chore: refactor hasher

Author: tilyupo

src/engine/core/admin-api-key-utils.ts

@@ -101,4 +101,3 @@ function hexToBytes(hex: string): Uint8Array {
   }
   return out;
 }
-

src/engine/core/sdk-key-service.ts

@@ -1,8 +1,8 @@
 import {LRUCache} from 'lru-cache';
 import type {SdkKeyInfo} from '../engine';
-import type {HashingService} from './hashing-service';
 import type {ReplicaService} from './replica';
 import {extractSdkKeyId} from './sdk-key-utils';
+import type {SecureHashingService} from './secure-hashing-service';
 import type {Service} from './service';
 
 export class SdkKeyService implements Service {
@@ -16,7 +16,7 @@ export class SdkKeyService implements Service {
 
   constructor(
     private readonly replicaService: ReplicaService,
-    private readonly hasher: HashingService,
+    private readonly hasher: SecureHashingService,
   ) {}
   async start(): Promise<void> {}
 

src/engine/core/hashing-service.ts src/engine/core/secure-hashing-service.tssrc/engine/core/hashing-service.ts renamed to src/engine/core/secure-hashing-service.ts

@@ -1,14 +1,14 @@
-// Use Web Crypto API (available in modern browsers and Node.js >= 18)
+import {timingSafeEqual} from 'node:crypto';
 
-export interface HashingService {
+export interface SecureHashingService {
   hash(source: string): Promise<string>;
   verify(hash: string, source: string): Promise<boolean>;
 }
 
 // Simple SHA-256 hashing service (unsalted, deterministic).
 // NOTE: This is weaker than Argon2 (no memory hardness). Consider reintroducing
 // a stronger KDF if tokens need resistance against offline brute-force.
-export function createSha256HashingService(): HashingService {
+export function createSha256HashingService(): SecureHashingService {
   function toHex(buffer: ArrayBuffer): string {
     const bytes = new Uint8Array(buffer);
     let hex = '';
@@ -29,7 +29,13 @@ export function createSha256HashingService(): HashingService {
       return sha256(token);
     },
     async verify(hash: string, token: string) {
-      return (await sha256(token)) === hash;
+      return timingSafeEqualString(await sha256(token), hash);
     },
   };
 }
+
+export function timingSafeEqualString(a: string, b: string): boolean {
+  const aBuffer = Buffer.from(a);
+  const bBuffer = Buffer.from(b);
+  return aBuffer.length === bBuffer.length && timingSafeEqual(aBuffer, bBuffer);
+}

src/engine/core/use-cases/create-sdk-key-use-case.ts

@@ -1,7 +1,7 @@
 import {BadRequestError} from '../errors';
-import type {HashingService} from '../hashing-service';
 import {getUserIdFromIdentity, type Identity} from '../identity';
 import {buildRawSdkKey, getSdkKeyPrefix, getSdkKeySuffix} from '../sdk-key-utils';
+import type {SecureHashingService} from '../secure-hashing-service';
 import {createAuditLogId} from '../stores/audit-log-store';
 import type {TransactionalUseCase} from '../use-case';
 import {createUuidV7} from '../uuid';
@@ -25,7 +25,7 @@ export interface CreateSdkKeyResponse {
 }
 
 export function createCreateSdkKeyUseCase(deps: {
-  hasher: HashingService;
+  secureHasher: SecureHashingService;
 }): TransactionalUseCase<CreateSdkKeyRequest, CreateSdkKeyResponse> {
   return async (ctx, tx, req) => {
     await tx.permissionService.ensureCanManageSdkKeys(ctx, {
@@ -44,7 +44,7 @@ export function createCreateSdkKeyUseCase(deps: {
     const sdkKeyId = createUuidV7();
     // Embed apiTokenId into token for future extraction
     const sdkKey = buildRawSdkKey(sdkKeyId);
-    const sdkKeyHash = await deps.hasher.hash(sdkKey);
+    const sdkKeyHash = await deps.secureHasher.hash(sdkKey);
     const keyPrefix = getSdkKeyPrefix(sdkKey);
     const keySuffix = getSdkKeySuffix(sdkKey);
     const now = new Date();

src/engine/core/use-cases/verify-admin-api-key-use-case.ts

@@ -1,15 +1,15 @@
 import {getSuperuserApiKey} from '@/environment';
-import {timingSafeEqual} from 'crypto';
 import type {Kysely} from 'kysely';
 import {LRUCache} from 'lru-cache';
-import {extractAdminApiKeyId, hashAdminApiKey} from '../admin-api-key-utils';
+import {extractAdminApiKeyId} from '../admin-api-key-utils';
 import type {AdminApiKeyScope, DB} from '../db';
 import {
   createApiKeyIdentity,
   createSuperuserIdentity,
   type ApiKeyIdentity,
   type SuperuserIdentity,
 } from '../identity';
+import {timingSafeEqualString, type SecureHashingService} from '../secure-hashing-service';
 import type {UseCase} from '../use-case';
 
 export interface VerifyAdminApiKeyRequest {
@@ -26,6 +26,7 @@ export type VerifyAdminApiKeyResponse =
 
 export interface VerifyAdminApiKeyUseCaseDeps {
   db: Kysely<DB>;
+  secureHasher: SecureHashingService;
 }
 
 export function createVerifyAdminApiKeyUseCase(
@@ -45,12 +46,7 @@ export function createVerifyAdminApiKeyUseCase(
     // Check if this is the superuser API key using constant-time comparison
     const superuserKey = getSuperuserApiKey();
     if (superuserKey) {
-      const keyBuffer = Buffer.from(key);
-      const superuserKeyBuffer = Buffer.from(superuserKey);
-      if (
-        superuserKeyBuffer.length === keyBuffer.length &&
-        timingSafeEqual(keyBuffer, superuserKeyBuffer)
-      ) {
+      if (timingSafeEqualString(superuserKey, key)) {
         return {status: 'valid', identity: createSuperuserIdentity()};
       }
     }
@@ -65,9 +61,6 @@ export function createVerifyAdminApiKeyUseCase(
         return {status: 'invalid', reason: 'invalid_format'};
       }
 
-      // Hash the key for verification
-      const keyHash = await hashAdminApiKey(key);
-
       // Fetch the key by hash
       const adminKey = await db
         .selectFrom('admin_api_keys')
@@ -79,7 +72,7 @@ export function createVerifyAdminApiKeyUseCase(
         return {status: 'invalid', reason: 'invalid_key'};
       }
 
-      if (adminKey.key_hash !== keyHash) {
+      if (!(await deps.secureHasher.verify(adminKey.key_hash, key))) {
         return {status: 'invalid', reason: 'invalid_key'};
       }
 

src/engine/core/use-cases/verify-sdk-key-use-case.ts

@@ -1,8 +1,8 @@
 import {LRUCache} from 'lru-cache';
 import type {SdkKeyInfo} from '../../engine';
-import type {HashingService} from '../hashing-service';
 import type {ReplicaService} from '../replica';
 import {extractSdkKeyId} from '../sdk-key-utils';
+import type {SecureHashingService} from '../secure-hashing-service';
 import type {UseCase} from '../use-case';
 
 export interface VerifySdkKeyRequest {
@@ -13,7 +13,7 @@ export type VerifySdkKeyResponse = SdkKeyInfo | null;
 
 export interface VerifySdkKeyUseCaseDeps {
   replicaService: ReplicaService;
-  hasher: HashingService;
+  hasher: SecureHashingService;
 }
 
 export function createVerifySdkKeyUseCase(

src/engine/edge.ts

@@ -4,11 +4,11 @@ import path from 'node:path';
 import {GLOBAL_CONTEXT} from './core/context';
 import {type DateProvider, DefaultDateProvider} from './core/date-provider';
 import {EventHub} from './core/event-hub';
-import {createSha256HashingService} from './core/hashing-service';
 import {createLogger, type LogLevel} from './core/logger';
 import {prepareDb} from './core/prepare-db';
 import {ReplicaService} from './core/replica';
 import {ReplicaEventBus} from './core/replica-event-bus';
+import {createSha256HashingService} from './core/secure-hashing-service';
 import type {Service} from './core/service';
 import {ReplicaStore} from './core/stores/replica-store';
 import {createGetProjectEventsUseCase} from './core/use-cases/get-project-events-use-case';

src/engine/engine.ts

@@ -9,13 +9,13 @@ import {type DateProvider, DefaultDateProvider} from './core/date-provider';
 import type {DB} from './core/db';
 import {type EmailService, PreferencesAwareEmailService} from './core/email-service';
 import {EventHubPublisher} from './core/event-hub';
-import {createSha256HashingService} from './core/hashing-service';
 import {createLogger, type Logger, type LogLevel} from './core/logger';
 import {PermissionService} from './core/permission-service';
 import {prepareDb} from './core/prepare-db';
 import {ProjectQueryService} from './core/project-query-service';
 import {ProposalService} from './core/proposal-service';
 import {type AppHubEvents} from './core/replica';
+import {createSha256HashingService} from './core/secure-hashing-service';
 import {AdminApiKeyStore} from './core/stores/admin-api-key-store';
 import {AuditLogStore} from './core/stores/audit-log-store';
 import {ConfigProposalStore} from './core/stores/config-proposal-store';
@@ -272,7 +272,7 @@ export async function createEngine(options: EngineOptions) {
 
   const dateProvider = options.dateProvider ?? new DefaultDateProvider();
 
-  const hasher = createSha256HashingService();
+  const secureHasher = createSha256HashingService();
 
   const transactionalUseCases = {
     getConfigList: createGetConfigListUseCase({}),
@@ -313,7 +313,7 @@ export async function createEngine(options: EngineOptions) {
     updateProjectEnvironmentsOrder: createUpdateProjectEnvironmentsOrderUseCase({dateProvider}),
     deleteProjectEnvironment: createDeleteProjectEnvironmentUseCase({dateProvider}),
     restoreConfigVersion: createRestoreConfigVersionUseCase(),
-    createSdkKey: createCreateSdkKeyUseCase({hasher: hasher}),
+    createSdkKey: createCreateSdkKeyUseCase({secureHasher}),
     // Combined use cases for page data
     getConfigPageData: createGetConfigPageDataUseCase(),
     getNewConfigPageData: createGetNewConfigPageDataUseCase(),
@@ -374,7 +374,7 @@ export async function createEngine(options: EngineOptions) {
     useCases: {
       ...engineUseCases,
       getHealth: createGetHealthUseCase(),
-      verifyAdminApiKey: createVerifyAdminApiKeyUseCase({db}),
+      verifyAdminApiKey: createVerifyAdminApiKeyUseCase({db, secureHasher}),
     },
     mail: options.emailService,
     stores: {