From a31d1f104d1c9ad5047dd018ab610bdd827b9cc4 Mon Sep 17 00:00:00 2001 From: Gabriel Luiz Freitas Almeida Date: Fri, 25 Aug 2023 18:35:08 -0300 Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20fix(api=5Fkey.py):=20add=20hashe?= =?UTF-8?q?d=5Fapi=5Fkey=20field=20to=20ApiKey=20model=20to=20store=20hash?= =?UTF-8?q?ed=20version=20of=20api=5Fkey=20=F0=9F=90=9B=20fix(crud.py):=20?= =?UTF-8?q?update=20create=5Fapi=5Fkey=20function=20to=20use=20hashed=20ve?= =?UTF-8?q?rsion=20of=20generated=5Fapi=5Fkey=20and=20mask=20the=20api=5Fk?= =?UTF-8?q?ey=20for=20security=20reasons?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../services/database/models/api_key/api_key.py | 2 ++ .../services/database/models/api_key/crud.py | 15 +++++++++------ 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/src/backend/langflow/services/database/models/api_key/api_key.py b/src/backend/langflow/services/database/models/api_key/api_key.py index 601d060b5..50398bdbc 100644 --- a/src/backend/langflow/services/database/models/api_key/api_key.py +++ b/src/backend/langflow/services/database/models/api_key/api_key.py @@ -17,7 +17,9 @@ class ApiKeyBase(SQLModelSerializable): class ApiKey(ApiKeyBase, table=True): id: UUID = Field(default_factory=uuid4, primary_key=True, unique=True) + api_key: str = Field(index=True, unique=True) + hashed_api_key: str = Field(index=True) # User relationship user_id: UUID = Field(index=True, foreign_key="user.id") user: "User" = Relationship(back_populates="api_keys") diff --git a/src/backend/langflow/services/database/models/api_key/crud.py b/src/backend/langflow/services/database/models/api_key/crud.py index af697b6d5..ae1de1f0f 100644 --- a/src/backend/langflow/services/database/models/api_key/crud.py +++ b/src/backend/langflow/services/database/models/api_key/crud.py @@ -24,17 +24,20 @@ def create_api_key( generated_api_key = secrets.token_urlsafe(32) # hash the API key - hashed_api_key = get_password_hash(generated_api_key) + hashed = get_password_hash(generated_api_key) # Use the generated key to create the ApiKey object - - api_key = ApiKey(api_key=hashed_api_key, name=api_key_create.name, user_id=user_id) + masked_api_key = f"{'*' * 10}{generated_api_key[-4:]}" + api_key = ApiKey( + api_key=masked_api_key, + hashed_api_key=hashed, + name=api_key_create.name, + user_id=user_id, + ) session.add(api_key) session.commit() session.refresh(api_key) - unmasked = UnmaskedApiKeyRead.from_orm(api_key) - unmasked.api_key = generated_api_key - return unmasked + return UnmaskedApiKeyRead.from_orm(api_key) def delete_api_key(session: Session, api_key_id: UUID) -> None: