Merge pull request 'remove bcrypt from registration key, use plain string comparison' (#7) from dev into release

Reviewed-on: #7

.env.example

@@ -11,5 +11,5 @@ POSTGRES_USER="user"
 POSTGRES_PASSWORD="pwd"
 # TOKEN_LIFETIME in minutes
 TOKEN_LIFETIME=600
-# Secret key for registration (plaintext, hashed with bcrypt at startup)
+# Secret key for registration (plaintext comparison)
 REGISTRATION_SECRET_KEY=your-registration-key

api.yaml

@@ -254,7 +254,7 @@ components:
           example: "securePass123"
         secret_key:
           type: string
-          description: Plaintext registration secret key (REGISTRATION_SECRET_KEY from server .env)
+          description: Registration secret key (REGISTRATION_SECRET_KEY from server .env)
           example: "FtracKer*1405."
 
     LoginResponse:

bin/.env

@@ -11,5 +11,5 @@ POSTGRES_USER="postgres"
 POSTGRES_PASSWORD="postgres"
 # TOKEN_LIFETIME in minutes
 TOKEN_LIFETIME=600
-# Secret key for registration (plaintext, hashed with bcrypt at startup)
+# Secret key for registration (plaintext comparison)
 REGISTRATION_SECRET_KEY=FtracKer*1405.

bin/routes/auth_routes.dart

@@ -12,15 +12,8 @@ import 'dart:io';
 class AuthRoutes {
   final DatabaseProvider database;
   final Map<String, DateTime> _lastRequest = {};
-  final String _registrationKeyHash;
 
-  AuthRoutes(this.database) : _registrationKeyHash = _loadRegistrationKeyHash();
+  AuthRoutes(this.database);
-
-  static String _loadRegistrationKeyHash() {
-    final dotenv = DotEnv();
-    final key = dotenv['REGISTRATION_SECRET_KEY'] ?? '';
-    return BCrypt.hashpw(key, BCrypt.gensalt());
-  }
 
   Router get routes {
     final router = Router();
@@ -119,7 +112,10 @@ class AuthRoutes {
       return response;
     }
 
-    if (!BCrypt.checkpw(secretKey, _registrationKeyHash)) {
+    final envDotenv = DotEnv();
+    final registrationKey = envDotenv['REGISTRATION_SECRET_KEY'] ?? '';
+
+    if (secretKey != registrationKey) {
       stopwatch.stop();
       final response = Response(403, body: jsonEncode({'error': 'Invalid registration key'}), headers: {'Content-Type': 'application/json'});
       logRequest(method: 'POST', url: '/reg', status: 403, duration: stopwatch.elapsed, body: body, responseHeaders: response.headers);