added validation for forms, sensitive text fields have been masked

src/globals/SiteIntegrations/components/MaskedField.tsx

@@ -0,0 +1,30 @@
+'use client'
+import type { TextFieldClientComponent } from 'payload'
+
+import { useField } from '@payloadcms/ui'
+import { useState } from 'react'
+
+export const MaskedField: TextFieldClientComponent = ({ field, path }) => {
+  const { setValue, value } = useField<string>({ path })
+  const [revealed, setRevealed] = useState(false)
+  const label = typeof field?.label === 'string' ? field.label : (field?.name ?? path)
+
+  return (
+    <div className="field-type text">
+      <label className="field-label">{label}</label>
+      <div style={{ display: 'flex', gap: '.5rem' }}>
+        <input
+          autoComplete="off"
+          onChange={(e) => setValue(e.target.value)}
+          style={{ flex: 1 }}
+          type={revealed ? 'text' : 'password'}
+          value={value ?? ''}
+        />
+        <button onClick={() => setRevealed((r) => !r)} type="button">
+          {revealed ? 'Hide' : 'Reveal'}
+        </button>
+      </div>
+    </div>
+  )
+}
+export default MaskedField

src/globals/SiteIntegrations/fields/smtp.ts

@@ -36,6 +36,10 @@ export const smtpFields: Field[] = [
     type: 'text',
     admin: {
       description: 'SMTP account password.',
+      // Masked in the UI (••••) — stored plaintext, readable for SMTP auth.
+      components: {
+        Field: '@intecion/ipal-kit/client#MaskedField',
+      },
     },
   },
   {

src/globals/SiteIntegrations/fields/storage.ts

@@ -35,6 +35,10 @@ export const storageFields: Field[] = [
     type: 'text',
     admin: {
       description: 'R2 secret access key.',
+      // Masked in the UI (••••) — stored plaintext, readable for R2 auth.
+      components: {
+        Field: '@intecion/ipal-kit/client#MaskedField',
+      },
     },
   },
 ]

src/globals/SiteIntegrations/fields/turnstile.ts

@@ -21,6 +21,10 @@ export const turnstileFields: Field[] = [
     type: 'text',
     admin: {
       description: 'Secret key used for server-side verification.',
+      // Masked in the UI (••••) — stored plaintext, readable for verification.
+      components: {
+        Field: '@intecion/ipal-kit/client#MaskedField',
+      },
     },
   },
 ]