API Key Authentication — Implementing API Key Auth for Services

// API key generation and validation
const crypto = require('crypto');

function generateApiKey() {
  const raw = crypto.randomBytes(32).toString('base64url');
  const prefix = 'scan_';
  const key = prefix + raw;
  const hash = crypto.createHash('sha256').update(key).digest('hex');

  // Store hash, return raw key once
  return { key, hash };
}

async function validateApiKey(req, res, next) {
  const apiKey = req.headers['x-api-key'];
  if (!apiKey) return res.status(401).json({ error: 'API key required' });

  const hash = crypto.createHash('sha256').update(apiKey).digest('hex');
  const keyRecord = await db.apiKeys.findOne({ hash });

  if (!keyRecord) return res.status(401).json({ error: 'Invalid API key' });
  if (keyRecord.expires_at && keyRecord.expires_at < new Date()) {
    return res.status(401).json({ error: 'API key expired' });
  }
  if (!keyRecord.is_active) return res.status(401).json({ error: 'API key revoked' });

  req.apiKeyRecord = keyRecord;
  next();
}

// Key scoping
const keyRecord = {
  name: 'CI/CD Pipeline',
  scopes: ['scan:create', 'scan:read'],
  rate_limit: { requests: 1000, per: 'hour' },
  ip_restrictions: ['203.0.113.0/24']
};