Merge pull request #63332 from nextcloud/backport/63311/stable34

[stable34] fix(config): mask the Euro-Office jwt_secret as sensitive

Author: AndyScherzinger

lib/private/AppConfig.php

@@ -1615,6 +1615,9 @@ private function getSensitiveKeys(string $app): array {
 			'call_summary_bot' => [
 				'/^secret_(.*)$/',
 			],
+			'eurooffice' => [
+				'/^jwt_secret$/',
+			],
 			'external' => [
 				'/^sites$/',
 				'/^jwt_token_privkey_(.*)$/',

lib/private/SystemConfig.php

@@ -107,6 +107,9 @@ class SystemConfig {
 				],
 			],
 		],
+		'eurooffice' => [
+			'jwt_secret' => true,
+		],
 		'onlyoffice' => [
 			'jwt_secret' => true,
 		],

tests/lib/AppConfigTest.php

@@ -202,4 +202,35 @@ public function testWritesAreCached(): void {
 		$config->setValueString('appid', 'first-key', 'new value');
 		$this->assertSame('new value', $config->getValueString('appid', 'first-key'));
 	}
+
+	public function testFilteredValuesMaskTheEuroOfficeSecret(): void {
+		$this->localCache->expects(self::atLeastOnce())
+			->method('get')
+			->with('OC\\AppConfig')
+			->willReturn([
+				'fastCache' => [
+					'eurooffice' => [
+						'jwt_secret' => 'a-document-server-signing-key',
+						'jwt_header' => 'AuthorizationJwt',
+					],
+				],
+				'lazyCache' => [
+					'eurooffice' => [],
+				],
+				'valueTypes' => [
+					'eurooffice' => [
+						'jwt_secret' => AppConfig::VALUE_STRING,
+						'jwt_header' => AppConfig::VALUE_STRING,
+					],
+				],
+			]);
+
+		$this->connection->expects(self::never())->method('getQueryBuilder');
+		$config = $this->getAppConfig(true);
+
+		$this->assertSame([
+			'jwt_secret' => IConfig::SENSITIVE_VALUE,
+			'jwt_header' => 'AuthorizationJwt',
+		], $config->getFilteredValues('eurooffice'));
+	}
 }

tests/lib/SystemConfigTest.php

@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace Test;
+
+use OC\Config;
+use OC\SystemConfig;
+use OCP\IConfig;
+use PHPUnit\Framework\MockObject\MockObject;
+
+/**
+ * Class SystemConfigTest
+ *
+ * @package Test
+ */
+class SystemConfigTest extends TestCase {
+	private Config&MockObject $config;
+
+	#[\Override]
+	protected function setUp(): void {
+		parent::setUp();
+
+		$this->config = $this->createMock(Config::class);
+	}
+
+	public function testGetFilteredValueMasksTheEuroOfficeSecret(): void {
+		$this->config->method('getValue')
+			->willReturnMap([
+				['config_extra_sensitive_values', [], []],
+				['eurooffice', '', [
+					'editors_check_interval' => 0,
+					'jwt_secret' => 'a-document-server-signing-key',
+					'jwt_header' => 'AuthorizationJwt',
+				]],
+			]);
+
+		$systemConfig = new SystemConfig($this->config);
+
+		$this->assertSame([
+			'editors_check_interval' => 0,
+			'jwt_secret' => IConfig::SENSITIVE_VALUE,
+			'jwt_header' => 'AuthorizationJwt',
+		], $systemConfig->getFilteredValue('eurooffice'));
+	}
+}