fix testing issues, add creator ref

Author: dobrac

packages/api/internal/api/spec.gen.go

@@ -4,8 +4,12 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"strings"
+
+	"golang.org/x/crypto/argon2"
 )
 
+const accessTokenSalt = "e2b_access_token_hash_salt"
+
 func MaskAccessToken(key string) string {
 	prefixLength := len(AccessTokenPrefix)
 	firstFour := key[:prefixLength]
@@ -14,6 +18,11 @@ func MaskAccessToken(key string) string {
 	return firstFour + stars + lastFour
 }
 
+func HashAccessToken(key string) string {
+	hashBytes := argon2.IDKey([]byte(key), []byte(accessTokenSalt), 1, 64*1024, 4, 32)
+	return hex.EncodeToString(hashBytes)
+}
+
 func GenerateAccessToken() string {
 	randomBytes := make([]byte, 20)
 	_, err := rand.Read(randomBytes)

packages/api/internal/api/types.gen.go

@@ -4,8 +4,12 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"strings"
+
+	"golang.org/x/crypto/argon2"
 )
 
+const apiKeySalt = "e2b_api_key_hash_salt"
+
 func MaskAPIKey(key string) string {
 	prefixLength := len(ApiKeyPrefix)
 	firstFour := key[:prefixLength]
@@ -14,6 +18,11 @@ func MaskAPIKey(key string) string {
 	return firstFour + stars + lastFour
 }
 
+func HashAPIKey(key string) string {
+	hashBytes := argon2.IDKey([]byte(key), []byte(apiKeySalt), 1, 64*1024, 4, 32)
+	return hex.EncodeToString(hashBytes)
+}
+
 func GenerateTeamAPIKey() string {
 	randomBytes := make([]byte, 20)
 	_, err := rand.Read(randomBytes)

packages/api/internal/auth/accesstoken.go

@@ -33,9 +33,11 @@ func (a *APIStore) PostAccesstokens(c *gin.Context) {
 	accessToken := auth.GenerateAccessToken()
 	accessTokenDB, err := a.db.Client.AccessToken.
 		Create().
-		SetID(accessToken).
+		SetUniqueID(uuid.New()).
 		SetUserID(userID).
+		SetID(accessToken).
 		SetAccessTokenMask(auth.MaskAccessToken(accessToken)).
+		SetAccessTokenHash(auth.HashAccessToken(accessToken)).
 		SetCreatedAt(time.Now()).
 		SetName(body.Name).
 		Save(ctx)
@@ -48,7 +50,7 @@ func (a *APIStore) PostAccesstokens(c *gin.Context) {
 	}
 
 	c.JSON(http.StatusCreated, api.CreatedAccessToken{
-		Id:        accessTokenDB.ID,
+		Id:        accessTokenDB.UniqueID,
 		Token:     accessToken,
 		TokenMask: auth.MaskAccessToken(accessToken),
 		Name:      accessTokenDB.Name,

packages/api/internal/auth/team_apikey.go

@@ -12,6 +12,7 @@ import (
 	"github.com/e2b-dev/infra/packages/api/internal/api"
 	"github.com/e2b-dev/infra/packages/api/internal/auth"
 	"github.com/e2b-dev/infra/packages/api/internal/utils"
+	"github.com/e2b-dev/infra/packages/shared/pkg/models/teamapikey"
 	"github.com/e2b-dev/infra/packages/shared/pkg/telemetry"
 )
 
@@ -53,7 +54,11 @@ func (a *APIStore) GetApikeys(c *gin.Context) {
 
 	teamID := a.GetTeamInfo(c).Team.ID
 
-	apiKeysDB, err := a.db.GetTeamAPIKeys(ctx, teamID)
+	apiKeysDB, err := a.db.Client.TeamAPIKey.
+		Query().
+		Where(teamapikey.TeamID(teamID)).
+		WithCreator().
+		All(ctx)
 	if err != nil {
 		log.Println("Error when getting team API keys: ", err)
 		c.JSON(http.StatusInternalServerError, "Error when getting team API keys")
@@ -63,12 +68,20 @@ func (a *APIStore) GetApikeys(c *gin.Context) {
 
 	teamAPIKeys := make([]api.TeamAPIKey, len(apiKeysDB))
 	for i, apiKey := range apiKeysDB {
+		var createdBy *api.TeamUser
+		if apiKey.Edges.Creator != nil {
+			createdBy = &api.TeamUser{
+				Email: apiKey.Edges.Creator.Email,
+				Id:    apiKey.Edges.Creator.ID,
+			}
+		}
+
 		teamAPIKeys[i] = api.TeamAPIKey{
 			Id:        apiKey.ID,
 			Name:      apiKey.Name,
 			KeyMask:   auth.MaskAPIKey(apiKey.APIKey),
 			CreatedAt: apiKey.CreatedAt,
-			CreatedBy: apiKey.CreatedBy,
+			CreatedBy: createdBy,
 			LastUsed:  apiKey.LastUsed,
 		}
 	}
@@ -119,28 +132,39 @@ func (a *APIStore) PostApikeys(c *gin.Context) {
 	apiKey, err := a.db.Client.TeamAPIKey.
 		Create().
 		SetTeamID(teamID).
-		SetAPIKey(teamApiKey).
 		SetCreatedBy(userID).
 		SetLastUsed(time.Now()).
 		SetUpdatedAt(time.Now()).
+		SetAPIKey(teamApiKey).
 		SetAPIKeyMask(auth.MaskAPIKey(teamApiKey)).
+		SetAPIKeyHash(auth.HashAPIKey(teamApiKey)).
 		SetCreatedAt(time.Now()).
 		SetName(body.Name).
 		Save(ctx)
-
 	if err != nil {
 		a.sendAPIStoreError(c, http.StatusInternalServerError, fmt.Sprintf("Error when creating API key: %s", err))
 
 		errMsg := fmt.Errorf("error when creating API key: %w", err)
 		telemetry.ReportCriticalError(ctx, errMsg)
 	}
 
+	user, err := a.db.Client.User.Get(ctx, userID)
+	if err != nil {
+		a.sendAPIStoreError(c, http.StatusInternalServerError, fmt.Sprintf("Error when getting user: %s", err))
+
+		errMsg := fmt.Errorf("error when getting user: %w", err)
+		telemetry.ReportCriticalError(ctx, errMsg)
+	}
+
 	c.JSON(http.StatusCreated, api.CreatedTeamAPIKey{
-		Id:        apiKey.ID,
-		Key:       teamApiKey,
-		KeyMask:   auth.MaskAPIKey(teamApiKey),
-		Name:      apiKey.Name,
-		CreatedBy: apiKey.CreatedBy,
+		Id:      apiKey.ID,
+		Key:     teamApiKey,
+		KeyMask: auth.MaskAPIKey(teamApiKey),
+		Name:    apiKey.Name,
+		CreatedBy: &api.TeamUser{
+			Id:    user.ID,
+			Email: user.Email,
+		},
 		CreatedAt: apiKey.CreatedAt,
 		LastUsed:  apiKey.LastUsed,
 	})

packages/api/internal/handlers/accesstoken.go

@@ -523,6 +523,7 @@ components:
       properties:
         id:
           type: string
+          format: uuid
           description: Identifier of the access token
         name:
           type: string
@@ -570,9 +571,8 @@ components:
           format: date-time
           description: Timestamp of API key creation
         createdBy:
-          type: string
-          format: uuid
-          description: Identifier of the user who created the API key
+          allOf:
+            - $ref: "#/components/schemas/TeamUser"
           nullable: true
         lastUsed:
           type: string
@@ -608,9 +608,8 @@ components:
           format: date-time
           description: Timestamp of API key creation
         createdBy:
-          type: string
-          format: uuid
-          description: Identifier of the user who created the API key
+          allOf:
+            - $ref: "#/components/schemas/TeamUser"
           nullable: true
         lastUsed:
           type: string