From 458b39efb1b5e6a35c547a8d717334d767b43ba8 Mon Sep 17 00:00:00 2001
From: Christoph Schaefer <christoph.schaefer@nextcloud.com>
Date: Mon, 17 Aug 2026 10:38:00 +0200
Subject: [PATCH] fix(config): mask the Euro-Office jwt_secret as sensitive

Both sensitive-key allowlists carried an `onlyoffice` entry but nothing
for `eurooffice`, so the document server signing key was printed in
full while the ONLYOFFICE one next to it was redacted.

SystemConfig covers `occ config:list system`, which is where the key
lands when the app is configured through config.php. AppConfig covers
plain `occ config:list` and the admin support report, which is where it
lands when it is set through the app's own settings page.

Fixes: #63302

Assisted-by: ClaudeCode:claude-opus-5
Signed-off-by: Christoph Schaefer <christoph.schaefer@nextcloud.com>
---
 lib/private/AppConfig.php      |  3 ++
 lib/private/SystemConfig.php   |  3 ++
 tests/lib/AppConfigTest.php    | 31 +++++++++++++++++++++
 tests/lib/SystemConfigTest.php | 50 ++++++++++++++++++++++++++++++++++
 4 files changed, 87 insertions(+)
 create mode 100644 tests/lib/SystemConfigTest.php

diff --git a/lib/private/AppConfig.php b/lib/private/AppConfig.php
index 27a6b7563eadc..cd41d52b60eb6 100644
--- a/lib/private/AppConfig.php
+++ b/lib/private/AppConfig.php
@@ -1607,6 +1607,9 @@ private function getSensitiveKeys(string $app): array {
 			'call_summary_bot' => [
 				'/^secret_(.*)$/',
 			],
+			'eurooffice' => [
+				'/^jwt_secret$/',
+			],
 			'external' => [
 				'/^sites$/',
 				'/^jwt_token_privkey_(.*)$/',
diff --git a/lib/private/SystemConfig.php b/lib/private/SystemConfig.php
index 126ea7efbf8c1..312dfdeca2a93 100644
--- a/lib/private/SystemConfig.php
+++ b/lib/private/SystemConfig.php
@@ -108,6 +108,9 @@ class SystemConfig {
 				],
 			],
 		],
+		'eurooffice' => [
+			'jwt_secret' => true,
+		],
 		'onlyoffice' => [
 			'jwt_secret' => true,
 		],
diff --git a/tests/lib/AppConfigTest.php b/tests/lib/AppConfigTest.php
index c99e7d1244d56..66bd6604f88bd 100644
--- a/tests/lib/AppConfigTest.php
+++ b/tests/lib/AppConfigTest.php
@@ -200,4 +200,35 @@ public function testWritesAreCached(): void {
 		$config->setValueString('appid', 'first-key', 'new value');
 		$this->assertSame('new value', $config->getValueString('appid', 'first-key'));
 	}
+
+	public function testFilteredValuesMaskTheEuroOfficeSecret(): void {
+		$this->localCache->expects(self::atLeastOnce())
+			->method('get')
+			->with('OC\\AppConfig')
+			->willReturn([
+				'fastCache' => [
+					'eurooffice' => [
+						'jwt_secret' => 'a-document-server-signing-key',
+						'jwt_header' => 'AuthorizationJwt',
+					],
+				],
+				'lazyCache' => [
+					'eurooffice' => [],
+				],
+				'valueTypes' => [
+					'eurooffice' => [
+						'jwt_secret' => AppConfig::VALUE_STRING,
+						'jwt_header' => AppConfig::VALUE_STRING,
+					],
+				],
+			]);
+
+		$this->connection->expects(self::never())->method('getQueryBuilder');
+		$config = $this->getAppConfig(true);
+
+		$this->assertSame([
+			'jwt_secret' => IConfig::SENSITIVE_VALUE,
+			'jwt_header' => 'AuthorizationJwt',
+		], $config->getFilteredValues('eurooffice'));
+	}
 }
diff --git a/tests/lib/SystemConfigTest.php b/tests/lib/SystemConfigTest.php
new file mode 100644
index 0000000000000..e08922ddd3955
--- /dev/null
+++ b/tests/lib/SystemConfigTest.php
@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace Test;
+
+use OC\Config;
+use OC\SystemConfig;
+use OCP\IConfig;
+use PHPUnit\Framework\MockObject\MockObject;
+
+/**
+ * Class SystemConfigTest
+ *
+ * @package Test
+ */
+class SystemConfigTest extends TestCase {
+	private Config&MockObject $config;
+
+	#[\Override]
+	protected function setUp(): void {
+		parent::setUp();
+
+		$this->config = $this->createMock(Config::class);
+	}
+
+	public function testGetFilteredValueMasksTheEuroOfficeSecret(): void {
+		$this->config->method('getValue')
+			->willReturnMap([
+				['config_extra_sensitive_values', [], []],
+				['eurooffice', '', [
+					'editors_check_interval' => 0,
+					'jwt_secret' => 'a-document-server-signing-key',
+					'jwt_header' => 'AuthorizationJwt',
+				]],
+			]);
+
+		$systemConfig = new SystemConfig($this->config);
+
+		$this->assertSame([
+			'editors_check_interval' => 0,
+			'jwt_secret' => IConfig::SENSITIVE_VALUE,
+			'jwt_header' => 'AuthorizationJwt',
+		], $systemConfig->getFilteredValue('eurooffice'));
+	}
+}