[Security] Guest-accessible API exposes merchant key

[chromonav]

Branch

• dev

Evidence

• easebuzz/easebuzz/doctype/easebuzz_settings/easebuzz_settings.py#L147-L150

@frappe.whitelist(allow_guest=True)
def get_merchant_key():
    controller = frappe.get_doc("Easebuzz Settings")
    return controller.merchant_key

Problem

Merchant key is exposed through a guest-accessible whitelisted method.

Risk/Impact

• Allows unauthenticated enumeration of payment gateway account metadata.
• Increases attack surface for targeted abuse/phishing against payment integration.
• Violates principle of minimizing externally exposed payment configuration details.

Replication suggestion

1. As Guest, call frappe.call/HTTP endpoint for get_merchant_key.
2. Observe merchant key value returned without authentication.

Expected: merchant identifiers/configuration should be available only to trusted server-side paths.
Actual: value is exposed to guest users.

Resolution suggestion

• Remove allow_guest=True.
• Avoid exposing merchant key via public API; fetch it only in server-side payment-init flow.
• If frontend requires a public identifier, provide a separate non-sensitive alias/token.

Acceptance criteria

• Guest users cannot fetch merchant key.
• API endpoint requires authenticated role or is removed.
• Existing payment flow works without exposing gateway configuration over public method calls.