store plaintext secret key in .env, hash at startup

2026-06-25 16:43:49 +03:00
parent 9644b64a90
commit 8df9af86e6
4 changed files with 14 additions and 10 deletions
@@ -12,8 +12,15 @@ import 'dart:io';
 class AuthRoutes {
  final DatabaseProvider database;
  final Map<String, DateTime> _lastRequest = {};
+  final String _registrationKeyHash;

-  AuthRoutes(this.database);
+  AuthRoutes(this.database) : _registrationKeyHash = _loadRegistrationKeyHash();
+
+  static String _loadRegistrationKeyHash() {
+    final dotenv = DotEnv();
+    final key = dotenv['REGISTRATION_SECRET_KEY'] ?? '';
+    return BCrypt.hashpw(key, BCrypt.gensalt());
+  }

  Router get routes {
    final router = Router();
@@ -112,10 +119,7 @@ class AuthRoutes {
      return response;
    }

-    final envDotenv = DotEnv();
-    final storedHash = envDotenv['REGISTRATION_SECRET_KEY'] ?? '';
-
-    if (!BCrypt.checkpw(secretKey, storedHash)) {
+    if (!BCrypt.checkpw(secretKey, _registrationKeyHash)) {
      stopwatch.stop();
      final response = Response(403, body: jsonEncode({'error': 'Invalid registration key'}), headers: {'Content-Type': 'application/json'});
      logRequest(method: 'POST', url: '/reg', status: 403, duration: stopwatch.elapsed, body: body, responseHeaders: response.headers);