From 069a757243b92d7bd0e50b79f8580d99d349d443 Mon Sep 17 00:00:00 2001
From: Chandrapal Badshah <12944530+Chan9390@users.noreply.github.com>
Date: Wed, 23 Apr 2025 15:49:23 +0530
Subject: [PATCH] Fix decryption to show key

---
 api/src/backend/api/models.py         | 13 ++++++++++---
 api/src/backend/api/v1/serializers.py |  1 -
 api/src/backend/api/v1/views.py       | 15 +++++++++++----
 3 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/api/src/backend/api/models.py b/api/src/backend/api/models.py
index edd6aa6fa6..5849133cb7 100644
--- a/api/src/backend/api/models.py
+++ b/api/src/backend/api/models.py
@@ -1,8 +1,8 @@
 import json
 import re
 from uuid import UUID, uuid4
-
-from cryptography.fernet import Fernet
+import logging
+from cryptography.fernet import Fernet, InvalidToken
 from django.conf import settings
 from django.contrib.auth.models import AbstractBaseUser
 from django.contrib.postgres.fields import ArrayField
@@ -49,6 +49,8 @@ fernet = Fernet(settings.SECRETS_ENCRYPTION_KEY.encode())
 # Convert Prowler Severity enum to Django TextChoices
 SeverityChoices = enum_to_choices(Severity)
 
+logger = logging.getLogger(__name__)
+
 
 class StatusChoices(models.TextChoices):
     """
@@ -1349,9 +1351,14 @@ class LighthouseConfig(RowLevelSecurityProtectedModel):
     @property
     def api_key_decoded(self):
         """Return the decrypted API key."""
+        if not self.api_key:
+            return None
+
         try:
-            decrypted_key = fernet.decrypt(self.api_key)
+            api_key_bytes = bytes(self.api_key)
+            decrypted_key = fernet.decrypt(api_key_bytes)
             return decrypted_key.decode()
+
         except InvalidToken:
             logger.warning("Failed to decrypt API key: invalid token.")
             return None
diff --git a/api/src/backend/api/v1/serializers.py b/api/src/backend/api/v1/serializers.py
index 6daa8744b1..4f8b44ccd2 100644
--- a/api/src/backend/api/v1/serializers.py
+++ b/api/src/backend/api/v1/serializers.py
@@ -1281,7 +1281,6 @@ class ProviderSecretCreateSerializer(RLSSerializer, BaseWriteProviderSecretSeria
         return validated_attrs
 
 
-
 class ProviderSecretUpdateSerializer(BaseWriteProviderSecretSerializer):
     secret = ProviderSecretField(write_only=True)
 
diff --git a/api/src/backend/api/v1/views.py b/api/src/backend/api/v1/views.py
index 3c40171996..914fe7f876 100644
--- a/api/src/backend/api/v1/views.py
+++ b/api/src/backend/api/v1/views.py
@@ -2870,6 +2870,12 @@ class LighthouseConfigViewSet(BaseRLSViewSet):
         """
         instance = self.get_object()
 
+        if not instance.api_key:
+            return Response(
+                {"detail": "API key is missing."},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
         try:
             decrypted_key = instance.api_key_decoded
             if decrypted_key is None:
@@ -2877,15 +2883,16 @@ class LighthouseConfigViewSet(BaseRLSViewSet):
                     {"detail": "API key is invalid or missing."},
                     status=status.HTTP_400_BAD_REQUEST,
                 )
-
             return Response(
                 {"api_key": decrypted_key},
                 status=status.HTTP_200_OK,
             )
-        except Exception:
+        except Exception as e:
             return Response(
-                {"detail": "API key is invalid or missing."},
-                status=status.HTTP_400_BAD_REQUEST,
+                {
+                    "detail": f"An unexpected error occurred while retrieving the API key. {str(e)}"
+                },
+                status=status.HTTP_500_INTERNAL_SERVER_ERROR,
             )
 
     def destroy(self, request, *args, **kwargs):