Enforce same-user maker-checker restriction

2026-10-01 12:03:32 +05:30
parent 2afd4aaf83
commit 11a0d502be
1 changed files with 3 additions and 3 deletions
@@ -27,17 +27,17 @@
         #/platform-admin/menu-access works out of the box the first time the app is stood up,
         without anyone needing shell/DB access to mint the first key by hand. It is deliberately
         the SAME raw value on every deployment/tenant (requested behaviour) rather than a random
-         one generated per install -- the trade-off, on purpose: this value is visible to anyone who
+         one generated per install - the trade-off, on purpose: this value is visible to anyone who
         can read this source file, exactly like a default admin password shipped in a seed script.
         It is a bootstrap convenience, not a secret. Rotate it for any deployment that is not purely
         local/dev: insert a new row with a real random key's hash (see ApiClientCredentialService's
-         hashing) and either deactivate or DELETE this row -- POST /v1/apiclients is intentionally
+         hashing) and either deactivate or DELETE this row - POST /v1/apiclients is intentionally
         disabled (see ApiClientAdminApiResource), so rotation is a direct m_api_client write, same
         as this seed.

         Raw key (only shown here, since it is fixed and not a secret to rotate away from):
             cbsx_default_platform_operator_key_2026
-         api_key_hash below is SHA-256 of that exact string, hex-encoded, lowercase -- matching
+         api_key_hash below is SHA-256 of that exact string, hex-encoded, lowercase - matching
         ApiClientCredentialService#sha256Hex. -->
    <changeSet id="0012_seed_default_platform_api_client" author="cbs-nitesh">
        <preConditions onFail="MARK_RAN">