From c1a2c6c591dc61a02b6e9bcab3d954ce243c1197 Mon Sep 17 00:00:00 2001
From: khang <khanghugo123@gmail.com>
Date: Mon, 22 Aug 2022 11:39:37 -0400
Subject: [PATCH] obscuring api key when called from webapp

---
 lib/routes/api/speech-credentials.js | 30 +++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/lib/routes/api/speech-credentials.js b/lib/routes/api/speech-credentials.js
index 53990f8..9e9ae9c 100644
--- a/lib/routes/api/speech-credentials.js
+++ b/lib/routes/api/speech-credentials.js
@@ -15,6 +15,12 @@ const {
   testWellSaidTts
 } = require('../../utils/speech-utils');
 
+const obscureKey = (key) => {
+  const key_spoiler_length = 6;
+  const key_spoiler_char = 'X';
+
+  return `${key.slice(0, key_spoiler_length)}${key_spoiler_char.repeat(key.length - key_spoiler_length)}`;
+};
 
 const encryptCredential = (obj) => {
   const {
@@ -110,24 +116,29 @@ router.get('/', async(req, res) => {
     res.status(200).json(creds.map((c) => {
       const {credential, ...obj} = c;
       if ('google' === obj.vendor) {
-        obj.service_key = JSON.parse(decrypt(credential));
+        const o = JSON.parse(decrypt(credential));
+        const obsecured = {
+          client_email: o.client_email,
+          private_key: obscureKey(o.private_key)
+        };
+        obj.service_key = obsecured;
       }
       else if ('aws' === obj.vendor) {
         const o = JSON.parse(decrypt(credential));
         obj.access_key_id = o.access_key_id;
-        obj.secret_access_key = o.secret_access_key;
+        obj.secret_access_key = obscureKey(o.secret_access_key);
         obj.aws_region = o.aws_region;
         logger.info({obj, o}, 'retrieving aws speech credential');
       }
       else if ('microsoft' === obj.vendor) {
         const o = JSON.parse(decrypt(credential));
-        obj.api_key = o.api_key;
+        obj.api_key = obscureKey(o.api_key);
         obj.region = o.region;
         logger.info({obj, o}, 'retrieving azure speech credential');
       }
       else if ('wellsaid' === obj.vendor) {
         const o = JSON.parse(decrypt(credential));
-        obj.api_key = o.api_key;
+        obj.api_key = obscureKey(o.api_key);
       }
       return obj;
     }));
@@ -147,17 +158,22 @@ router.get('/:sid', async(req, res) => {
     if (0 === cred.length) return res.sendStatus(404);
     const {credential, ...obj} = cred[0];
     if ('google' === obj.vendor) {
-      obj.service_key = decrypt(credential);
+      const o = JSON.parse(decrypt(credential));
+      const obsecured = {
+        client_email: o.client_email,
+        private_key: obscureKey(o.private_key)
+      };
+      obj.service_key = JSON.stringify(obsecured);
     }
     else if ('aws' === obj.vendor) {
       const o = JSON.parse(decrypt(credential));
       obj.access_key_id = o.access_key_id;
-      obj.secret_access_key = o.secret_access_key;
+      obj.secret_access_key = obscureKey(o.secret_access_key);
       obj.aws_region = o.aws_region;
     }
     else if ('microsoft' === obj.vendor) {
       const o = JSON.parse(decrypt(credential));
-      obj.api_key = o.api_key;
+      obj.api_key = obscureKey(o.api_key);
       obj.region = o.region;
     }
     res.status(200).json(obj);