From d1170836b87a8e61b8ed3aa461fe386371263395 Mon Sep 17 00:00:00 2001 From: Prem Palanisamy Date: Thu, 12 Feb 2026 16:40:20 +0000 Subject: [PATCH] Only generate consoleApiKey for same-instance migrations --- src/Appwrite/Platform/Workers/Migrations.php | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/src/Appwrite/Platform/Workers/Migrations.php b/src/Appwrite/Platform/Workers/Migrations.php index 3c5eec722c..2ebbf80edd 100644 --- a/src/Appwrite/Platform/Workers/Migrations.php +++ b/src/Appwrite/Platform/Workers/Migrations.php @@ -367,7 +367,6 @@ class Migrations extends Action $project = $this->project; $tempAPIKey = $this->generateAPIKey($project); - $tempConsoleAPIKey = $this->generateConsoleAPIKey(); $transfer = $source = $destination = null; @@ -386,10 +385,10 @@ class Migrations extends Action $credentials['apiKey'] = $credentials['apiKey'] ?? $tempAPIKey; $credentials['endpoint'] = $credentials['endpoint'] ?? $endpoint; - // Only set consoleApiKey for same-instance migrations to avoid - // leaking a locally-signed JWT to untrusted remote servers - if (($credentials['endpoint'] ?? '') === $endpoint) { - $credentials['consoleApiKey'] = $tempConsoleAPIKey; + // Only generate and set consoleApiKey for same-instance migrations + // to avoid leaking a locally-signed JWT to untrusted remote servers + if ($credentials['endpoint'] === $endpoint) { + $credentials['consoleApiKey'] = $this->generateConsoleAPIKey(); $credentials['sourceProjectId'] = $credentials['projectId']; } }