From 86ea75026fbff4e2cfc63a4756148bb3f89791a1 Mon Sep 17 00:00:00 2001
From: Prem Palanisamy <i.prem.tsd@gmail.com>
Date: Thu, 12 Feb 2026 16:30:57 +0000
Subject: [PATCH] Guard consoleApiKey to same-instance migrations only

Revert controller to original form without console API key generation
to avoid leaking JWT to untrusted remote endpoints. In the worker,
only set consoleApiKey when the source endpoint matches the local
endpoint, ensuring the locally-signed JWT is never sent cross-instance.
---
 app/controllers/api/migrations.php           | 13 +------------
 src/Appwrite/Platform/Workers/Migrations.php |  8 +++++++-
 2 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/app/controllers/api/migrations.php b/app/controllers/api/migrations.php
index 5bf4813403..9d5e013cdc 100644
--- a/app/controllers/api/migrations.php
+++ b/app/controllers/api/migrations.php
@@ -1,6 +1,5 @@
 <?php
 
-use Ahc\Jwt\JWT;
 use Appwrite\Event\Event;
 use Appwrite\Event\Migration;
 use Appwrite\Extend\Exception;
@@ -719,17 +718,7 @@ Http::get('/v1/migrations/appwrite/report')
     ->inject('user')
     ->action(function (array $resources, string $endpoint, string $projectID, string $key, Response $response) {
 
-        $consoleApiKey = '';
-        $openSslKey = System::getEnv('_APP_OPENSSL_KEY_V1');
-        if (!empty($openSslKey)) {
-            $jwt = new JWT($openSslKey, 'HS256', 86400, 0);
-            $consoleApiKey = API_KEY_DYNAMIC . '_' . $jwt->encode([
-                'projectId' => 'console',
-                'scopes' => ['platforms.read', 'keys.read'],
-            ]);
-        }
-
-        $appwrite = new Appwrite($projectID, $endpoint, $key, consoleApiKey: $consoleApiKey, sourceProjectId: $projectID);
+        $appwrite = new Appwrite($projectID, $endpoint, $key);
 
         try {
             $report = $appwrite->report($resources);
diff --git a/src/Appwrite/Platform/Workers/Migrations.php b/src/Appwrite/Platform/Workers/Migrations.php
index 94fde774e2..3c5eec722c 100644
--- a/src/Appwrite/Platform/Workers/Migrations.php
+++ b/src/Appwrite/Platform/Workers/Migrations.php
@@ -385,7 +385,13 @@ class Migrations extends Action
                 $credentials['projectId'] = $credentials['projectId'] ?? $project->getId();
                 $credentials['apiKey'] = $credentials['apiKey'] ?? $tempAPIKey;
                 $credentials['endpoint'] = $credentials['endpoint'] ?? $endpoint;
-                $credentials['consoleApiKey'] = $credentials['consoleApiKey'] ?? $tempConsoleAPIKey;
+
+                // Only set consoleApiKey for same-instance migrations to avoid
+                // leaking a locally-signed JWT to untrusted remote servers
+                if (($credentials['endpoint'] ?? '') === $endpoint) {
+                    $credentials['consoleApiKey'] = $tempConsoleAPIKey;
+                    $credentials['sourceProjectId'] = $credentials['projectId'];
+                }
             }
 
             if ($migration->getAttribute('destination') === DestinationAppwrite::getName()) {