BTCPay Server Merges Fix That Keeps Store API Keys Within Scope
Photo: TokenPost
Nicolas Dorier merged a BTCPay Server change into the project’s master branch on Oct. 19 to keep API keys limited to one store within the permissions granted to them. The change blocks those keys from using server-wide or account-wide permissions solely because their owner is a server administrator. The fix also prevents a restricted key from creating a broader API key for another user. Three integration tests cover server-role access, user-account deletion and an attempt to create an unrestricted key without a store scope. BTCPay’s Greenfield API is used by integrations.
Source: TokenPost
