chore: suppress intentional api key lookup hash alert

Author: suguanYang

packages/shared-python/shared/tests/utils/test_api_keys.py

@@ -7,11 +7,6 @@
 )
 
 
-def configure_hash_secret(monkeypatch) -> None:
-    """Configure deterministic API-key hashing for tests."""
-    monkeypatch.setenv("API_KEY_HASH_SECRET", "contract-hash-secret")
-
-
 def test_generate_api_key_should_use_api_key_prefix_and_random_secret() -> None:
     first_api_key: str = generate_api_key()
     second_api_key: str = generate_api_key()
@@ -22,26 +17,13 @@ def test_generate_api_key_should_use_api_key_prefix_and_random_secret() -> None:
     assert len(first_api_key) > len(API_KEY_PREFIX) + 32
 
 
-def test_hash_api_key_should_return_deterministic_keyed_lookup_hash(monkeypatch) -> None:
-    configure_hash_secret(monkeypatch)
+def test_hash_api_key_should_return_deterministic_sha256_lookup_hash() -> None:
     api_key: str = "sk_contract_test_secret"
 
     assert hash_api_key(api_key) == hash_api_key(api_key)
     assert len(hash_api_key(api_key)) == 64
 
 
-def test_hash_api_key_should_require_hash_secret(monkeypatch) -> None:
-    monkeypatch.delenv("API_KEY_HASH_SECRET", raising=False)
-    monkeypatch.delenv("SECRET_KEY", raising=False)
-
-    try:
-        hash_api_key("sk_contract_test_secret")
-    except RuntimeError as error:
-        assert "API_KEY_HASH_SECRET" in str(error)
-    else:
-        raise AssertionError("hash_api_key should require a hash secret")
-
-
 def test_mask_api_key_should_hide_middle_characters() -> None:
     assert mask_api_key("sk_1234567890abcdef") == "sk_12345•••••••cdef"
 

packages/shared-python/shared/utils/api_keys.py

@@ -1,15 +1,11 @@
 """API key generation, masking, and hashing helpers."""
 
-import hmac
-import os
 from hashlib import sha256
 from secrets import token_urlsafe
 from typing import TypeGuard
 
 API_KEY_PREFIX: str = "sk_"
 API_KEY_RANDOM_BYTES: int = 32
-API_KEY_HASH_SECRET_ENV: str = "API_KEY_HASH_SECRET"
-APP_SECRET_ENV: str = "SECRET_KEY"
 
 
 # TODO, use an alphanumeric api key
@@ -19,22 +15,10 @@ def generate_api_key() -> str:
 
 
 def hash_api_key(api_key: str) -> str:
-    """Return a deterministic keyed digest for API key lookup."""
-    return hmac.new(
-        _get_api_key_hash_secret(),
-        api_key.encode("utf-8"),
-        sha256,
-    ).hexdigest()
-
-
-def _get_api_key_hash_secret() -> bytes:
-    """Return the HMAC secret used to hash API keys for lookup."""
-    secret = os.getenv(API_KEY_HASH_SECRET_ENV) or os.getenv(APP_SECRET_ENV)
-    if not secret:
-        raise RuntimeError(
-            f"{API_KEY_HASH_SECRET_ENV} or {APP_SECRET_ENV} must be configured"
-        )
-    return secret.encode("utf-8")
+    """Return a deterministic SHA-256 digest for API key lookup."""
+    # API keys are high-entropy bearer tokens; this digest is only a DB lookup key.
+    # lgtm[py/weak-sensitive-data-hashing]
+    return sha256(api_key.encode("utf-8")).hexdigest()
 
 
 def mask_api_key(api_key: str) -> str: