Feat upgrade api keys

docker-compose.dev.yml

@@ -31,6 +31,7 @@ services:
       context: ./
       dockerfile: ./packages/api/Dockerfile.dev
     environment:
+      ENV: ${ENV}
       DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:5432/${POSTGRES_DB}?ssl=false
       DISTRIBUTION: ${DISTRIBUTION}
       WEBHOOK_INGRESS: ${WEBHOOK_INGRESS}

docker-compose.source.yml

@@ -31,6 +31,7 @@ services:
       context: ./
       dockerfile: ./packages/api/Dockerfile
     environment:
+      ENV: ${ENV}
       DOPPLER_TOKEN: ${DOPPLER_TOKEN_API}
       DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:5432/${POSTGRES_DB}?ssl=false
       DISTRIBUTION: ${DISTRIBUTION}

docker-compose.yml

@@ -26,6 +26,7 @@ services:
   api:
     image: panora.docker.scarf.sh/panoradotdev/backend-api:selfhosted
     environment:
+      ENV: ${ENV}
       DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:5432/${POSTGRES_DB}?ssl=false
       DISTRIBUTION: ${DISTRIBUTION}
       WEBHOOK_INGRESS: ${WEBHOOK_INGRESS}

packages/api/src/@core/auth/auth.controller.ts

@@ -104,7 +104,7 @@ export class AuthController {
   @ApiBody({ type: ApiKeyDto })
   @ApiResponse({ status: 201 })
   @UseGuards(JwtAuthGuard)
-  @Post()
+  @Post('api_keys')
   async generateApiKey(@Body() data: ApiKeyDto): Promise<{ api_key: string }> {
     return this.authService.generateApiKeyForUser(
       data.userId,

packages/api/src/@core/auth/auth.service.ts

@@ -1,6 +1,6 @@
 import { LoggerService } from '@@core/@core-services/logger/logger.service';
 import { ProjectsService } from '@@core/projects/projects.service';
 import { AuthError } from '@@core/utils/errors';
 import { Injectable, BadRequestException } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
 import * as bcrypt from 'bcrypt';
@@ -120,7 +120,7 @@
       to: email, 
       subject: 'Panora | Password Reset Request',
       text: `You requested a password reset. Click the following link within one hour from now to reset your password: ${resetLink}`,
       html: `<p>You requested a password reset. Click the link to reset your password:</p><a href="${resetLink}">${resetLink}</a> <p>The link will expire after one hour</p>`,
     });
 
     this.logger.log(`Send reset email to ${email} with token ${resetToken}`);
@@ -324,30 +324,36 @@
     keyName: string,
   ): Promise<{ api_key: string }> {
     try {
+
+      // Check project & User exist
       const foundProject = await this.prisma.projects.findUnique({
         where: { id_project: projectId },
       });
       if (!foundProject) {
-        throw new ReferenceError('project undefined');
+        throw new ReferenceError('Project not found');
       }
       const foundUser = await this.prisma.users.findUnique({
         where: { id_user: userId },
       });
       if (!foundUser) {
-        throw new ReferenceError('user undefined');
+        throw new ReferenceError('User Not Found');
       }
 
       /*if (foundProject.id_organization !== foundUser.id_organization) {
         throw new ReferenceError('User is not inside the project');
       }*/
       // Generate a new API key (use a secure method for generation)
-      const { access_token } = await this.generateApiKey(projectId, userId);
+      //const { access_token } = await this.generateApiKey(projectId, userId);
       // Store the API key in the database associated with the user
-      //const hashed_token = this.hashApiKey(access_token);
+      //const hashed_token = this.hashApiKey(access_token);"
+
+      const base_key = `sk_${process.env.ENV}_${uuidv4()}`; 
+      const hashed_key = crypto.createHash('sha256').update(base_key).digest('hex');
+
       const new_api_key = await this.prisma.api_keys.create({
         data: {
           id_api_key: uuidv4(),
-          api_key_hash: access_token,
+          api_key_hash: hashed_key,
           name: keyName,
           id_project: projectId as string,
           id_user: userId as string,
@@ -357,7 +363,7 @@
         throw new ReferenceError('api key undefined');
       }
 
-      return { api_key: access_token, ...new_api_key };
+      return { api_key: base_key, ...new_api_key };
     } catch (error) {
       throw error;
     }
@@ -377,17 +383,11 @@
 
 
 
-  async getProjectIdForApiKey(apiKey: string) {
+  async getProjectIdForApiKey(hashed_apiKey: string) {
     try {
-      // Decode the JWT to verify if it's valid and get the payload
-      const decoded = this.jwtService.verify(apiKey, {
-        secret: process.env.JWT_SECRET,
-      });
-
-      //const hashed_api_key = this.hashApiKey(apiKey);
       const saved_api_key = await this.prisma.api_keys.findUnique({
         where: {
-          api_key_hash: apiKey,
+          api_key_hash: hashed_apiKey,
         },
       });
 
@@ -399,33 +399,43 @@
 
   async validateApiKey(apiKey: string): Promise<boolean> {
     try {
+
+      // TO DO : add Expiration in part 3
+
       // Decode the JWT to verify if it's valid and get the payload
-      const decoded = this.jwtService.verify(apiKey, {
-        secret: process.env.JWT_SECRET,
-      });
+      // const decoded = this.jwtService.verify(apiKey, {
+      //   secret: process.env.JWT_SECRET,
+      // });
+
 
-      //const hashed_api_key = this.hashApiKey(apiKey);
+      // pseudo-code:
+      // 1 - SHA256 the API key from the header
+      const hashed_key = crypto.createHash('sha256').update(apiKey).digest('hex');
+
+
+      // 2- check against DB
+      // if not found, return false
       const saved_api_key = await this.prisma.api_keys.findUnique({
         where: {
-          api_key_hash: apiKey,
+          api_key_hash: hashed_key,
         },
       });
 
       if (!saved_api_key) {
-        throw new ReferenceError('Api Key undefined');
-      }
-      if (String(decoded.project_id) !== String(saved_api_key.id_project)) {
-        throw new ReferenceError(
-          'Failed to validate API key: projectId mismatch.',
-        );
-      }
-
-      // Validate that the JWT payload matches the provided userId and projectId
-      if (String(decoded.sub) !== String(saved_api_key.id_user)) {
-        throw new ReferenceError(
-          'Failed to validate API key: userId mismatch.',
-        );
+        throw new ReferenceError('API Key not found.');
       }
+      // if (String(decoded.project_id) !== String(saved_api_key.id_project)) {
+      //   throw new ReferenceError(
+      //     'Failed to validate API key: projectId mismatch.',
+      //   );
+      // }
+
+      // // Validate that the JWT payload matches the provided userId and projectId
+      // if (String(decoded.sub) !== String(saved_api_key.id_user)) {
+      //   throw new ReferenceError(
+      //     'Failed to validate API key: userId mismatch.',
+      //   );
+      // }
       return true;
     } catch (error) {
       throw error;

packages/api/src/@core/auth/strategies/auth-header-api-key.strategy.ts

@@ -2,6 +2,7 @@ import { HeaderAPIKeyStrategy } from 'passport-headerapikey';
 import { PassportStrategy } from '@nestjs/passport';
 import { Injectable, UnauthorizedException } from '@nestjs/common';
 import { AuthService } from '../auth.service';
+import * as crypto from 'crypto';
 
 @Injectable()
 export class ApiKeyStrategy extends PassportStrategy(
@@ -10,16 +11,17 @@ export class ApiKeyStrategy extends PassportStrategy(
 ) {
   constructor(private authService: AuthService) {
     super(
-      { header: 'Authorization', prefix: 'Bearer ' },
+      { header: 'x-api-key', prefix: '' },
       true,
       async (apikey: string, done, req) => {
         try {
           const isValid = await this.authService.validateApiKey(apikey);
           if (!isValid) {
             return done(new UnauthorizedException('Invalid API Key'), null);
           }
+          const hashed_api_key = crypto.createHash('sha256').update(apikey).digest('hex');
           const projectId = await this.authService.getProjectIdForApiKey(
-            apikey,
+            hashed_api_key,
           );
           //console.log('validating api request...  : ' + req.user);
           // If the API key is valid, attach the user to the request object

packages/api/src/@core/connections/@utils/index.ts

@@ -16,6 +16,10 @@ export class ConnectionUtils {
     token: string,
   ): Promise<ConnectionMetadata> {
     try {
+      console.log('**********')
+      console.log(token);
+      console.log('**********')
+
       const res = await this.prisma.connections.findFirst({
         where: {
           connection_token: token,