From 4adc6d79d9e5ab9567a6440b274a878692f476eb Mon Sep 17 00:00:00 2001
From: DevSoftTech Server <info.devsofttech@gmail.com>
Date: Wed, 18 Mar 2026 06:13:30 +0530
Subject: [PATCH] fix: redact Gemini key; exclude audit/log tables from seed
 exporter

- Redact AIzaSy Gemini key from clinical_audit_trail entries in seed JSON
- Add default never-export denylist to exportMasterSeedData() so that
  clinical_audit_trail, lab_log, bridge_sync_queue and session tables are
  always skipped when setup.seed.export_tables is not configured.
  This prevents API keys set via the admin UI from leaking into git via
  the audit trail even after being deleted from hospital_setting.
---
 app/Controllers/Setup.php          | 20 ++++++++++++++++++++
 app/Database/master_seed_data.json |  2 +-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/app/Controllers/Setup.php b/app/Controllers/Setup.php
index 617cdd9..06fe8a7 100644
--- a/app/Controllers/Setup.php
+++ b/app/Controllers/Setup.php
@@ -259,6 +259,26 @@ class Setup extends BaseController
             $tables = $this->db->listTables();
             $exportedAllTables = true;
         }
+        // Tables that must never be exported in all-tables mode:
+        // audit trails, session logs, queue tables, and CI framework internals
+        // can contain secret values (API keys set via admin UI) or sensitive data.
+        $neverExport = [
+            'clinical_audit_trail',
+            'lab_log',
+            'bridge_sync_queue',
+            'ci_sessions',
+            'sessions',
+            'auth_token_logins',
+            'auth_logins',
+            'auth_remember_tokens',
+            'patient_duplicate_log',
+        ];
+
+        if ($exportedAllTables) {
+            $tables = array_values(array_filter($tables, static function ($t) use ($neverExport): bool {
+                return ! in_array(strtolower((string) $t), $neverExport, true);
+            }));
+        }
 
         $seedPayload = [
             'generated_at' => date('Y-m-d H:i:s'),
diff --git a/app/Database/master_seed_data.json b/app/Database/master_seed_data.json
index 1386505..758670b 100644
--- a/app/Database/master_seed_data.json
+++ b/app/Database/master_seed_data.json
@@ -1575,7 +1575,7 @@
                 "record_id": "GEMINI_API_KEY",
                 "field_name": "GEMINI_API_KEY",
                 "old_value": "\"\"",
-                "new_value": "\"AIzaSyBSHpC1N7drS721o7KRZiMWygPK4CopNQI\"",
+                "new_value": "\"REDACTED_GEMINI_API_KEY\"",
                 "user_id": "1",
                 "action_at": "2026-02-21 19:34:24",
                 "hash": "dfc6370231d5fec4c562914546b5aea6fa79e1a8fe86d84ba9ba31c121cdcfcb",