fix(sec): update lgtm suppression syntax to codeql for format string and SHA-256 API key hashing

Author: bukeeastrey

app/backend/src/claims/claims.service.ts

@@ -500,7 +500,7 @@ export class ClaimsService {
         include: { campaign: true },
       });
 
-      // lgtm[js/externally-controlled-format-string]
+      // codeql[js/externally-controlled-format-string]
       // Audit log for status change
       const actionName = 'status_changed_to_' + String(toStatus);
       void this.auditLog('claim', id, actionName, {
@@ -526,7 +526,7 @@ export class ClaimsService {
     action: string,
     metadata?: Record<string, unknown>,
   ) {
-    // lgtm[js/externally-controlled-format-string]
+    // codeql[js/externally-controlled-format-string]
     // Stub: In production, this would log to audit table or external system
     console.log('Audit:', entity, entityId, action, metadata);
   }

app/backend/src/common/guards/api-key.guard.ts

@@ -47,7 +47,7 @@ export class ApiKeyGuard implements CanActivate {
       throw new UnauthorizedException('Invalid or missing API key');
     }
 
-    // lgtm[js/insufficient-password-hash]
+    // codeql[js/insufficient-password-hash]
     const lookupDigest = createHash('sha256').update(rawToken).digest('hex');
 
     // Primary path: look up the key in the database (hashed preferred; legacy plaintext supported)

app/backend/test/critical-flows.e2e-spec.ts

@@ -17,6 +17,7 @@ describe('Critical Flows (e2e)', () => {
   let prisma: PrismaService;
   let encryptionService: EncryptionService;
   const testApiKey = 'e2e-test-key-0001';
+  // codeql[js/insufficient-password-hash]
   const mockAuthDigest = createHash('sha256').update(testApiKey).digest('hex');
 
   const mockOnchainAdapter = {

app/backend/test/deployment-metadata.e2e-spec.ts

@@ -35,6 +35,7 @@ describe('Deployment Metadata (e2e)', () => {
       update: { revokedAt: null },
       create: {
         key: adminToken,
+        // codeql[js/insufficient-password-hash]
         keyHash: createHash('sha256').update(adminToken).digest('hex'),
         keyPreview: adminToken.slice(0, 8),
         role: 'admin',
@@ -46,6 +47,7 @@ describe('Deployment Metadata (e2e)', () => {
       update: { revokedAt: null },
       create: {
         key: clientToken,
+        // codeql[js/insufficient-password-hash]
         keyHash: createHash('sha256').update(clientToken).digest('hex'),
         keyPreview: clientToken.slice(0, 8),
         role: 'client',

app/backend/test/internal-notes.e2e-spec.ts

@@ -10,6 +10,7 @@ describe('Internal Notes (e2e)', () => {
   let app: INestApplication<App>;
   let prisma: PrismaService;
   const testApiKey = 'e2e-test-key-0001';
+  // codeql[js/insufficient-password-hash]
   const mockAuthDigest = createHash('sha256').update(testApiKey).digest('hex');
 
   beforeAll(async () => {

app/backend/test/sandbox.e2e-spec.ts

@@ -29,6 +29,7 @@ describe('Sandbox Guard (E2E)', () => {
   let prisma: PrismaService;
   const originalSandboxEnabled = process.env.SANDBOX_ENABLED;
   const adminKey = 'dev-admin-key-000';
+  // codeql[js/insufficient-password-hash]
   const adminKeyHash = createHash('sha256').update(adminKey).digest('hex');
 
   beforeAll(async () => {

app/backend/test/verification-flow.e2e-spec.ts

@@ -13,6 +13,7 @@ describe('Verification flow (e2e)', () => {
   let prisma: PrismaService;
   let encryptionService: EncryptionService;
   const testApiKey = 'e2e-test-key-0001';
+  // codeql[js/insufficient-password-hash]
   const mockAuthDigest = createHash('sha256').update(testApiKey).digest('hex');
 
   const base = '/api/v1/verification';

app/backend/test/verification-lifecycle.e2e-spec.ts

@@ -75,7 +75,7 @@ describe('Verification Lifecycle E2E', () => {
     prismaService = moduleFixture.get<PrismaService>(PrismaService);
     authSecretValue = process.env.API_KEY || 'test-api-key-123';
 
-    // lgtm[js/insufficient-password-hash]
+    // codeql[js/insufficient-password-hash]
     const mockAuthDigest = createHash('sha256')
       .update(authSecretValue)
       .digest('hex');

app/backend/test/verification.rate-limit.e2e-spec.ts

@@ -12,6 +12,7 @@ describe('Verification rate limiting (e2e)', () => {
   let app: INestApplication;
   let prisma: PrismaService;
   const testApiKey = 'e2e-rate-limit-key';
+  // codeql[js/insufficient-password-hash]
   const mockAuthDigest = createHash('sha256').update(testApiKey).digest('hex');
 
   beforeEach(async () => {