fix(httpapi): redact agent_secret from speaker list responses

Секрет agent больше не отдаётся viewer/editor в GET/list speakers; остаётся только при создании спикера. Co-authored-by: Cursor <[email protected]>
2026-05-25 10:13:28 +07:00
parent 6a6f6cedbc
commit 5a16a45922
2 changed files with 66 additions and 1 deletions
@@ -39,7 +39,10 @@ func speakerJSONFromStore(st store.Backend, sp *store.Speaker) map[string]any {
 	if strings.TrimSpace(sp.MetaJSON) != "" && sp.MetaJSON != "{}" {
 		var raw map[string]any
 		if json.Unmarshal([]byte(sp.MetaJSON), &raw) == nil {
-			m["meta_json"] = raw
+			delete(raw, "agent_secret")
+			if len(raw) > 0 {
+				m["meta_json"] = raw
+			}
 		}
 	}
 	if meta.AgentDomain != "" {