Potential fix for code scanning alert no. 14: Use of password hash with insufficient computational effort

[zeroc0d3]

Potential fix for https://github.com/telemetryflow/telemetryflow-core/security/code-scanning/14

Use a memory/CPU-hard password hashing function instead of raw SHA-256 for apiKeySecret. Since this file already imports Node crypto, the best minimal fix is to switch to crypto.scryptSync(...) with a per-key random salt, and store the result in a parseable format (e.g., salt:hash). This avoids adding external dependencies and keeps behavior (store derived secret string, return raw key once) unchanged.

What to change (in backend/src/modules/api-keys/domain/aggregates/ApiKey.ts):

• In rotate(...), replace:
  • const apiKeySecret = crypto.createHash('sha256').update(rawKeySecret).digest('hex');
• With:
  • generate random salt via crypto.randomBytes(16).toString('hex')
  • derive hash via crypto.scryptSync(rawKeySecret, salt, 64).toString('hex')
  • store as ${salt}:${derivedKey} in apiKeySecret

No new imports are needed (already using crypto).

Suggested fixes powered by Copilot Autofix. Review carefully before merging.