fix(JWTManager): Mark private key as sensitive

Signed-off-by: provokateurin <kate@provokateurin.de>

[skip ci]

appinfo/info.xml

@@ -44,6 +44,7 @@ More information is available in the External sites documentation.]]></descripti
 	<repair-steps>
 		<post-migration>
 			<step>OCA\External\Migration\CopyDefaultIcons</step>
+			<step>OCA\External\Migration\JWTTokenPrivateKeySensitive</step>
 		</post-migration>
 		<install>
 			<step>OCA\External\Migration\CopyDefaultIcons</step>

lib/JWTManager.php

@@ -105,7 +105,7 @@ protected function ensureTokenKeys(string $alg): void {
 			throw new \Exception('Unsupported algorithm ' . $alg);
 		}
 
-		$this->config->setValueString(Application::APP_ID, 'jwt_token_privkey_' . strtolower($alg), $secret);
+		$this->config->setValueString(Application::APP_ID, 'jwt_token_privkey_' . strtolower($alg), $secret, sensitive: true);
 		$this->config->setValueString(Application::APP_ID, 'jwt_token_pubkey_' . strtolower($alg), $public);
 	}
 

lib/Migration/JWTTokenPrivateKeySensitive.php

@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\External\Migration;
+
+use OCA\External\AppInfo\Application;
+use OCP\IAppConfig;
+use OCP\Migration\IOutput;
+use OCP\Migration\IRepairStep;
+
+class JWTTokenPrivateKeySensitive implements IRepairStep {
+	public function __construct(
+		private IAppConfig $config,
+	) {
+	}
+
+	public function getName() {
+		return 'Mark JWT token private key as sensitive';
+	}
+
+	public function run(IOutput $output): void {
+		foreach ($this->config->getKeys(Application::APP_ID) as $key) {
+			if (!str_starts_with($key, 'jwt_token_privkey_')) {
+				continue;
+			}
+
+			$secret = $this->config->getValueString(Application::APP_ID, $key);
+			$this->config->setValueString(Application::APP_ID, $key, $secret, sensitive: true);
+		}
+	}
+}