Protected settings fix (#5229)

* Hide protected setting in settings view

* Implement custom serializer for setting value

- Return '***' if the setting is protected

* Implement to_internal_value

* Stringify

* Add protected setting to sample plugin

* Unit tests for plugin settings API

* Update unit test

InvenTree/common/serializers.py

@@ -13,6 +13,25 @@ from InvenTree.serializers import (InvenTreeImageSerializerField,
                                    InvenTreeModelSerializer)
 
 
+class SettingsValueField(serializers.Field):
+    """Custom serializer field for a settings value."""
+
+    def get_attribute(self, instance):
+        """Return the object instance, not the attribute value."""
+        return instance
+
+    def to_representation(self, instance):
+        """Return the value of the setting:
+
+        - Protected settings are returned as '***'
+        """
+        return '***' if instance.protected else str(instance.value)
+
+    def to_internal_value(self, data):
+        """Return the internal value of the setting"""
+        return str(data)
+
+
 class SettingsSerializer(InvenTreeModelSerializer):
     """Base serializer for a settings object."""
 
@@ -30,6 +49,8 @@ class SettingsSerializer(InvenTreeModelSerializer):
 
     api_url = serializers.CharField(read_only=True)
 
+    value = SettingsValueField()
+
     def get_choices(self, obj):
         """Returns the choices available for a given item."""
         results = []
@@ -45,16 +66,6 @@ class SettingsSerializer(InvenTreeModelSerializer):
 
         return results
 
-    def get_value(self, obj):
-        """Make sure protected values are not returned."""
-        # never return protected values
-        if obj.protected:
-            result = '***'
-        else:
-            result = obj.value
-
-        return result
-
 
 class GlobalSettingsSerializer(SettingsSerializer):
     """Serializer for the InvenTreeSetting model."""