[stable29] fix(JWTManager): Mark private key as sensitive

appinfo/info.xml

@@ -10,7 +10,7 @@ It is also possible to add links only for a given language, device type or user
 
 More information is available in the External sites documentation.]]></description>
 
-	<version>5.4.0</version>
+	<version>5.4.1</version>
 	<licence>agpl</licence>
 
 	<author>Joas Schilling</author>
@@ -40,6 +40,7 @@ More information is available in the External sites documentation.]]></descripti
 	<repair-steps>
 		<post-migration>
 			<step>OCA\External\Migration\CopyDefaultIcons</step>
+			<step>OCA\External\Migration\JWTTokenPrivateKeySensitive</step>
 		</post-migration>
 		<install>
 			<step>OCA\External\Migration\CopyDefaultIcons</step>

lib/JWTManager.php

@@ -117,7 +117,7 @@ protected function ensureTokenKeys(string $alg): void {
 			throw new \Exception('Unsupported algorithm ' . $alg);
 		}
 
-		$this->config->setValueString(Application::APP_ID, 'jwt_token_privkey_' . strtolower($alg), $secret);
+		$this->config->setValueString(Application::APP_ID, 'jwt_token_privkey_' . strtolower($alg), $secret, sensitive: true);
 		$this->config->setValueString(Application::APP_ID, 'jwt_token_pubkey_' . strtolower($alg), $public);
 	}
 

lib/Migration/JWTTokenPrivateKeySensitive.php

@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\External\Migration;
+
+use OCA\External\AppInfo\Application;
+use OCP\IAppConfig;
+use OCP\Migration\IOutput;
+use OCP\Migration\IRepairStep;
+
+class JWTTokenPrivateKeySensitive implements IRepairStep {
+	public function __construct(
+		private IAppConfig $config,
+	) {
+	}
+
+	public function getName() {
+		return 'Mark JWT token private key as sensitive';
+	}
+
+	public function run(IOutput $output): void {
+		foreach ($this->config->getKeys(Application::APP_ID) as $key) {
+			if (!str_starts_with($key, 'jwt_token_privkey_')) {
+				continue;
+			}
+
+			$secret = $this->config->getValueString(Application::APP_ID, $key);
+			$this->config->setValueString(Application::APP_ID, $key, $secret, sensitive: true);
+		}
+	}
+}