CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 28 Packages Projects Releases Wiki Activity

fix: remove illegal -- from migration 0012's XML comment

Browse Source 
Same mistake as an earlier migration this session: a literal "--" inside
an XML comment is illegal per the XML spec and crashes the entire backend
startup (Liquibase's XML parser rejects the whole changelog, not just this
file). Reworded the prose to avoid it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
nitesh
2026-09-30 12:00:59 +05:30
co-authored by Claude Sonnet 5
parent 9436eab129
commit 82336cbe98
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fineract-provider/src/main/resources/db/changelog/tenant-store/parts/0012_seed_default_platform_api_client.xml
+8 -8
View File
@@ -27,17 +27,17 @@
#/platform-admin/menu-access works out of the box the first time the app is stood up, #/platform-admin/menu-access works out of the box the first time the app is stood up,
without anyone needing shell/DB access to mint the first key by hand. It is deliberately without anyone needing shell/DB access to mint the first key by hand. It is deliberately
the SAME raw value on every deployment/tenant (requested behaviour) rather than a random the SAME raw value on every deployment/tenant (requested behaviour) rather than a random
one generated per install -- the trade-off, on purpose: this value is visible to anyone who one generated per install: this is a deliberate trade-off, since this value is visible to
can read this source file, exactly like a default admin password shipped in a seed script. anyone who can read this source file, exactly like a default admin password shipped in a
It is a bootstrap convenience, not a secret. Rotate it for any deployment that is not purely seed script. It is a bootstrap convenience, not a secret. Rotate it for any deployment that
local/dev: insert a new row with a real random key's hash (see ApiClientCredentialService's is not purely local/dev: insert a new row with a real random key's hash (see
hashing) and either deactivate or DELETE this row -- POST /v1/apiclients is intentionally ApiClientCredentialService's hashing) and either deactivate or DELETE this row. POST
disabled (see ApiClientAdminApiResource), so rotation is a direct m_api_client write, same /v1/apiclients is intentionally disabled (see ApiClientAdminApiResource), so rotation is a
as this seed. direct m_api_client write, same as this seed.
Raw key (only shown here, since it is fixed and not a secret to rotate away from): Raw key (only shown here, since it is fixed and not a secret to rotate away from):
cbsx_default_platform_operator_key_2026 cbsx_default_platform_operator_key_2026
api_key_hash below is SHA-256 of that exact string, hex-encoded, lowercase -- matching api_key_hash below is SHA-256 of that exact string, hex-encoded, lowercase, matching
ApiClientCredentialService#sha256Hex. --> ApiClientCredentialService#sha256Hex. -->
<changeSet id="0012_seed_default_platform_api_client" author="cbs-nitesh"> <changeSet id="0012_seed_default_platform_api_client" author="cbs-nitesh">
<preConditions onFail="MARK_RAN"> <preConditions onFail="MARK_RAN">