refactor: Move API keys into their own table (no-changelog) (#10629)

Co-authored-by: कारतोफ्फेलस्क्रिप्ट™ <aditya@netroy.in>

packages/cli/src/controllers/__tests__/me.controller.test.ts

@@ -2,11 +2,14 @@ import { UserUpdateRequestDto } from '@n8n/api-types';
 import type { Response } from 'express';
 import { mock, anyObject } from 'jest-mock-extended';
 import jwt from 'jsonwebtoken';
+import { randomString } from 'n8n-workflow';
 import { Container } from 'typedi';
 
 import { AUTH_COOKIE_NAME } from '@/constants';
-import { API_KEY_PREFIX, MeController } from '@/controllers/me.controller';
+import { MeController } from '@/controllers/me.controller';
+import type { ApiKey } from '@/databases/entities/api-key';
 import type { User } from '@/databases/entities/user';
+import { ApiKeyRepository } from '@/databases/repositories/api-key.repository';
 import { AuthUserRepository } from '@/databases/repositories/auth-user.repository';
 import { InvalidAuthTokenRepository } from '@/databases/repositories/invalid-auth-token.repository';
 import { UserRepository } from '@/databases/repositories/user.repository';
@@ -18,6 +21,7 @@ import type { PublicUser } from '@/interfaces';
 import { License } from '@/license';
 import { MfaService } from '@/mfa/mfa.service';
 import type { AuthenticatedRequest, MeRequest } from '@/requests';
+import { API_KEY_PREFIX } from '@/services/public-api-key.service';
 import { UserService } from '@/services/user.service';
 import { mockInstance } from '@test/mocking';
 import { badPasswords } from '@test/test-data';
@@ -30,6 +34,7 @@ describe('MeController', () => {
 	const userService = mockInstance(UserService);
 	const userRepository = mockInstance(UserRepository);
 	const mockMfaService = mockInstance(MfaService);
+	const apiKeysRepository = mockInstance(ApiKeyRepository);
 	mockInstance(AuthUserRepository);
 	mockInstance(InvalidAuthTokenRepository);
 	mockInstance(License).isWithinUsersLimit.mockReturnValue(true);
@@ -412,27 +417,63 @@ describe('MeController', () => {
 	describe('API Key methods', () => {
 		let req: AuthenticatedRequest;
 		beforeAll(() => {
-			req = mock({ user: mock<Partial<User>>({ id: '123', apiKey: `${API_KEY_PREFIX}test-key` }) });
+			req = mock<AuthenticatedRequest>({ user: mock<User>({ id: '123' }) });
 		});
 
 		describe('createAPIKey', () => {
 			it('should create and save an API key', async () => {
-				const { apiKey } = await controller.createAPIKey(req);
-				expect(userService.update).toHaveBeenCalledWith(req.user.id, { apiKey });
+				const apiKeyData = {
+					id: '123',
+					userId: '123',
+					label: 'My API Key',
+					apiKey: `${API_KEY_PREFIX}${randomString(42)}`,
+					createdAt: new Date(),
+				} as ApiKey;
+
+				apiKeysRepository.upsert.mockImplementation();
+
+				apiKeysRepository.findOneByOrFail.mockResolvedValue(apiKeyData);
+
+				const newApiKey = await controller.createAPIKey(req);
+
+				expect(apiKeysRepository.upsert).toHaveBeenCalled();
+				expect(apiKeyData).toEqual(newApiKey);
 			});
 		});
 
-		describe('getAPIKey', () => {
-			it('should return the users api key redacted', async () => {
-				const { apiKey } = await controller.getAPIKey(req);
-				expect(apiKey).not.toEqual(req.user.apiKey);
+		describe('getAPIKeys', () => {
+			it('should return the users api keys redacted', async () => {
+				const apiKeyData = {
+					id: '123',
+					userId: '123',
+					label: 'My API Key',
+					apiKey: `${API_KEY_PREFIX}${randomString(42)}`,
+					createdAt: new Date(),
+				} as ApiKey;
+
+				apiKeysRepository.findBy.mockResolvedValue([apiKeyData]);
+
+				const apiKeys = await controller.getAPIKeys(req);
+				expect(apiKeys[0].apiKey).not.toEqual(apiKeyData.apiKey);
+				expect(apiKeysRepository.findBy).toHaveBeenCalledWith({ userId: req.user.id });
 			});
 		});
 
 		describe('deleteAPIKey', () => {
 			it('should delete the API key', async () => {
+				const user = mock<User>({
+					id: '123',
+					password: 'password',
+					authIdentities: [],
+					role: 'global:member',
+					mfaEnabled: false,
+				});
+				const req = mock<MeRequest.DeleteAPIKey>({ user, params: { id: user.id } });
 				await controller.deleteAPIKey(req);
-				expect(userService.update).toHaveBeenCalledWith(req.user.id, { apiKey: null });
+				expect(apiKeysRepository.delete).toHaveBeenCalledWith({
+					userId: req.user.id,
+					id: req.params.id,
+				});
 			});
 		});
 	});

packages/cli/src/controllers/me.controller.ts

@@ -4,7 +4,6 @@ import {
 	UserUpdateRequestDto,
 } from '@n8n/api-types';
 import { plainToInstance } from 'class-transformer';
-import { randomBytes } from 'crypto';
 import { type RequestHandler, Response } from 'express';
 
 import { AuthService } from '@/auth/auth.service';
@@ -22,13 +21,12 @@ import { MfaService } from '@/mfa/mfa.service';
 import { isApiEnabled } from '@/public-api';
 import { AuthenticatedRequest, MeRequest } from '@/requests';
 import { PasswordUtility } from '@/services/password.utility';
+import { PublicApiKeyService } from '@/services/public-api-key.service';
 import { UserService } from '@/services/user.service';
 import { isSamlLicensedAndEnabled } from '@/sso/saml/saml-helpers';
 
 import { PersonalizationSurveyAnswersV4 } from './survey-answers.dto';
 
-export const API_KEY_PREFIX = 'n8n_api_';
-
 export const isApiEnabledMiddleware: RequestHandler = (_, res, next) => {
 	if (isApiEnabled()) {
 		next();
@@ -48,6 +46,7 @@ export class MeController {
 		private readonly userRepository: UserRepository,
 		private readonly eventService: EventService,
 		private readonly mfaService: MfaService,
+		private readonly publicApiKeyService: PublicApiKeyService,
 	) {}
 
 	/**
@@ -219,34 +218,32 @@ export class MeController {
 	}
 
 	/**
-	 * Creates an API Key
+	 * Create an API Key
 	 */
-	@Post('/api-key', { middlewares: [isApiEnabledMiddleware] })
+	@Post('/api-keys', { middlewares: [isApiEnabledMiddleware] })
 	async createAPIKey(req: AuthenticatedRequest) {
-		const apiKey = `n8n_api_${randomBytes(40).toString('hex')}`;
-
-		await this.userService.update(req.user.id, { apiKey });
+		const newApiKey = await this.publicApiKeyService.createPublicApiKeyForUser(req.user);
 
 		this.eventService.emit('public-api-key-created', { user: req.user, publicApi: false });
 
-		return { apiKey };
+		return newApiKey;
 	}
 
 	/**
-	 * Get an API Key
+	 * Get API keys
 	 */
-	@Get('/api-key', { middlewares: [isApiEnabledMiddleware] })
-	async getAPIKey(req: AuthenticatedRequest) {
-		const apiKey = this.redactApiKey(req.user.apiKey);
-		return { apiKey };
+	@Get('/api-keys', { middlewares: [isApiEnabledMiddleware] })
+	async getAPIKeys(req: AuthenticatedRequest) {
+		const apiKeys = await this.publicApiKeyService.getRedactedApiKeysForUser(req.user);
+		return apiKeys;
 	}
 
 	/**
-	 * Deletes an API Key
+	 * Delete an API Key
 	 */
-	@Delete('/api-key', { middlewares: [isApiEnabledMiddleware] })
-	async deleteAPIKey(req: AuthenticatedRequest) {
-		await this.userService.update(req.user.id, { apiKey: null });
+	@Delete('/api-keys/:id', { middlewares: [isApiEnabledMiddleware] })
+	async deleteAPIKey(req: MeRequest.DeleteAPIKey) {
+		await this.publicApiKeyService.deleteApiKeyForUser(req.user, req.params.id);
 
 		this.eventService.emit('public-api-key-deleted', { user: req.user, publicApi: false });
 
@@ -273,14 +270,4 @@ export class MeController {
 
 		return user.settings;
 	}
-
-	private redactApiKey(apiKey: string | null) {
-		if (!apiKey) return;
-		const keepLength = 5;
-		return (
-			API_KEY_PREFIX +
-			apiKey.slice(API_KEY_PREFIX.length, API_KEY_PREFIX.length + keepLength) +
-			'*'.repeat(apiKey.length - API_KEY_PREFIX.length - keepLength)
-		);
-	}
 }

packages/cli/src/databases/entities/__tests__/user.entity.test.ts

@@ -8,7 +8,6 @@ describe('User Entity', () => {
 				firstName: 'Don',
 				lastName: 'Joe',
 				password: '123456789',
-				apiKey: '123',
 			});
 			expect(JSON.stringify(user)).toEqual(
 				'{"email":"test@example.com","firstName":"Don","lastName":"Joe"}',

packages/cli/src/databases/entities/api-key.ts

@@ -0,0 +1,25 @@
+import { Column, Entity, Index, ManyToOne, Unique } from '@n8n/typeorm';
+
+import { WithTimestampsAndStringId } from './abstract-entity';
+import { User } from './user';
+
+@Entity('user_api_keys')
+@Unique(['userId', 'label'])
+export class ApiKey extends WithTimestampsAndStringId {
+	@ManyToOne(
+		() => User,
+		(user) => user.id,
+		{ onDelete: 'CASCADE' },
+	)
+	user: User;
+
+	@Column({ type: String })
+	userId: string;
+
+	@Column({ type: String })
+	label: string;
+
+	@Index({ unique: true })
+	@Column({ type: String })
+	apiKey: string;
+}

packages/cli/src/databases/entities/index.ts

@@ -1,5 +1,6 @@
 import { AnnotationTagEntity } from './annotation-tag-entity.ee';
 import { AnnotationTagMapping } from './annotation-tag-mapping.ee';
+import { ApiKey } from './api-key';
 import { AuthIdentity } from './auth-identity';
 import { AuthProviderSyncHistory } from './auth-provider-sync-history';
 import { AuthUser } from './auth-user';
@@ -54,4 +55,5 @@ export const entities = {
 	WorkflowHistory,
 	Project,
 	ProjectRelation,
+	ApiKey,
 };

packages/cli/src/databases/entities/user.ts

@@ -23,6 +23,7 @@ import { NoUrl } from '@/validators/no-url.validator';
 import { NoXss } from '@/validators/no-xss.validator';
 
 import { WithTimestamps, jsonColumnType } from './abstract-entity';
+import type { ApiKey } from './api-key';
 import type { AuthIdentity } from './auth-identity';
 import type { ProjectRelation } from './project-relation';
 import type { SharedCredentials } from './shared-credentials';
@@ -89,6 +90,9 @@ export class User extends WithTimestamps implements IUser {
 	@OneToMany('AuthIdentity', 'user')
 	authIdentities: AuthIdentity[];
 
+	@OneToMany('ApiKey', 'user')
+	apiKeys: ApiKey[];
+
 	@OneToMany('SharedWorkflow', 'user')
 	sharedWorkflows: SharedWorkflow[];
 
@@ -107,10 +111,6 @@ export class User extends WithTimestamps implements IUser {
 		this.email = this.email?.toLowerCase() ?? null;
 	}
 
-	@Column({ type: String, nullable: true })
-	@Index({ unique: true })
-	apiKey: string | null;
-
 	@Column({ type: Boolean, default: false })
 	mfaEnabled: boolean;
 
@@ -151,7 +151,7 @@ export class User extends WithTimestamps implements IUser {
 	}
 
 	toJSON() {
-		const { password, apiKey, ...rest } = this;
+		const { password, ...rest } = this;
 		return rest;
 	}
 

packages/cli/src/databases/migrations/common/1724951148974-AddApiKeysTable.ts

@@ -0,0 +1,58 @@
+import type { ApiKey } from '@/databases/entities/api-key';
+import type { MigrationContext } from '@/databases/types';
+import { generateNanoId } from '@/databases/utils/generators';
+
+export class AddApiKeysTable1724951148974 {
+	async up({
+		queryRunner,
+		escape,
+		runQuery,
+		schemaBuilder: { createTable, column },
+	}: MigrationContext) {
+		const userTable = escape.tableName('user');
+		const userApiKeysTable = escape.tableName('user_api_keys');
+		const userIdColumn = escape.columnName('userId');
+		const apiKeyColumn = escape.columnName('apiKey');
+		const labelColumn = escape.columnName('label');
+		const idColumn = escape.columnName('id');
+
+		// Create the new table
+		await createTable('user_api_keys')
+			.withColumns(
+				column('id').varchar(36).primary,
+				column('userId').uuid.notNull,
+				column('label').varchar(100).notNull,
+				column('apiKey').varchar().notNull,
+			)
+			.withForeignKey('userId', {
+				tableName: 'user',
+				columnName: 'id',
+				onDelete: 'CASCADE',
+			})
+			.withIndexOn(['userId', 'label'], true)
+			.withIndexOn(['apiKey'], true).withTimestamps;
+
+		const usersWithApiKeys = (await queryRunner.query(
+			`SELECT ${idColumn}, ${apiKeyColumn} FROM ${userTable} WHERE ${apiKeyColumn} IS NOT NULL`,
+		)) as Array<Partial<ApiKey>>;
+
+		// Move the apiKey from the users table to the new table
+		await Promise.all(
+			usersWithApiKeys.map(
+				async (user: { id: string; apiKey: string }) =>
+					await runQuery(
+						`INSERT INTO ${userApiKeysTable} (${idColumn}, ${userIdColumn}, ${apiKeyColumn}, ${labelColumn}) VALUES (:id, :userId, :apiKey, :label)`,
+						{
+							id: generateNanoId(),
+							userId: user.id,
+							apiKey: user.apiKey,
+							label: 'My API Key',
+						},
+					),
+			),
+		);
+
+		//  Drop apiKey column on user's table
+		await queryRunner.query(`ALTER TABLE ${userTable} DROP COLUMN ${apiKeyColumn};`);
+	}
+}

packages/cli/src/databases/migrations/mysqldb/index.ts

@@ -63,6 +63,7 @@ import { AddConstraintToExecutionMetadata1720101653148 } from '../common/1720101
 import { CreateInvalidAuthTokenTable1723627610222 } from '../common/1723627610222-CreateInvalidAuthTokenTable';
 import { RefactorExecutionIndices1723796243146 } from '../common/1723796243146-RefactorExecutionIndices';
 import { CreateAnnotationTables1724753530828 } from '../common/1724753530828-CreateExecutionAnnotationTables';
+import { AddApiKeysTable1724951148974 } from '../common/1724951148974-AddApiKeysTable';
 
 export const mysqlMigrations: Migration[] = [
 	InitialMigration1588157391238,
@@ -128,4 +129,5 @@ export const mysqlMigrations: Migration[] = [
 	CreateInvalidAuthTokenTable1723627610222,
 	RefactorExecutionIndices1723796243146,
 	CreateAnnotationTables1724753530828,
+	AddApiKeysTable1724951148974,
 ];

packages/cli/src/databases/migrations/postgresdb/index.ts

@@ -63,6 +63,7 @@ import { AddConstraintToExecutionMetadata1720101653148 } from '../common/1720101
 import { CreateInvalidAuthTokenTable1723627610222 } from '../common/1723627610222-CreateInvalidAuthTokenTable';
 import { RefactorExecutionIndices1723796243146 } from '../common/1723796243146-RefactorExecutionIndices';
 import { CreateAnnotationTables1724753530828 } from '../common/1724753530828-CreateExecutionAnnotationTables';
+import { AddApiKeysTable1724951148974 } from '../common/1724951148974-AddApiKeysTable';
 
 export const postgresMigrations: Migration[] = [
 	InitialMigration1587669153312,
@@ -128,4 +129,5 @@ export const postgresMigrations: Migration[] = [
 	CreateInvalidAuthTokenTable1723627610222,
 	RefactorExecutionIndices1723796243146,
 	CreateAnnotationTables1724753530828,
+	AddApiKeysTable1724951148974,
 ];

packages/cli/src/databases/migrations/sqlite/1724951148974-AddApiKeysTable.ts

@@ -0,0 +1,77 @@
+import type { ApiKey } from '@/databases/entities/api-key';
+import type { MigrationContext } from '@/databases/types';
+import { generateNanoId } from '@/databases/utils/generators';
+
+export class AddApiKeysTable1724951148974 {
+	async up({ queryRunner, tablePrefix, runQuery }: MigrationContext) {
+		const tableName = `${tablePrefix}user_api_keys`;
+
+		// Create the table
+		await queryRunner.query(`
+			CREATE TABLE ${tableName} (
+				id VARCHAR(36) PRIMARY KEY NOT NULL,
+				"userId" VARCHAR NOT NULL,
+				"label" VARCHAR(100) NOT NULL,
+				"apiKey" VARCHAR NOT NULL,
+				"createdAt" DATETIME(3) NOT NULL DEFAULT (STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW')),
+				"updatedAt" DATETIME(3) NOT NULL DEFAULT (STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW')),
+				FOREIGN KEY ("userId") REFERENCES user(id) ON DELETE CASCADE,
+				UNIQUE ("userId", label),
+				UNIQUE("apiKey")
+			);
+		`);
+
+		const usersWithApiKeys = (await queryRunner.query(
+			`SELECT id, "apiKey" FROM ${tablePrefix}user WHERE "apiKey" IS NOT NULL`,
+		)) as Array<Partial<ApiKey>>;
+
+		// Move the apiKey from the users table to the new table
+		await Promise.all(
+			usersWithApiKeys.map(
+				async (user: { id: string; apiKey: string }) =>
+					await runQuery(
+						`INSERT INTO ${tableName} ("id", "userId", "apiKey", "label") VALUES (:id, :userId, :apiKey, :label)`,
+						{
+							id: generateNanoId(),
+							userId: user.id,
+							apiKey: user.apiKey,
+							label: 'My API Key',
+						},
+					),
+			),
+		);
+
+		// Create temporary table to store the users dropping the api key column
+		await queryRunner.query(`
+				CREATE TABLE users_new (
+					id varchar PRIMARY KEY,
+					email VARCHAR(255) UNIQUE,
+					"firstName" VARCHAR(32),
+					"lastName" VARCHAR(32),
+					password VARCHAR,
+					"personalizationAnswers" TEXT,
+					"createdAt" DATETIME(3) NOT NULL DEFAULT (STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW')),
+					"updatedAt" DATETIME(3) NOT NULL DEFAULT (STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW')),
+					settings TEXT,
+					disabled BOOLEAN DEFAULT FALSE NOT NULL,
+					"mfaEnabled" BOOLEAN DEFAULT FALSE NOT NULL,
+					"mfaSecret" TEXT,
+					"mfaRecoveryCodes" TEXT,
+					role TEXT NOT NULL
+			);
+		`);
+
+		//  Copy the data from the original users table
+		await queryRunner.query(`
+			INSERT INTO users_new ("id", "email", "firstName", "lastName", "password", "personalizationAnswers", "createdAt", "updatedAt", "settings", "disabled", "mfaEnabled", "mfaSecret", "mfaRecoveryCodes", "role")
+			SELECT "id", "email", "firstName", "lastName", "password", "personalizationAnswers", "createdAt", "updatedAt", "settings", "disabled", "mfaEnabled", "mfaSecret", "mfaRecoveryCodes", "role"
+			FROM ${tablePrefix}user;
+		`);
+
+		// Drop table with apiKey column
+		await queryRunner.query(`DROP TABLE ${tablePrefix}user;`);
+
+		// Rename the temporary table to users
+		await queryRunner.query('ALTER TABLE users_new RENAME TO user;');
+	}
+}

packages/cli/src/databases/migrations/sqlite/index.ts

@@ -37,6 +37,7 @@ import { AddMfaColumns1690000000030 } from './1690000000040-AddMfaColumns';
 import { ExecutionSoftDelete1693491613982 } from './1693491613982-ExecutionSoftDelete';
 import { DropRoleMapping1705429061930 } from './1705429061930-DropRoleMapping';
 import { AddActivatedAtUserSetting1717498465931 } from './1717498465931-AddActivatedAtUserSetting';
+import { AddApiKeysTable1724951148974 } from './1724951148974-AddApiKeysTable';
 import { UniqueWorkflowNames1620821879465 } from '../common/1620821879465-UniqueWorkflowNames';
 import { UpdateWorkflowCredentials1630330987096 } from '../common/1630330987096-UpdateWorkflowCredentials';
 import { AddNodeIds1658930531669 } from '../common/1658930531669-AddNodeIds';
@@ -122,6 +123,7 @@ const sqliteMigrations: Migration[] = [
 	CreateInvalidAuthTokenTable1723627610222,
 	RefactorExecutionIndices1723796243146,
 	CreateAnnotationTables1724753530828,
+	AddApiKeysTable1724951148974,
 ];
 
 export { sqliteMigrations };

packages/cli/src/databases/repositories/api-key.repository.ts

@@ -0,0 +1,11 @@
+import { DataSource, Repository } from '@n8n/typeorm';
+import { Service } from 'typedi';
+
+import { ApiKey } from '../entities/api-key';
+
+@Service()
+export class ApiKeyRepository extends Repository<ApiKey> {
+	constructor(dataSource: DataSource) {
+		super(ApiKey, dataSource.manager);
+	}
+}

packages/cli/src/public-api/index.ts

@@ -10,10 +10,10 @@ import { Container } from 'typedi';
 import validator from 'validator';
 import YAML from 'yamljs';
 
-import { UserRepository } from '@/databases/repositories/user.repository';
 import { EventService } from '@/events/event.service';
 import { License } from '@/license';
 import type { AuthenticatedRequest } from '@/requests';
+import { PublicApiKeyService } from '@/services/public-api-key.service';
 import { UrlService } from '@/services/url.service';
 
 async function createApiRouter(
@@ -90,10 +90,9 @@ async function createApiRouter(
 						_scopes: unknown,
 						schema: OpenAPIV3.ApiKeySecurityScheme,
 					): Promise<boolean> => {
-						const apiKey = req.headers[schema.name.toLowerCase()] as string;
-						const user = await Container.get(UserRepository).findOne({
-							where: { apiKey },
-						});
+						const providedApiKey = req.headers[schema.name.toLowerCase()] as string;
+
+						const user = await Container.get(PublicApiKeyService).getUserForApiKey(providedApiKey);
 
 						if (!user) return false;
 

packages/cli/src/requests.ts

@@ -186,6 +186,7 @@ export declare namespace CredentialRequest {
 
 export declare namespace MeRequest {
 	export type SurveyAnswers = AuthenticatedRequest<{}, {}, IPersonalizationSurveyAnswersV4>;
+	export type DeleteAPIKey = AuthenticatedRequest<{ id: string }>;
 }
 
 export interface UserSetupPayload {

packages/cli/src/services/public-api-key.service.ts

@@ -0,0 +1,80 @@
+import { randomBytes } from 'node:crypto';
+import Container, { Service } from 'typedi';
+
+import { ApiKey } from '@/databases/entities/api-key';
+import type { User } from '@/databases/entities/user';
+import { ApiKeyRepository } from '@/databases/repositories/api-key.repository';
+import { UserRepository } from '@/databases/repositories/user.repository';
+
+export const API_KEY_PREFIX = 'n8n_api_';
+
+@Service()
+export class PublicApiKeyService {
+	constructor(private readonly apiKeyRepository: ApiKeyRepository) {}
+
+	/**
+	 * Creates a new public API key for the specified user.
+	 * @param user - The user for whom the API key is being created.
+	 * @returns A promise that resolves to the newly created API key.
+	 */
+	async createPublicApiKeyForUser(user: User) {
+		const apiKey = this.createApiKeyString();
+		await this.apiKeyRepository.upsert(
+			this.apiKeyRepository.create({
+				userId: user.id,
+				apiKey,
+				label: 'My API Key',
+			}),
+			['apiKey'],
+		);
+
+		return await this.apiKeyRepository.findOneByOrFail({ apiKey });
+	}
+
+	/**
+	 * Retrieves and redacts API keys for a given user.
+	 * @param user - The user for whom to retrieve and redact API keys.
+	 * @returns A promise that resolves to an array of objects containing redacted API keys.
+	 */
+	async getRedactedApiKeysForUser(user: User) {
+		const apiKeys = await this.apiKeyRepository.findBy({ userId: user.id });
+		return apiKeys.map((apiKeyRecord) => ({
+			...apiKeyRecord,
+			apiKey: this.redactApiKey(apiKeyRecord.apiKey),
+		}));
+	}
+
+	async deleteApiKeyForUser(user: User, apiKeyId: string) {
+		await this.apiKeyRepository.delete({ userId: user.id, id: apiKeyId });
+	}
+
+	async getUserForApiKey(apiKey: string) {
+		return await Container.get(UserRepository)
+			.createQueryBuilder('user')
+			.innerJoin(ApiKey, 'apiKey', 'apiKey.userId = user.id')
+			.where('apiKey.apiKey = :apiKey', { apiKey })
+			.select('user')
+			.getOne();
+	}
+
+	/**
+	 * Redacts an API key by keeping the first few characters and replacing the rest with asterisks.
+	 * @param apiKey - The API key to be redacted. If null, the function returns undefined.
+	 * @returns The redacted API key with a fixed prefix and asterisks replacing the rest of the characters.
+	 * @example
+	 * ```typescript
+	 * const redactedKey = PublicApiKeyService.redactApiKey('12345-abcdef-67890');
+	 * console.log(redactedKey); // Output: '12345-*****'
+	 * ```
+	 */
+	redactApiKey(apiKey: string) {
+		const keepLength = 5;
+		return (
+			API_KEY_PREFIX +
+			apiKey.slice(API_KEY_PREFIX.length, API_KEY_PREFIX.length + keepLength) +
+			'*'.repeat(apiKey.length - API_KEY_PREFIX.length - keepLength)
+		);
+	}
+
+	createApiKeyString = () => `${API_KEY_PREFIX}${randomBytes(40).toString('hex')}`;
+}

packages/cli/src/services/user.service.ts

@@ -58,7 +58,7 @@ export class UserService {
 			withScopes?: boolean;
 		},
 	) {
-		const { password, updatedAt, apiKey, authIdentities, ...rest } = user;
+		const { password, updatedAt, authIdentities, ...rest } = user;
 
 		const ldapIdentity = authIdentities?.find((i) => i.providerType === 'ldap');