Format API keys in hexa instead of base64

meilisearch-auth/Cargo.toml

@@ -4,7 +4,6 @@ version = "0.28.0"
 edition = "2021"
 
 [dependencies]
-base64 = "0.13.0"
 enum-iterator = "0.7.0"
 hmac = "0.12.1"
 meilisearch-types = { path = "../meilisearch-types" }
@@ -15,4 +14,4 @@ serde_json = { version = "1.0.79", features = ["preserve_order"] }
 sha2 = "0.10.2"
 thiserror = "1.0.30"
 time = { version = "0.3.7", features = ["serde-well-known", "formatting", "parsing", "macros"] }
-uuid = { version = "0.8.2", features = ["serde", "v4"] }
+uuid = { version = "1.1.2", features = ["serde", "v4"] }

meilisearch-auth/src/lib.rs

@@ -18,7 +18,7 @@ pub use action::{actions, Action};
 use error::{AuthControllerError, Result};
 pub use key::Key;
 use meilisearch_types::star_or::StarOr;
-use store::generate_key_as_base64;
+use store::generate_key_as_hexa;
 pub use store::open_auth_store_env;
 use store::HeedAuthStore;
 
@@ -139,7 +139,7 @@ impl AuthController {
     pub fn generate_key(&self, uid: Uuid) -> Option<String> {
         self.master_key
             .as_ref()
-            .map(|master_key| generate_key_as_base64(uid.as_bytes(), master_key.as_bytes()))
+            .map(|master_key| generate_key_as_hexa(uid, master_key.as_bytes()))
     }
 
     /// Check if the provided key is authorized to make a specific action

meilisearch-auth/src/store.rs

@@ -13,8 +13,9 @@ use hmac::{Hmac, Mac};
 use meilisearch_types::star_or::StarOr;
 use milli::heed::types::{ByteSlice, DecodeIgnore, SerdeJson};
 use milli::heed::{Database, Env, EnvOpenOptions, RwTxn};
-use sha2::{Digest, Sha256};
+use sha2::Sha256;
 use time::OffsetDateTime;
+use uuid::fmt::Hyphenated;
 use uuid::Uuid;
 
 use super::error::Result;
@@ -132,13 +133,16 @@ impl HeedAuthStore {
             .remap_data_type::<DecodeIgnore>()
             .iter(&rtxn)?
             .filter_map(|res| match res {
-                Ok((uid, _))
-                    if generate_key_as_base64(uid, master_key).as_bytes() == encoded_key =>
-                {
+                Ok((uid, _)) => {
                     let (uid, _) = try_split_array_at(uid)?;
-                    Some(Uuid::from_bytes(*uid))
+                    let uid = Uuid::from_bytes(*uid);
+                    if generate_key_as_hexa(uid, master_key).as_bytes() == encoded_key {
+                        Some(uid)
+                    } else {
+                        None
+                    }
                 }
-                _ => None,
+                Err(_) => None,
             })
             .next();
 
@@ -244,13 +248,17 @@ impl<'a> milli::heed::BytesEncode<'a> for KeyIdActionCodec {
     }
 }
 
-pub fn generate_key_as_base64(uid: &[u8], master_key: &[u8]) -> String {
-    let master_key_sha = Sha256::digest(master_key);
-    let mut mac = Hmac::<Sha256>::new_from_slice(master_key_sha.as_slice()).unwrap();
-    mac.update(uid);
+pub fn generate_key_as_hexa(uid: Uuid, master_key: &[u8]) -> String {
+    // format uid as hyphenated allowing user to generate their own keys.
+    let mut uid_buffer = [0; Hyphenated::LENGTH];
+    let uid = uid.hyphenated().encode_lower(&mut uid_buffer);
+
+    // new_from_slice function never fail.
+    let mut mac = Hmac::<Sha256>::new_from_slice(master_key).unwrap();
+    mac.update(uid.as_bytes());
 
     let result = mac.finalize();
-    base64::encode_config(result.into_bytes(), base64::URL_SAFE_NO_PAD)
+    format!("{:x}", result.into_bytes())
 }
 
 /// Divides one slice into two at an index, returns `None` if mid is out of bounds.