fix(api): avoid lazy loading nested server secrets

This commit is contained in:
Andras Bacsai
2026-07-02 17:47:22 +02:00
parent 13172849e1
commit 99f60228ad
5 changed files with 28 additions and 58 deletions
@@ -60,37 +60,11 @@ class DatabasesController extends Controller
'mariadb_root_password',
]);
$this->exposeNestedServerSecrets($database);
} else {
$this->hideNestedServerSecrets($database);
}
return serializeApiResponse($database);
}
private function hideNestedServerSecrets(Model $model): void
{
$server = $model->destination?->server;
if ($server === null) {
return;
}
$server->makeHidden([
'logdrain_axiom_api_key',
'logdrain_newrelic_license_key',
]);
if ($server->settings !== null) {
$server->settings->makeHidden([
'sentinel_token',
'sentinel_custom_url',
'logdrain_newrelic_license_key',
'logdrain_axiom_api_key',
'logdrain_custom_config',
'logdrain_custom_config_parser',
]);
}
}
/**
* Expose sensitive fields on eager-loaded nested Server + ServerSetting
* relations for callers with the `read:sensitive` or `root` token ability.