This the main repository for RSpace: rspace-web. Check https://github.com/rspace-os/rspace-web/blob/main/DevDocs/DeveloperNotes/GettingStarted/GettingStarted.md for setup instructions.
for user who generated API key the value of their key is no longer sent to front-end whenever 'My Profile' page is displayed, but only after user explicitly clicks on 'Show Key' link
when System Admin user 'operates as' they can no longer see user's API key ('Show Key' returns an error); System Admin can still generate new API key or revoke the old one, as there may be valid reasons for these actions (similarly how we do allow System Admin to reset user's password)
the /apiKeyInfo/all endpoint within UserDetailsSysAdminApi is now only available when deployment property sysadmin.apikey.access is set to true (it's false by default)
Solution to https://github.com/rspace-os/rspace-web/issues/73. This PR consists of multiple changes that should make retrieval of API key more secure and traceable.
The changes in behaviour:
/apiKeyInfo/all
endpoint withinUserDetailsSysAdminApi
is now only available when deployment propertysysadmin.apikey.access
is set totrue
(it'sfalse
by default)