Fix V2 admin Web Search test failing for saved Foundry connections

[Paul Lizer (paullizer)]

Summary

• Test web search in V2 Admin Settings failed for a saved connection with "Foundry Project Endpoint is required", "Foundry API Version is required" and "Foundry Agent ID is required", even though every value was on screen. V2 saves the Foundry connection inside web_search_agent (declared through paths), but the connection test read each field key as a top-level setting. The test only worked while the values were unsaved edits, so it failed again after Save or a reload.
• Adds one stored-value lookup, readStoredFieldValue, and a key reader, readSettingValue, that follow a field's declared paths or settings_path. The connection-test payload moves into a pure buildConnectionTestPayload. The field index is now passed to the connection test, the section shell's visibility filter, the section status and the secret field.
• Admin impact: a saved Web Search connection, managed identity or service principal, is tested with its saved values. The fields for the saved authentication type are shown, the section reads as configured, and clearing a saved client secret shows the removal warning and Undo.
• The section shell's visibility filter had no field index at all. Once Analyze, Comparison or Merge was saved as enabled, the Document action capabilities card hid that action's limits. They now appear as the schema declares.

Review notes:

• readSettingValue does not substitute schema defaults, matching the dependency reader it replaces, so a condition holds only once a value is saved or chosen.
• ConnectionTest now requires fieldsByKey, so TypeScript rejects a call site that omits it.
• Not changed here: the section shell also never receives runtime flags. With ENABLE_MCP_UI on, the Inbound MCP card renders none of its flag-gated settings.

Linked issue

N/A - no tracking issue for this fix.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only (0.261.259 -> 0.261.260)
• deployers/version.txt bumped, or not needed because deployers/ was not changed (deployers/ not changed)

Testing / validation

• npx tsc -b --noEmit (in application/v2_ui): passed
• npm run build (in application/v2_ui): passed, with only the existing chunk-size warning
• python functional_tests/test_v2_admin_nested_setting_reads.py: passed, 8/8. This new end-to-end test:
  1. Saves a Foundry connection through the real normalize_admin_settings_updates.
  2. Masks it as the V2 settings GET does.
  3. Runs the real TypeScript readers against the real field schema.
  4. Sends the resulting payload through run_web_search_connection_test, with a stand-in that records the Foundry agent call.
• python -m pytest functional_tests/test_v2_admin_nested_setting_reads.py functional_tests/test_v2_admin_secret_field_handling.py -q: passed, 18 passed
• python functional_tests/test_v2_admin_section_shell.py: passed, 5/5, including 32 TypeScript logic checks (2 new)
• python functional_tests/test_v2_admin_secret_field_handling.py: passed, 10/10. Its structural check was updated for the path-aware stored value.
• node functional_tests/test_v2_admin_field_visibility.mjs: passed, 22/22
• python functional_tests/test_web_search_admin_connection_test.py: passed, 5/5
• python functional_tests/test_v2_admin_knowledge_web_research.py: passed, 9/9
• python functional_tests/test_docs_site_quality.py: passed, 6/6
• python functional_tests/test_docs_app_surface_coverage.py: passed, 7/7
• Other tests that import the changed modules all passed. Each was run as python functional_tests/<file> or node functional_tests/<file>:
  • test_v2_admin_capability_placement.py (7/7)
  • test_v2_admin_field_renderer_coverage.py (4/4)
  • test_v2_admin_inbound_mcp_parity.py (9/9)
  • test_v2_admin_settings_layout.py (5/5)
  • test_v2_admin_settings_live_shell_refresh.py (6/6)
  • test_v2_admin_workspaces_parity.py (11/11)
  • test_v2_model_catalog_workbench.py (3/3)
  • test_v2_admin_secret_fields.py (7/7)
  • test_v2_admin_settings_secret_handling.py (6/6)
  • test_v2_admin_settings_secret_redaction.py (4/4)
  • test_v2_admin_settings_normalization.py (15/15)
  • test_orchestration_planner_model_setting.py
  • test_v2_admin_agents_logic.mjs (40/40)
  • test_shared_ai_connections_ui_logic.mjs
  • test_v2_chat_content_checks.mjs
• python functional_tests/test_v2_admin_settings_schema.py: failed, 10/11. The failure, core-plugin-toggles.m365_trusted_download_hosts: default [] is not str, was already there and is unrelated; neither the schema nor that test changed.
• Mutation checks:
  • Removing paths support from readStoredFieldValue fails 6 of the 8 new end-to-end checks with the reported symptoms, including Endpoint sent as '' and a hidden Managed Identity Type.
  • Dropping the field index from SettingsSection's visibility filter fails the new shell check.
• Not run: a live Foundry agent call from a deployed app, and the browser UI tests.

Documentation

• Release notes updated, or not needed (v0.261.260 Bug Fixes entry in docs/explanation/release_notes.md)
• Feature documentation updated, or not needed (not needed for this bug fix)
• Fix documentation updated, or not needed (docs/explanation/fixes/V2_ADMIN_WEB_SEARCH_NESTED_SETTINGS_FIX.md)

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security()) (no new routes)
• Settings sent to non-admin frontends use sanitize_settings_for_user() (no change to settings exposure; admin settings page only, and secrets still arrive masked)
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS (no new dependencies)
• No secrets, keys, connection strings, or local-only artifacts are included (test values are synthetic)