opensource/mateclaw
2
0
Fork 0
mirror of https://gitee.com/mateos/mateclaw.git synced 2026-09-13 03:13:41 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(auth): suppress tokenHash from PAT JSON responses

Browse Source
This commit is contained in:
matevip 2026-05-02 15:41:47 +08:00
parent 9411dfff7b
commit a8d94681e5
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
mateclaw-server/src/main/java/vip/mate/auth/pat/PersonalAccessTokenEntity.java
View File

@ -1,6 +1,7 @@
package vip.mate.auth.pat;
import com.baomidou.mybatisplus.annotation.*;
import com.fasterxml.jackson.annotation.JsonIgnore;
import lombok.Data;
import java.time.LocalDateTime;
@ -26,7 +27,18 @@ public class PersonalAccessTokenEntity {
/** Human-readable label so the owner can tell tokens apart in the UI. */
private String name;
/** SHA-256 hex of the plaintext, lowercase. UNIQUE indexed for O(1) auth lookups. */
/**
* SHA-256 hex of the plaintext, lowercase. UNIQUE indexed for O(1) auth lookups.
*
* <p>{@link JsonIgnore} keeps the hash out of every JSON response —
* SHA-256 is not directly reversible, but exposing the digest is poor
* hygiene (lets an attacker who already has a candidate plaintext
* verify a match without trying to authenticate, leaks per-user token
* counts to anyone who can read the list endpoint, and would feed
* future rainbow-table attacks if we ever weakened the algorithm).
* Internally readable / writable by the service + mapper as usual.
*/
@JsonIgnore
private String tokenHash;
/**