fix: truncate the api key when logging

packages/config/src/__tests__/api.test.ts

@@ -0,0 +1,20 @@
+import { truncateApiKey } from '../api.truncate.js';
+import o from 'ospec';
+
+o.spec('ApiKeyTruncate', () => {
+  o('should truncate apikeys', () => {
+    o(truncateApiKey('c01h3e17kjsw5evq8ndjxbda80e')).equals('cbda80e');
+    o(truncateApiKey('d01h3e17kjsw5evq8ndjxbda80e')).equals('dbda80e');
+  });
+
+  o('should not truncate invalid api keys', () => {
+    o(truncateApiKey([{ hello: 'world' }])).deepEquals('invalid');
+    o(truncateApiKey(null)).equals('invalid');
+    o(truncateApiKey(1)).equals('invalid');
+  });
+
+  o('should not truncate truncated', () => {
+    o(truncateApiKey('cbda80e')).equals('cbda80e');
+    o(truncateApiKey('dbda80e')).equals('dbda80e');
+  });
+});

packages/config/src/api.truncate.ts

@@ -0,0 +1,7 @@
+/** Truncate a API key to the last 6 digits */
+export function truncateApiKey(x: unknown): string | undefined {
+  if (typeof x !== 'string') return 'invalid';
+  if (x.startsWith('c')) return 'c' + x.slice(x.length - 6);
+  if (x.startsWith('d')) return 'd' + x.slice(x.length - 6);
+  return 'invalid';
+}

packages/config/src/index.ts

@@ -28,3 +28,4 @@ export { ConfigJson, zoomLevelsFromWmts } from './json/json.config.js';
 export { standardizeLayerName } from './json/name.convertor.js';
 export { base58, isBase58 } from './base58.js';
 export { sha256base58, ensureBase58 } from './base58.node.js';
+export { truncateApiKey } from './api.truncate.js';

packages/lambda-tiler/src/util/validate.ts

@@ -3,6 +3,7 @@ import { Const, isValidApiKey } from '@basemaps/shared';
 import { getImageFormat } from '@basemaps/tiler';
 import { LambdaHttpRequest, LambdaHttpResponse } from '@linzjs/lambda';
 import { TileXyzGet } from '../routes/tile.xyz';
+import { truncateApiKey } from '@basemaps/config';
 
 export interface TileXyz {
   tile: { x: number; y: number; z: number };
@@ -25,7 +26,8 @@ export const Validate = {
     const valid = isValidApiKey(apiKey);
 
     if (!valid.valid) throw new LambdaHttpResponse(400, 'API Key Invalid: ' + valid.message);
-    req.set('api', apiKey);
+    // Truncate the API Key so we are not logging the full key
+    req.set('api', truncateApiKey(apiKey));
     return apiKey as string;
   },