From 37a34aad110892e297ff1782b174b17a203ea5bc Mon Sep 17 00:00:00 2001 From: XuqmGroup Date: Mon, 13 Jul 2026 16:24:17 +0800 Subject: [PATCH] fix(push): keep OPPO master secret server-side --- .../xuqm/tenant/controller/SdkConfigController.java | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/tenant-service/src/main/java/com/xuqm/tenant/controller/SdkConfigController.java b/tenant-service/src/main/java/com/xuqm/tenant/controller/SdkConfigController.java index 55c97c9..335c12d 100644 --- a/tenant-service/src/main/java/com/xuqm/tenant/controller/SdkConfigController.java +++ b/tenant-service/src/main/java/com/xuqm/tenant/controller/SdkConfigController.java @@ -85,13 +85,19 @@ public class SdkConfigController { JsonNode pushConfig; if (rawPushConfig.has("vendors") && rawPushConfig.path("vendors").isObject()) { com.fasterxml.jackson.databind.node.ObjectNode flat = objectMapper.createObjectNode(); - rawPushConfig.path("vendors").fields().forEachRemaining(e -> flat.set(e.getKey(), e.getValue())); + rawPushConfig.path("vendors").fields().forEachRemaining(e -> flat.set(e.getKey(), e.getValue().deepCopy())); if (rawPushConfig.has("profiles")) { flat.set("profiles", rawPushConfig.get("profiles")); } pushConfig = flat; } else { - pushConfig = rawPushConfig; + pushConfig = rawPushConfig.deepCopy(); + } + // This endpoint is public and consumed by client SDKs. OPPO masterSecret is + // exclusively a server-side API credential; the Android SDK only needs appSecret. + if (pushConfig.isObject() && pushConfig.path("oppo").isObject()) { + ((com.fasterxml.jackson.databind.node.ObjectNode) pushConfig.path("oppo")) + .remove("masterSecret"); } boolean updateEnabled = deployProps.isEnableUpdate() && featureServiceRepository .findByAppKeyAndPlatformAndServiceType(app.getAppKey(), platform, FeatureServiceEntity.ServiceType.UPDATE)