From 867662b05a1220431c6f731e655dd2641b1f5685 Mon Sep 17 00:00:00 2001 From: Roomote Date: Sun, 23 Aug 2026 03:21:32 +0000 Subject: [PATCH 1/3] fix: suppress provider fingerprint CodeQL false positive --- .../db/src/lib/provider-credential-fingerprint.ts | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/packages/db/src/lib/provider-credential-fingerprint.ts b/packages/db/src/lib/provider-credential-fingerprint.ts index fc37b09a0..7e2fc00c3 100644 --- a/packages/db/src/lib/provider-credential-fingerprint.ts +++ b/packages/db/src/lib/provider-credential-fingerprint.ts @@ -2,9 +2,16 @@ import { createHmac } from 'node:crypto'; import { getEncryptionKey } from '@roomote/env'; +/** + * Returns a stable, non-secret identifier for grouping provider credentials. + * This is not a password hash and must remain deterministic for lookups. + */ export function fingerprintProviderCredential(apiKey: string): string { - return createHmac('sha256', getEncryptionKey()) - .update(apiKey) - .digest('hex') - .slice(0, 12); + return ( + createHmac('sha256', getEncryptionKey()) + // codeql[js/insufficient-password-hash] -- This keyed HMAC is an identifier, not a password verifier. + .update(apiKey) + .digest('hex') + .slice(0, 12) + ); } From d0e99d341f7188ffe216ab6e44ff2348975e76ce Mon Sep 17 00:00:00 2001 From: Roomote Date: Sun, 23 Aug 2026 03:29:52 +0000 Subject: [PATCH 2/3] fix: anchor CodeQL suppression to alert line --- .../db/src/lib/provider-credential-fingerprint.ts | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/packages/db/src/lib/provider-credential-fingerprint.ts b/packages/db/src/lib/provider-credential-fingerprint.ts index 7e2fc00c3..e6184a142 100644 --- a/packages/db/src/lib/provider-credential-fingerprint.ts +++ b/packages/db/src/lib/provider-credential-fingerprint.ts @@ -7,11 +7,8 @@ import { getEncryptionKey } from '@roomote/env'; * This is not a password hash and must remain deterministic for lookups. */ export function fingerprintProviderCredential(apiKey: string): string { - return ( - createHmac('sha256', getEncryptionKey()) - // codeql[js/insufficient-password-hash] -- This keyed HMAC is an identifier, not a password verifier. - .update(apiKey) - .digest('hex') - .slice(0, 12) - ); + return createHmac('sha256', getEncryptionKey()) + .update(apiKey) // codeql[js/insufficient-password-hash] -- This keyed HMAC is an identifier, not a password verifier. + .digest('hex') + .slice(0, 12); } From f46685d4e71b58a836a8d9c9574ca97e00311c69 Mon Sep 17 00:00:00 2001 From: Roomote Date: Sun, 23 Aug 2026 03:39:48 +0000 Subject: [PATCH 3/3] docs: clarify provider fingerprint security semantics --- packages/db/src/lib/provider-credential-fingerprint.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/db/src/lib/provider-credential-fingerprint.ts b/packages/db/src/lib/provider-credential-fingerprint.ts index e6184a142..a139abc64 100644 --- a/packages/db/src/lib/provider-credential-fingerprint.ts +++ b/packages/db/src/lib/provider-credential-fingerprint.ts @@ -3,12 +3,12 @@ import { createHmac } from 'node:crypto'; import { getEncryptionKey } from '@roomote/env'; /** - * Returns a stable, non-secret identifier for grouping provider credentials. - * This is not a password hash and must remain deterministic for lookups. + * Returns a stable, non-secret grouping identifier using a deployment-keyed HMAC. + * It is not used for authentication or password storage, so password-KDF semantics do not apply. */ export function fingerprintProviderCredential(apiKey: string): string { return createHmac('sha256', getEncryptionKey()) - .update(apiKey) // codeql[js/insufficient-password-hash] -- This keyed HMAC is an identifier, not a password verifier. + .update(apiKey) .digest('hex') .slice(0, 12); }