From 2a6c16898d1c51693cf3566312137436e7e201d1 Mon Sep 17 00:00:00 2001 From: David Eugui Date: Wed, 19 Aug 2026 13:55:21 +0200 Subject: [PATCH] fix(controlplane): avoid re-logging caller-supplied seed API key Prior to this change, the seed script unconditionally logged the organization API key to stdout via a bare console.log, bypassing the pino logger used elsewhere in the script. Every shipped invocation path always supplies API_KEY explicitly, so in practice this line only ever re-echoed a secret the caller already had. This change only logs the key when it was auto-generated by ApiKeyGenerator (i.e. API_KEY was not set). --- controlplane/src/bin/get-config.ts | 1 + controlplane/src/bin/seed.ts | 7 ++++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/controlplane/src/bin/get-config.ts b/controlplane/src/bin/get-config.ts index b7a62ea504..9d02544f65 100644 --- a/controlplane/src/bin/get-config.ts +++ b/controlplane/src/bin/get-config.ts @@ -10,6 +10,7 @@ const getConfig = () => { apiUrl: process.env.KC_API_URL || 'http://localhost:8080', apiKey: process.env.API_KEY || ApiKeyGenerator.generate(), + apiKeyWasGenerated: !process.env.API_KEY, userEmail: process.env.USER_EMAIL || 'foo@wundergraph.com', userPassword: process.env.USER_PASSWORD || 'wunder@123', diff --git a/controlplane/src/bin/seed.ts b/controlplane/src/bin/seed.ts index 94a68be2c3..2f53474ee8 100644 --- a/controlplane/src/bin/seed.ts +++ b/controlplane/src/bin/seed.ts @@ -18,6 +18,7 @@ const { clientId, apiUrl, apiKey, + apiKeyWasGenerated, userEmail, userPassword, userFirstName, @@ -131,7 +132,11 @@ try { timeout: 1, }); - console.log(`API Key: ${apiKey}`); + if (apiKeyWasGenerated) { + console.log(`API Key: ${apiKey}`); + } else { + console.log('API Key: using the value provided via the API_KEY environment variable'); + } console.log('Done'); // eslint-disable-next-line unicorn/no-process-exit