From 52b882dd1bd46b4c6896f709a92e7c1280dc9547 Mon Sep 17 00:00:00 2001 From: AJ ONeal Date: Mon, 13 Apr 2026 19:41:59 -0600 Subject: [PATCH] fix(auth/csvauth): ID() returns Name only, not Name~hashID for tokens MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Token hashID is an internal cache key for lookup disambiguation. Exposing it in ID() leaks implementation detail to callers — JWT act claims, audit logs, and session records all got the raw fingerprint suffix instead of the human-readable credential name. --- auth/csvauth/credential.go | 3 --- 1 file changed, 3 deletions(-) diff --git a/auth/csvauth/credential.go b/auth/csvauth/credential.go index 2026913..e9529a6 100644 --- a/auth/csvauth/credential.go +++ b/auth/csvauth/credential.go @@ -57,9 +57,6 @@ type Credential struct { } func (c *Credential) ID() string { - if c.Purpose == PurposeToken { - return c.Name + hashIDSep + c.hashID - } return c.Name }