Merge pull request #13 from Ifechukwu001/fix/auth

Refactored auth algorithm

Author: Ifechukwu001

src/api/middlewares/GateWayMiddleware.py

@@ -16,7 +16,6 @@ def __init__(self, logger: Logger) -> None:
 
     def authenticate(self, request: HttpRequest, key: str | None) -> str | None:
         try:
-            api_key = request.headers["X-API-GATEWAY-KEY"]
             api_timestamp = request.headers["X-API-GATEWAY-TIMESTAMP"]
             api_signature = request.headers["X-API-GATEWAY-SIGNATURE"]
         except KeyError as e:
@@ -30,22 +29,10 @@ def authenticate(self, request: HttpRequest, key: str | None) -> str | None:
             )
             raise AuthenticationError(message=message)
 
-        valid_api_key = api_gateway["key"]
-        if api_key != valid_api_key:
-            message = "Invalid API key!"
-            self.logger.error(
-                {
-                    "activity_type": "Authenticate Gateway Request",
-                    "message": message,
-                    "metadata": {"headers": request.headers},
-                }
-            )
-            raise AuthenticationError(message=message)
-
         signature_data: SignatureData = {
             "signature": api_signature,
             "timestamp": api_timestamp,
-            "key": valid_api_key,
+            "key": api_gateway["key"],
             "ttl": api_gateway["ttl"],
             "title": SIGNATURE_SOURCES["gateway"],
         }

src/api/routes/__init__.py

@@ -20,11 +20,6 @@ def custom_openapi_schema(path_params: dict | None = None) -> OpenAPISchema:
     schema = original_get_openapi_schema()
 
     schema["components"]["securitySchemes"] = {
-        "Gateway Key": {
-            "type": "apiKey",
-            "in": "header",
-            "name": "X-API-GATEWAY-KEY",
-        },
         "API Timestamp": {
             "type": "apiKey",
             "in": "header",
@@ -39,7 +34,6 @@ def custom_openapi_schema(path_params: dict | None = None) -> OpenAPISchema:
 
     schema["security"] = [
         {
-            "Gateway Key": [],
             "API Timestamp": [],
             "API Signature": [],
         }

src/api/services/UtilityService.py

@@ -1,6 +1,7 @@
 import hmac
 import hashlib
 from uuid import uuid4
+from base64 import b64encode
 from typing import TypedDict
 from datetime import UTC, datetime, timedelta
 
@@ -111,9 +112,12 @@ def generate_uuid() -> ExpireUUID:
 
     @staticmethod
     def generate_signature(key: str, timestamp: str) -> str:
-        signature = hmac.new(
-            key=key.encode(), msg=timestamp.encode(), digestmod=hashlib.sha256
-        ).hexdigest()
+        digest = hmac.new(
+            key=key.encode(),
+            msg=f"{key}:{timestamp}".encode(),
+            digestmod=hashlib.sha256,
+        ).digest()
+        signature = b64encode(digest).decode()
         return signature
 
     @staticmethod