zhi/HarborForge.Backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge fix/security-audit: RBAC/API-key-hash/cookie hardening

Browse Source
This commit is contained in:
h z
2026-06-01 09:23:35 +01:00
parent 16199c9280 3f5f813c65
commit 1a5a3ed1b1
8 changed files with 74 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
app/models/apikey.py
View File

@@ -7,7 +7,10 @@ class APIKey(Base):
__tablename__ = "api_keys"
id = Column(Integer, primary_key=True, index=True)
key = Column(String(64), unique=True, nullable=False, index=True)
# The raw key is never stored — only its SHA-256 hash. `key_prefix` holds
# the first few chars for human-readable display/masking in listings.
key_hash = Column(String(64), unique=True, nullable=False, index=True)
key_prefix = Column(String(16), nullable=True)
name = Column(String(100), nullable=False) # e.g. "agent-zhi", "agent-lyn"
user_id = Column(Integer, ForeignKey("users.id"), nullable=False)
is_active = Column(Boolean, default=True)