diegosouzapw
1cbbc33f20
FASE-01 — Security Hardening: - Remove hardcoded JWT_SECRET and API_KEY_SECRET fallbacks (fail-fast) - Create secretsValidator.js with enforceSecrets() at startup - Create inputSanitizer.js (prompt injection + PII detection) - Integrate sanitizer in chat.js handler pipeline - Add structured logging to silent catch blocks in proxy.js - Remove .passthrough() from Zod updateSettingsSchema - Remove insecure npm fs dependency - Update .env.example with generation commands FASE-02 — CI/CD & Tests: - Create ci.yml workflow (lint, build, test, coverage, e2e) - Fix test scripts (test now runs actual tests) - Add test:unit, test:security, test:coverage (c8), test:all - Add security rules to ESLint (no-eval, no-implied-eval, no-new-func) FASE-03 — Architecture: - Create settingsCache.js (eliminate self-fetch anti-pattern) - Create domain/types.js and domain/responses.js FASE-04 — Observability: - Create correlationId.js (AsyncLocalStorage tracing) - Create circuitBreaker.js (full state machine + registry) - Create requestTimeout.js (per-provider timeouts) FASE-05 — Code Quality: - Create structuredLogger.js (JSON/human-readable logging) FASE-06 — Documentation: - Update SECURITY.md with hardening practices - Create CONTRIBUTING.md with dev setup and PR checklist Tests: 52/52 pass (23 security + 15 observability + 14 integration)
102 lines
2.6 KiB
JavaScript
102 lines
2.6 KiB
JavaScript
import crypto from "crypto";
|
|
|
|
// FASE-01: No hardcoded fallback — enforced by secretsValidator at startup
|
|
if (!process.env.API_KEY_SECRET) {
|
|
console.error("[SECURITY] API_KEY_SECRET is not set. API key CRC will be insecure.");
|
|
}
|
|
const API_KEY_SECRET = process.env.API_KEY_SECRET;
|
|
|
|
/**
|
|
* Generate 6-char random keyId
|
|
*/
|
|
function generateKeyId() {
|
|
const chars = "abcdefghijklmnopqrstuvwxyz0123456789";
|
|
let result = "";
|
|
for (let i = 0; i < 6; i++) {
|
|
result += chars.charAt(Math.floor(Math.random() * chars.length));
|
|
}
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* Generate CRC (8-char HMAC)
|
|
*/
|
|
function generateCrc(machineId, keyId) {
|
|
return crypto
|
|
.createHmac("sha256", API_KEY_SECRET)
|
|
.update(machineId + keyId)
|
|
.digest("hex")
|
|
.slice(0, 8);
|
|
}
|
|
|
|
/**
|
|
* Generate API key with machineId embedded
|
|
* Format: sk-{machineId}-{keyId}-{crc8}
|
|
* @param {string} machineId - 16-char machine ID
|
|
* @returns {{ key: string, keyId: string }}
|
|
*/
|
|
export function generateApiKeyWithMachine(machineId) {
|
|
const keyId = generateKeyId();
|
|
const crc = generateCrc(machineId, keyId);
|
|
const key = `sk-${machineId}-${keyId}-${crc}`;
|
|
return { key, keyId };
|
|
}
|
|
|
|
/**
|
|
* Parse API key and extract machineId + keyId
|
|
* Supports both formats:
|
|
* - New: sk-{machineId}-{keyId}-{crc8}
|
|
* - Old: sk-{random8}
|
|
* @param {string} apiKey
|
|
* @returns {{ machineId: string, keyId: string, isNewFormat: boolean } | null}
|
|
*/
|
|
export function parseApiKey(apiKey) {
|
|
if (!apiKey || !apiKey.startsWith("sk-")) return null;
|
|
|
|
const parts = apiKey.split("-");
|
|
|
|
// New format: sk-{machineId}-{keyId}-{crc8} = 4 parts
|
|
if (parts.length === 4) {
|
|
const [, machineId, keyId, crc] = parts;
|
|
|
|
// Validate CRC
|
|
const expectedCrc = generateCrc(machineId, keyId);
|
|
if (crc !== expectedCrc) return null;
|
|
|
|
return { machineId, keyId, isNewFormat: true };
|
|
}
|
|
|
|
// Old format: sk-{random8} = 2 parts
|
|
if (parts.length === 2) {
|
|
return { machineId: null, keyId: parts[1], isNewFormat: false };
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
/**
|
|
* Verify API key CRC (only for new format)
|
|
* @param {string} apiKey
|
|
* @returns {boolean}
|
|
*/
|
|
export function verifyApiKeyCrc(apiKey) {
|
|
const parsed = parseApiKey(apiKey);
|
|
if (!parsed) return false;
|
|
|
|
// Old format doesn't have CRC, always valid if parsed
|
|
if (!parsed.isNewFormat) return true;
|
|
|
|
// New format already verified in parseApiKey
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Check if API key is new format (contains machineId)
|
|
* @param {string} apiKey
|
|
* @returns {boolean}
|
|
*/
|
|
export function isNewFormatKey(apiKey) {
|
|
const parsed = parseApiKey(apiKey);
|
|
return parsed?.isNewFormat === true;
|
|
}
|