk-ant-… / sk-…"
             :aria-invalid="!!errors.apiKey"
           />