From 11a0d502be34f95a58f6694d3f2b2eda94510d95 Mon Sep 17 00:00:00 2001 From: anshul Date: Thu, 1 Oct 2026 12:03:32 +0530 Subject: [PATCH] Enforce same-user maker-checker restriction --- .../parts/0012_seed_default_platform_api_client.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fineract-provider/src/main/resources/db/changelog/tenant-store/parts/0012_seed_default_platform_api_client.xml b/fineract-provider/src/main/resources/db/changelog/tenant-store/parts/0012_seed_default_platform_api_client.xml index a75be07a2..b10999153 100644 --- a/fineract-provider/src/main/resources/db/changelog/tenant-store/parts/0012_seed_default_platform_api_client.xml +++ b/fineract-provider/src/main/resources/db/changelog/tenant-store/parts/0012_seed_default_platform_api_client.xml @@ -27,17 +27,17 @@ #/platform-admin/menu-access works out of the box the first time the app is stood up, without anyone needing shell/DB access to mint the first key by hand. It is deliberately the SAME raw value on every deployment/tenant (requested behaviour) rather than a random - one generated per install -- the trade-off, on purpose: this value is visible to anyone who + one generated per install - the trade-off, on purpose: this value is visible to anyone who can read this source file, exactly like a default admin password shipped in a seed script. It is a bootstrap convenience, not a secret. Rotate it for any deployment that is not purely local/dev: insert a new row with a real random key's hash (see ApiClientCredentialService's - hashing) and either deactivate or DELETE this row -- POST /v1/apiclients is intentionally + hashing) and either deactivate or DELETE this row - POST /v1/apiclients is intentionally disabled (see ApiClientAdminApiResource), so rotation is a direct m_api_client write, same as this seed. Raw key (only shown here, since it is fixed and not a secret to rotate away from): cbsx_default_platform_operator_key_2026 - api_key_hash below is SHA-256 of that exact string, hex-encoded, lowercase -- matching + api_key_hash below is SHA-256 of that exact string, hex-encoded, lowercase - matching ApiClientCredentialService#sha256Hex. -->