From f5812cf7fa218e2cdc9f9c149fc7592940a030d4 Mon Sep 17 00:00:00 2001 From: Aimish <161852111+aim1sh@users.noreply.github.com> Date: Tue, 22 Sep 2026 19:49:04 +0500 Subject: [PATCH] fix(auth): hide instance token when exposure disabled Remove instance tokens from fetchInstances responses unless AUTHENTICATION_EXPOSE_IN_FETCH_INSTANCES is explicitly enabled. --- src/api/controllers/instance.controller.ts | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/src/api/controllers/instance.controller.ts b/src/api/controllers/instance.controller.ts index 4d468059b0..18387551e8 100644 --- a/src/api/controllers/instance.controller.ts +++ b/src/api/controllers/instance.controller.ts @@ -407,6 +407,16 @@ export class InstanceController { public async fetchInstances({ instanceName, instanceId, number }: InstanceDto, key: string) { const env = this.configService.get('AUTHENTICATION').API_KEY; + const exposeToken = this.configService.get('AUTHENTICATION').EXPOSE_IN_FETCH_INSTANCES; + const hideTokens = (instances: any[]) => { + if (exposeToken) return instances; + + return instances.map((instance) => { + const publicInstance = { ...instance }; + delete publicInstance.token; + return publicInstance; + }); + }; if (env.KEY !== key) { const instancesByKey = await this.prismaRepository.instance.findMany({ @@ -420,19 +430,19 @@ export class InstanceController { if (instancesByKey.length > 0) { const names = instancesByKey.map((instance) => instance.name); - return this.waMonitor.instanceInfo(names); + return hideTokens(await this.waMonitor.instanceInfo(names)); } else { throw new UnauthorizedException(); } } if (instanceId || number) { - return this.waMonitor.instanceInfoById(instanceId, number); + return hideTokens(await this.waMonitor.instanceInfoById(instanceId, number)); } const instanceNames = instanceName ? [instanceName] : null; - return this.waMonitor.instanceInfo(instanceNames); + return hideTokens(await this.waMonitor.instanceInfo(instanceNames)); } public async setPresence({ instanceName }: InstanceDto, data: SetPresenceDto) {