From 04398116131331ac1040e352967206cdbaf9c06f Mon Sep 17 00:00:00 2001 From: MOHAN Date: Thu, 2 Jul 2026 00:31:14 +0530 Subject: [PATCH] Sync legacy api_keys row when the single legacy key is regenerated MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit regenerate_api_key() only updated users.api_key_hash/prefix, leaving the backfilled 'Default (legacy)' row in api_keys stale after rotation — not a security issue (the old hash was still correctly rejected) but the Tokens page would show a wrong/orphaned prefix for a key that no longer works. Co-Authored-By: Claude Sonnet 5 --- src/mt_odoo_mcp/auth/service.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/mt_odoo_mcp/auth/service.py b/src/mt_odoo_mcp/auth/service.py index 7394596..7f865ab 100644 --- a/src/mt_odoo_mcp/auth/service.py +++ b/src/mt_odoo_mcp/auth/service.py @@ -97,12 +97,20 @@ def get_user_by_api_key(api_key: str) -> Optional[User]: def regenerate_api_key(user_id: int) -> str: - """Generate a new API key for the user. Returns the full key (shown once).""" + """Generate a new API key for the user. Returns the full key (shown once). + + Also syncs the backfilled 'Default (legacy)' row in api_keys (see + list_api_keys) if one exists, so the Tokens page doesn't show a stale + prefix/hash for a key that no longer works after rotation.""" full_key, key_hash, key_prefix = generate_api_key() db_execute( "UPDATE users SET api_key_hash = ?, api_key_prefix = ? WHERE id = ?", (key_hash, key_prefix, user_id), ) + db_execute( + "UPDATE api_keys SET key_hash = ?, key_prefix = ? WHERE user_id = ? AND name = 'Default (legacy)'", + (key_hash, key_prefix, user_id), + ) db_commit() return full_key