fix: Unexposed jwt_secret on GET /api/kytos/core/config/ endpoint

CHANGELOG.rst

@@ -24,6 +24,10 @@ Changed
 - HTTP API exceptions responses no longer include the ``"name"`` key name in the response, only ``"code"``  and ``"description"`` still remain
 - Development ``get_test_client`` now uses a ``htppx.AsyncClient`` instance
 
+Fixed
+=====
+- Unexposed ``jwt_secret`` on ``GET /api/kytos/core/config/`` endpoint
+
 
 [2022.3.1]  2023-02-17
 **********************

kytos/core/config.py

@@ -210,6 +210,14 @@ def _parse_json(value):
 
         return options
 
+    @staticmethod
+    def options_exposed(daemon_options: dict) -> dict:
+        """Options exposed on API."""
+        options = dict(daemon_options)
+        for key in {"jwt_secret"}:
+            options.pop(key, None)
+        return options
+
 
 def _render_config_templates(templates,
                              destination=Path(__file__).parent,

kytos/core/controller.py

@@ -424,7 +424,7 @@ def configuration_endpoint(self, _request: Request) -> JSONResponse:
             string: Json with current configurations used by kytos.
 
         """
-        return JSONResponse(self.options.__dict__)
+        return JSONResponse(KytosConfig.options_exposed(self.options.__dict__))
 
     def restart(self, graceful=True):
         """Restart Kytos SDN Controller.

tests/unit/test_core/test_controller.py

@@ -773,6 +773,7 @@ async def test_app_event_handler(self, controller):
     async def test_configuration_endpoint(self, controller, api_client):
         """Should return the attribute options as json."""
         expected = vars(controller.options)
+        expected.pop("jwt_secret", None)
         resp = await api_client.get("kytos/core/config")
         assert resp.status_code == 200
         assert expected == resp.json()