From f6a98a75050af3be093c34a52dfe26f79d0646d1 Mon Sep 17 00:00:00 2001 From: Luis Faria Date: Wed, 29 Jul 2026 13:21:57 +0100 Subject: [PATCH] Fix regenerateAccessKey putting the wrong subject in the JWT accessKey.getName() is the access key's human-readable label (e.g. "mcp"), not the RODA username - that's accessKey.getUserName(). createAccessKey correctly uses the username (via accessKey.setUserName(id), consumed by the model service layer when it generates the token); regenerateAccessKey built the JWT inline and used the wrong field. The bug is silent and severe: JwtUtils.generateToken signs a token whose subject doesn't correspond to any real user. RODA's own /authenticated endpoint doesn't reject this - it decodes the token, fails to find a matching user, and returns a degenerate User shell (id=null, name=null, uuid="user-null", guest=false, allRoles=[]) with 200 OK instead of erroring. Every tool/role check downstream then silently sees a "real" but permission-less user rather than a clear authentication failure. Any AccessKey regenerated via RODA's UI (the Access Token tab's "regenerate" action, not "create") was affected - only brand-new keys worked correctly. Verified live: created an AccessKey, regenerated it via POST /api/v2/members/users/access-keys/regenerate/{id}, decoded the resulting JWT (sub now correctly "admin", not the key's label), and confirmed GET /api/v2/members/users/authenticated with that token returns the full admin identity and role list. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01263fsB7QYevDFgwAY8okcq --- .../java/org/roda/wui/api/v2/controller/MembersController.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roda-ui/roda-wui/src/main/java/org/roda/wui/api/v2/controller/MembersController.java b/roda-ui/roda-wui/src/main/java/org/roda/wui/api/v2/controller/MembersController.java index f93ac5e5ba..61f73ae6d6 100644 --- a/roda-ui/roda-wui/src/main/java/org/roda/wui/api/v2/controller/MembersController.java +++ b/roda-ui/roda-wui/src/main/java/org/roda/wui/api/v2/controller/MembersController.java @@ -460,7 +460,8 @@ public AccessKey regenerateAccessKey(String id, @RequestBody CreateAccessKeyRequ } AccessKey accessKey = RodaCoreFactory.getModelService().retrieveAccessKey(id); - accessKey.setKey(JwtUtils.generateToken(accessKey.getName(), regenerateAccessKeyRequest.getExpirationDate())); + accessKey + .setKey(JwtUtils.generateToken(accessKey.getUserName(), regenerateAccessKeyRequest.getExpirationDate())); return RodaCoreFactory.getModelService().updateAccessKey(accessKey, requestContext.getUser().getName()); } catch (RODAException e) { state = LogEntryState.FAILURE;