feat: secrets masqués — couverture universelle clés API/mots de passe + clic pour copier (#188)

frontend/js/viewer.js

@@ -7276,7 +7276,10 @@ export function renderFile(data) {
         prettyBtn.classList.add("active");
       } else {
         mdDiv.innerHTML = data.html;
-        mdDiv.querySelectorAll("pre code").forEach((block) => safeHighlight(block));
+        mdDiv.querySelectorAll("pre code").forEach((block) => {
+          if (block.querySelector(".secret-mask")) return;
+          safeHighlight(block);
+        });
         prettyBtn.classList.remove("active");
       }
     });
@@ -7327,8 +7330,10 @@ export function renderFile(data) {
     renderBacklinksPanel(data.vault, data.path, area);
   }
 
-  // Highlight code blocks
+  // Highlight code blocks — a block carrying a secret mask (#188) must be
+  // left alone: highlight.js rebuilds the markup and would drop the badge.
   area.querySelectorAll("pre code").forEach((block) => {
+    if (block.querySelector(".secret-mask")) return;
     safeHighlight(block);
   });
 
@@ -7370,6 +7375,23 @@ export function renderFile(data) {
     });
   });
 
+  // Secret masks (#188): click copies the real value to the clipboard.
+  // The handler is delegated (and attached once) so it survives re-renders.
+  area.querySelectorAll(".secret-mask").forEach((mask) => {
+    mask.title = t("viewer.secret_copy_hint");
+  });
+  if (!area.dataset.secretMaskWired) {
+    area.dataset.secretMaskWired = "1";
+    area.addEventListener("click", (e) => {
+      const mask = e.target instanceof Element ? e.target.closest(".secret-mask") : null;
+      if (!mask || !area.contains(mask)) return;
+      const secret = mask.getAttribute("data-secret");
+      if (!secret) return;
+      const ok = copyToClipboard(secret);
+      showToast(ok ? t("viewer.secret_copied") : t("viewer.secret_copy_failed"), ok ? "success" : "error");
+    });
+  }
+
   safeCreateIcons();
   area.scrollTop = 0;