From 2cac30fa48f0ff654f0e08e10a6e3c022fa69de8 Mon Sep 17 00:00:00 2001
From: Jonathan Miller <jmiller-moko@noreply.git.mokoconsulting.tech>
Date: Sat, 6 Jun 2026 20:39:05 -0500
Subject: [PATCH] fix: fall back to manifest XML for signing_key default

Hidden field defaults aren't stored in database params until the plugin
is re-saved. All 3 heartbeat paths now read the signing_key default
from the monitor plugin's manifest XML as a fallback.
---
 .../src/Controller/DisplayController.php      | 20 ++++++++++++++++++
 .../src/Extension/Monitor.php                 | 20 ++++++++++++++++++
 source/script.php                             | 21 ++++++++++++++++++-
 3 files changed, 60 insertions(+), 1 deletion(-)

diff --git a/source/packages/com_mokowaas/admin/src/Controller/DisplayController.php b/source/packages/com_mokowaas/admin/src/Controller/DisplayController.php
index a74c76b4..e80ca58e 100644
--- a/source/packages/com_mokowaas/admin/src/Controller/DisplayController.php
+++ b/source/packages/com_mokowaas/admin/src/Controller/DisplayController.php
@@ -137,6 +137,26 @@ class DisplayController extends BaseController
 			$headers = ['Content-Type: application/json'];
 			$signingKeyB64 = $params->get('signing_key', '');
 
+			// Fall back to manifest XML default if not yet saved in params
+			if (empty($signingKeyB64))
+			{
+				$manifestFile = JPATH_PLUGINS . '/system/mokowaas_monitor/mokowaas_monitor.xml';
+
+				if (is_file($manifestFile))
+				{
+					$xml = simplexml_load_file($manifestFile);
+
+					if ($xml)
+					{
+						foreach ($xml->xpath('//field[@name="signing_key"]') as $field)
+						{
+							$signingKeyB64 = (string) $field['default'];
+							break;
+						}
+					}
+				}
+			}
+
 			if (!empty($signingKeyB64))
 			{
 				$privateKeyPem = base64_decode($signingKeyB64);
diff --git a/source/packages/plg_system_mokowaas_monitor/src/Extension/Monitor.php b/source/packages/plg_system_mokowaas_monitor/src/Extension/Monitor.php
index 8329d66f..0adb9c67 100644
--- a/source/packages/plg_system_mokowaas_monitor/src/Extension/Monitor.php
+++ b/source/packages/plg_system_mokowaas_monitor/src/Extension/Monitor.php
@@ -202,6 +202,26 @@ class Monitor extends CMSPlugin implements SubscriberInterface
 	{
 		$signingKeyB64 = $this->params->get('signing_key', '');
 
+		// Fall back to manifest XML default if not yet saved in params
+		if (empty($signingKeyB64))
+		{
+			$manifestFile = JPATH_PLUGINS . '/system/mokowaas_monitor/mokowaas_monitor.xml';
+
+			if (is_file($manifestFile))
+			{
+				$xml = simplexml_load_file($manifestFile);
+
+				if ($xml)
+				{
+					foreach ($xml->xpath('//field[@name="signing_key"]') as $field)
+					{
+						$signingKeyB64 = (string) $field['default'];
+						break;
+					}
+				}
+			}
+		}
+
 		if (empty($signingKeyB64))
 		{
 			return null;
diff --git a/source/script.php b/source/script.php
index 0a29545a..9c82e316 100644
--- a/source/script.php
+++ b/source/script.php
@@ -833,9 +833,28 @@ class Pkg_MokowaasInstallerScript
 
 			$headers = ['Content-Type: application/json'];
 
-			// RSA sign the request
+			// RSA sign the request — fall back to manifest XML default
 			$signingKeyB64 = $monitorParams->signing_key ?? '';
 
+			if (empty($signingKeyB64))
+			{
+				$manifestFile = JPATH_PLUGINS . '/system/mokowaas_monitor/mokowaas_monitor.xml';
+
+				if (is_file($manifestFile))
+				{
+					$xml = simplexml_load_file($manifestFile);
+
+					if ($xml)
+					{
+						foreach ($xml->xpath('//field[@name="signing_key"]') as $field)
+						{
+							$signingKeyB64 = (string) $field['default'];
+							break;
+						}
+					}
+				}
+			}
+
 			if (!empty($signingKeyB64))
 			{
 				$privateKeyPem = base64_decode($signingKeyB64);