feat(security): add HMAC-SHA256 based API key generation and verification

Author: yash-pouranik

backend/middleware/verifyApiKey.js

@@ -1,12 +1,16 @@
 const Project = require('../models/Project');
+const { hashApiKey } = require('../utils/api');
 
 module.exports = async (req, res, next) => {
     try {
         const apiKey = req.header('x-api-key');
 
         if (!apiKey) return res.status(401).json({ error: 'API key not found' });
 
-        const project = await Project.findOne({ apiKey })
+        const hashedApi = hashApiKey(apiKey);
+        
+
+        const project = await Project.findOne({ apiKey: hashedApi })
             .populate('owner', 'isVerified');
         if (!project) return res.status(401).json({ error: 'Invalid API key' });
 

backend/routes/projects.js

@@ -8,6 +8,7 @@ const { z } = require('zod');
 const authMiddleware = require('../middleware/authMiddleware');
 const verifyEmail = require('../middleware/verifyEmail')
 const { v4: uuidv4 } = require('uuid');
+const { generateApiKey, hashApiKey } = require('../utils/api');
 const multer = require('multer');
 const { createClient } = require('@supabase/supabase-js');
 
@@ -43,19 +44,25 @@ router.post('/', authMiddleware, verifyEmail, async (req, res) => {
         // Validation Applied
         const { name, description } = createProjectSchema.parse(req.body);
 
+        const rawApiKey = generateApiKey()
+        const hashedkey = hashApiKey(rawApiKey);
+
+        const rawSecret = generateApiKey()
+
         const newProject = new Project({
             name,
             description,
             owner: req.user._id,
-            apiKey: uuidv4(),
-            jwtSecret: uuidv4()
+            apiKey: hashedkey,
+            jwtSecret: rawSecret
         });
         await newProject.save();
 
         const projectObj = newProject.toObject();
+        projectObj.apiKey = rawApiKey;
         delete projectObj.jwtSecret;
 
-        res.status(201).json(projectObj); // Fixed: .json()
+        res.status(201).json(projectObj);
     } catch (err) {
         if (err instanceof z.ZodError) return res.status(400).json({ error: err.errors });
         res.status(500).json({ error: err.message }); // Fixed: .json()

backend/utils/api.js

@@ -0,0 +1,23 @@
+const crypto = require('crypto');
+
+function generateApiKey() {
+
+    // OS level cryptographic randomnesss
+    const bytes = crypto.randomBytes(32)
+    // console.log(bytes);
+
+    const key = bytes.toString("base64url");
+    // console.log(key)
+
+    return `ub_key_${key}`
+
+}
+
+function hashApiKey(apikey) {
+    return crypto
+        .createHmac("sha256", "ikewdxnuuencwoi")
+        .update(apikey)
+        .digest("hex");
+}
+
+module.exports = { generateApiKey, hashApiKey }