Feat/argon2id apikey hashing 222 (#408)

* feat(backend): add OIDC JWT issuance and revocation

* Suppress CodeQL false positive for API key fingerprint

* Fix OIDC CI checks

* Add OIDC token coverage

* Move CodeQL suppression before fingerprint hash

* Hash API keys with Argon2id

* Update generated OpenAPI spec for OAuth routes

Author: kimanicode

app/backend/cache/redis.service.ts

@@ -24,6 +24,10 @@ export class RedisService implements OnModuleInit, OnModuleDestroy {
     this.client?.disconnect();
   }
 
+  getClient(): Redis {
+    return this.client;
+  }
+
   /**
    * Retrieve and deserialise a cached value.
    * Returns `null` on cache miss or if Redis is unavailable.
@@ -93,4 +97,4 @@ export class RedisService implements OnModuleInit, OnModuleDestroy {
       return 0;
     }
   }
-}
+}

app/backend/package-lock.json

@@ -48,6 +48,7 @@
     "@sendgrid/mail": "^8.1.5",
     "@stellar/stellar-sdk": "^14.6.1",
     "@willsoto/nestjs-prometheus": "^6.0.2",
+    "argon2": "^0.45.1",
     "axios": "^1.13.6",
     "bull": "^4.16.5",
     "bullmq": "^5.79.0",
@@ -57,6 +58,7 @@
     "dotenv": "^17.2.3",
     "helmet": "^8.1.0",
     "ioredis": "^5.9.2",
+    "jose": "^4",
     "openai": "^6.33.0",
     "pino": "^10.3.0",
     "pino-http": "^11.0.0",

app/backend/package.json

@@ -0,0 +1,39 @@
+import argon2 from 'argon2';
+import type { HashOptions } from 'argon2';
+
+const ARGON2ID_OPTIONS: HashOptions = {
+  type: argon2.argon2id,
+  memoryCost: 65536,
+  timeCost: 3,
+  parallelism: 1,
+  hashLength: 32,
+};
+
+export function maskApiKeyPreview(rawKey: string): string {
+  const prefix = rawKey.slice(0, 6);
+  const suffix = rawKey.slice(-4);
+  return `${prefix}...${suffix}`;
+}
+
+export function hashApiKey(rawKey: string): Promise<string> {
+  return argon2.hash(rawKey, ARGON2ID_OPTIONS);
+}
+
+export function isArgon2idHash(
+  value: string | null | undefined,
+): value is string {
+  return typeof value === 'string' && value.startsWith('$argon2id$');
+}
+
+export async function verifyApiKeyHash(
+  hash: string | null | undefined,
+  rawKey: string,
+): Promise<boolean> {
+  if (!isArgon2idHash(hash)) return false;
+
+  try {
+    return await argon2.verify(hash, rawKey);
+  } catch {
+    return false;
+  }
+}

app/backend/src/api-keys/api-key-hash.util.ts

@@ -3,6 +3,7 @@ import { BadRequestException, NotFoundException } from '@nestjs/common';
 import { ApiKeysService } from './api-keys.service';
 import { PrismaService } from '../prisma/prisma.service';
 import { AppRole } from '../auth/app-role.enum';
+import { verifyApiKeyHash } from './api-key-hash.util';
 
 describe('ApiKeysService', () => {
   let service: ApiKeysService;
@@ -55,6 +56,11 @@ describe('ApiKeysService', () => {
 
     expect(result.id).toBe('k1');
     expect(result.apiKey).toMatch(/^s2s_/);
+    const createCall = mockPrisma.apiKey.create.mock.calls[0][0];
+    expect(createCall.data.keyHash).toMatch(/^\$argon2id\$/);
+    await expect(
+      verifyApiKeyHash(createCall.data.keyHash, result.apiKey),
+    ).resolves.toBe(true);
   });
 
   it('requires ngoId for NGO role', async () => {
@@ -177,6 +183,11 @@ describe('ApiKeysService', () => {
 
       expect(result.replacement.id).toBe('new');
       expect(result.apiKey).toMatch(/^s2s_/);
+      const createCall = tx.apiKey.create.mock.calls[0][0];
+      expect(createCall.data.keyHash).toMatch(/^\$argon2id\$/);
+      await expect(
+        verifyApiKeyHash(createCall.data.keyHash, result.apiKey),
+      ).resolves.toBe(true);
       expect(tx.apiKey.update).toHaveBeenCalledWith(
         expect.objectContaining({
           where: { id: 'old' },