Simplify MAAS key storage to SHA-256 hash only

Remove redundant dual key storage (Django's make_password + SHA-256).
The 'key' field now stores only the SHA-256 hash used for lookups,
eliminating the separate 'key_hash' field and the check_password step.

Author: guilbaults

maas/admin.py

@@ -1,6 +1,5 @@
 from django import forms
 from django.contrib import admin
-from django.contrib.auth.hashers import make_password
 from django.utils.translation import gettext_lazy as _
 
 from maas.models import MAASProvider, MAASApiKey, MAASUsageRecord, sha256_key
@@ -16,13 +15,13 @@ class MAASProviderAdminForm(forms.ModelForm):
                 'placeholder': _('Enter a key or click Generate'),
             }
         ),
-        help_text=_('Enter a clear-text key, or click Generate. It will be hashed and stored securely. Leave blank when editing to keep the existing key.'),
+        help_text=_('Enter a clear-text key, or click Generate. It will be hashed (SHA-256) and stored. Leave blank when editing to keep the existing key.'),
     )
 
     class Meta:
         model = MAASProvider
         fields = '__all__'
-        exclude = ('key', 'key_hash')
+        exclude = ('key',)
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -32,8 +31,7 @@ def save(self, commit=True):
         instance = super().save(commit=False)
         raw_key = self.cleaned_data.get('clear_text_key', '').strip()
         if raw_key:
-            instance.key = make_password(raw_key)
-            instance.key_hash = sha256_key(raw_key)
+            instance.key = sha256_key(raw_key)
         if commit:
             instance.save()
         return instance
@@ -49,13 +47,13 @@ class MAASApiKeyAdminForm(forms.ModelForm):
                 'placeholder': _('Enter a key or click Generate'),
             }
         ),
-        help_text=_('Enter a clear-text key, or click Generate. It will be hashed and stored securely. Leave blank when editing to keep the existing key.'),
+        help_text=_('Enter a clear-text key, or click Generate. It will be hashed (SHA-256) and stored. Leave blank when editing to keep the existing key.'),
     )
 
     class Meta:
         model = MAASApiKey
         fields = '__all__'
-        exclude = ('key', 'key_hash')
+        exclude = ('key',)
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -65,8 +63,7 @@ def save(self, commit=True):
         instance = super().save(commit=False)
         raw_key = self.cleaned_data.get('clear_text_key', '').strip()
         if raw_key:
-            instance.key = make_password(raw_key)
-            instance.key_hash = sha256_key(raw_key)
+            instance.key = sha256_key(raw_key)
         if commit:
             instance.save()
         return instance
@@ -78,7 +75,7 @@ class MAASProviderAdmin(admin.ModelAdmin):
     list_display = ('name', 'url', 'is_active', 'created_at', 'updated_at')
     list_filter = ('is_active',)
     search_fields = ('name',)
-    readonly_fields = ('created_at', 'updated_at', 'key_hash')
+    readonly_fields = ('created_at', 'updated_at', 'key')
 
     change_form_template = 'admin/maas/change_form.html'
 
@@ -89,7 +86,7 @@ class MAASApiKeyAdmin(admin.ModelAdmin):
     list_display = ('user', 'name', 'is_active', 'is_expired', 'created_at', 'expires_at', 'last_used_at')
     list_filter = ('is_active',)
     search_fields = ('user__username', 'name')
-    readonly_fields = ('created_at', 'last_used_at', 'key_hash')
+    readonly_fields = ('created_at', 'last_used_at', 'key')
 
     change_form_template = 'admin/maas/change_form.html'
 

maas/migrations/0001_initial.py

@@ -1,5 +1,3 @@
-# Generated migration for maas module
-
 from django.conf import settings
 from django.db import migrations, models
 import django.db.models.deletion
@@ -20,8 +18,7 @@ class Migration(migrations.Migration):
                 ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
                 ('name', models.CharField(max_length=255, unique=True, verbose_name='name')),
                 ('url', models.URLField(max_length=500, verbose_name='base URL')),
-                ('key', models.CharField(max_length=255, verbose_name='API key (hashed)')),
-                ('key_hash', models.CharField(db_index=True, max_length=64, verbose_name='key hash (lookup)')),
+                ('key', models.CharField(db_index=True, max_length=64, verbose_name='key hash (lookup)')),
                 ('is_active', models.BooleanField(default=True, verbose_name='active')),
                 ('created_at', models.DateTimeField(auto_now_add=True, verbose_name='created')),
                 ('updated_at', models.DateTimeField(auto_now=True, verbose_name='updated')),
@@ -37,8 +34,7 @@ class Migration(migrations.Migration):
             fields=[
                 ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
                 ('name', models.CharField(max_length=255, verbose_name='name')),
-                ('key', models.CharField(max_length=255, verbose_name='API key (hashed)')),
-                ('key_hash', models.CharField(db_index=True, max_length=64, verbose_name='key hash (lookup)')),
+                ('key', models.CharField(db_index=True, max_length=64, verbose_name='key hash (lookup)')),
                 ('created_at', models.DateTimeField(auto_now_add=True, verbose_name='created')),
                 ('expires_at', models.DateTimeField(blank=True, null=True, verbose_name='expires')),
                 ('is_active', models.BooleanField(default=True, verbose_name='active')),

maas/models.py

@@ -11,8 +11,7 @@ def sha256_key(raw_key):
 class MAASProvider(models.Model):
     name = models.CharField(_('name'), max_length=255, unique=True)
     url = models.URLField(_('base URL'), max_length=500)
-    key = models.CharField(_('API key (hashed)'), max_length=255)
-    key_hash = models.CharField(_('key hash (lookup)'), max_length=64, db_index=True)
+    key = models.CharField(_('key hash (lookup)'), max_length=64, db_index=True)
     is_active = models.BooleanField(_('active'), default=True)
     created_at = models.DateTimeField(_('created'), auto_now_add=True)
     updated_at = models.DateTimeField(_('updated'), auto_now=True)
@@ -29,8 +28,7 @@ def __str__(self):
 class MAASApiKey(models.Model):
     user = models.ForeignKey(User, on_delete=models.CASCADE, related_name='maas_keys', verbose_name=_('user'))
     name = models.CharField(_('name'), max_length=255)
-    key = models.CharField(_('API key (hashed)'), max_length=255)
-    key_hash = models.CharField(_('key hash (lookup)'), max_length=64, db_index=True)
+    key = models.CharField(_('key hash (lookup)'), max_length=64, db_index=True)
     created_at = models.DateTimeField(_('created'), auto_now_add=True)
     expires_at = models.DateTimeField(_('expires'), null=True, blank=True)
     is_active = models.BooleanField(_('active'), default=True)

maas/tests.py

@@ -1,5 +1,4 @@
 from datetime import datetime, timedelta
-from django.contrib.auth.hashers import make_password
 from tests.tests import CustomTestCase
 from maas.models import MAASProvider, MAASApiKey, MAASUsageRecord, sha256_key
 
@@ -9,17 +8,15 @@ def _create_provider(self, name='Test Provider', url='https://test.example.com',
         return MAASProvider.objects.create(
             name=name,
             url=url,
-            key=make_password(key),
-            key_hash=sha256_key(key),
+            key=sha256_key(key),
             is_active=True,
         )
 
     def _create_api_key(self, user, name='Test Key', key='test-user-key', expires_at=None):
         return MAASApiKey.objects.create(
             user=user,
             name=name,
-            key=make_password(key),
-            key_hash=sha256_key(key),
+            key=sha256_key(key),
             expires_at=expires_at,
             is_active=True,
         )
@@ -290,6 +287,25 @@ def test_public_revoke_no_header(self):
         self.assertEqual(response.status_code, 200)
 
 
+def _create_provider(name='Test Provider', url='https://test.example.com', key='test-provider-key'):
+    return MAASProvider.objects.create(
+        name=name,
+        url=url,
+        key=sha256_key(key),
+        is_active=True,
+    )
+
+
+def _create_api_key(user, name='Test Key', key='test-user-key', expires_at=None):
+    return MAASApiKey.objects.create(
+        user=user,
+        name=name,
+        key=sha256_key(key),
+        expires_at=expires_at,
+        is_active=True,
+    )
+
+
 class MaasAdminTestCase(CustomTestCase):
     def test_admin_provider_key_hashed_on_create(self):
         response = self.admin_client.post('/admin/maas/maasprovider/add/', {
@@ -301,7 +317,7 @@ def test_admin_provider_key_hashed_on_create(self):
         self.assertRedirects(response, '/admin/maas/maasprovider/')
         provider = MAASProvider.objects.get(name='Test Provider')
         self.assertNotEqual(provider.key, 'my-secret-key')
-        self.assertEqual(provider.key_hash, sha256_key('my-secret-key'))
+        self.assertEqual(provider.key, sha256_key('my-secret-key'))
 
     def test_admin_provider_key_not_plaintext(self):
         self.admin_client.post('/admin/maas/maasprovider/add/', {
@@ -311,11 +327,11 @@ def test_admin_provider_key_not_plaintext(self):
             'is_active': True,
         })
         provider = MAASProvider.objects.get(name='Secret Provider')
-        self.assertTrue(provider.key.startswith('pbkdf2_') or provider.key.startswith('argon2') or provider.key.startswith('bcrypt'))
+        self.assertEqual(provider.key, sha256_key('super-secret-value'))
 
     def test_admin_provider_edit_blank_key_preserves_existing(self):
-        provider = self._create_provider(key='original-key')
-        original_key_hash = provider.key_hash
+        provider = _create_provider(key='original-key')
+        original_key = provider.key
         response = self.admin_client.post(f'/admin/maas/maasprovider/{provider.id}/change/', {
             'name': 'Updated Provider',
             'url': 'https://updated.example.com',
@@ -325,18 +341,18 @@ def test_admin_provider_edit_blank_key_preserves_existing(self):
         self.assertRedirects(response, '/admin/maas/maasprovider/')
         provider.refresh_from_db()
         self.assertEqual(provider.name, 'Updated Provider')
-        self.assertEqual(provider.key_hash, original_key_hash)
+        self.assertEqual(provider.key, original_key)
 
     def test_admin_provider_edit_new_key_overwrites(self):
-        provider = self._create_provider(key='original-key')
+        provider = _create_provider(key='original-key')
         self.admin_client.post(f'/admin/maas/maasprovider/{provider.id}/change/', {
             'name': 'Updated Provider',
             'url': 'https://updated.example.com',
             'clear_text_key': 'new-secret-key',
             'is_active': True,
         })
         provider.refresh_from_db()
-        self.assertEqual(provider.key_hash, sha256_key('new-secret-key'))
+        self.assertEqual(provider.key, sha256_key('new-secret-key'))
 
     def test_admin_api_key_hashed_on_create(self):
         response = self.admin_client.post('/admin/maas/maasapikey/add/', {
@@ -352,7 +368,7 @@ def test_admin_api_key_hashed_on_create(self):
         self.assertRedirects(response, '/admin/maas/maasapikey/')
         api_key = MAASApiKey.objects.get(name='Admin Created Key')
         self.assertNotEqual(api_key.key, 'admin-api-secret')
-        self.assertEqual(api_key.key_hash, sha256_key('admin-api-secret'))
+        self.assertEqual(api_key.key, sha256_key('admin-api-secret'))
 
     def test_admin_api_key_not_plaintext(self):
         self.admin_client.post('/admin/maas/maasapikey/add/', {
@@ -366,11 +382,11 @@ def test_admin_api_key_not_plaintext(self):
             'last_used_at_1': '',
         })
         api_key = MAASApiKey.objects.get(name='Secret API Key')
-        self.assertTrue(api_key.key.startswith('pbkdf2_') or api_key.key.startswith('argon2') or api_key.key.startswith('bcrypt'))
+        self.assertEqual(api_key.key, sha256_key('secret-api-value'))
 
     def test_admin_api_key_edit_blank_preserves_existing(self):
-        api_key = self._create_api_key(self.testuser, key='original-api-key')
-        original_hash = api_key.key_hash
+        api_key = _create_api_key(self.testuser, key='original-api-key')
+        original_hash = api_key.key
         self.admin_client.post(f'/admin/maas/maasapikey/{api_key.id}/change/', {
             'user': self.testuser.pk,
             'name': 'Updated API Key',
@@ -383,4 +399,4 @@ def test_admin_api_key_edit_blank_preserves_existing(self):
         })
         api_key.refresh_from_db()
         self.assertEqual(api_key.name, 'Updated API Key')
-        self.assertEqual(api_key.key_hash, original_hash)
+        self.assertEqual(api_key.key, original_hash)

maas/views.py

@@ -9,7 +9,6 @@
 from django.http import HttpResponseForbidden, HttpResponseNotFound, JsonResponse
 from django.contrib.auth.decorators import login_required
 from django.contrib.admin.views.decorators import staff_member_required
-from django.contrib.auth.hashers import make_password, check_password
 from django.utils import timezone
 from django.utils.translation import gettext as _
 from django.views.decorators.http import require_POST
@@ -60,13 +59,10 @@ def authenticate(self, request):
 
         key_hash = sha256_key(raw_key)
         try:
-            candidate = MAASApiKey.objects.get(is_active=True, key_hash=key_hash)
+            candidate = MAASApiKey.objects.get(is_active=True, key=key_hash)
         except MAASApiKey.DoesNotExist:
             raise AuthenticationFailed(_('Invalid API key'))
 
-        if not check_password(raw_key, candidate.key):
-            raise AuthenticationFailed(_('Invalid API key'))
-
         if candidate.is_expired:
             raise AuthenticationFailed(_('API key has expired'))
 
@@ -82,12 +78,9 @@ def lookup_provider(provider_key):
     """Find an active provider by its plaintext API key."""
     key_hash = sha256_key(provider_key)
     try:
-        candidate = MAASProvider.objects.get(is_active=True, key_hash=key_hash)
+        return MAASProvider.objects.get(is_active=True, key=key_hash)
     except MAASProvider.DoesNotExist:
         return None
-    if not check_password(provider_key, candidate.key):
-        return None
-    return candidate
 
 
 # --- API Endpoints ---
@@ -198,10 +191,9 @@ def post(self, request):
             if raw_key:
                 key_hash = sha256_key(raw_key)
                 try:
-                    candidate = MAASApiKey.objects.get(is_active=True, key_hash=key_hash)
-                    if check_password(raw_key, candidate.key):
-                        candidate.is_active = False
-                        candidate.save(update_fields=['is_active'])
+                    candidate = MAASApiKey.objects.get(is_active=True, key=key_hash)
+                    candidate.is_active = False
+                    candidate.save(update_fields=['is_active'])
                 except MAASApiKey.DoesNotExist:
                     pass
         return Response({}, status=status.HTTP_200_OK)
@@ -304,7 +296,6 @@ def key_new(request, username):
             })
 
         raw_key = secrets.token_urlsafe(48)
-        hashed_key = make_password(raw_key)
         key_hash = sha256_key(raw_key)
 
         expires_at = None
@@ -315,8 +306,7 @@ def key_new(request, username):
         api_key = MAASApiKey.objects.create(
             user=target_user,
             name=name,
-            key=hashed_key,
-            key_hash=key_hash,
+            key=key_hash,
             expires_at=expires_at,
         )
 
@@ -370,12 +360,10 @@ def provider_new(request):
                 'error': _('All fields are required'),
             })
 
-        hashed_key = make_password(raw_key)
         provider = MAASProvider.objects.create(
             name=name,
             url=url,
-            key=hashed_key,
-            key_hash=sha256_key(raw_key),
+            key=sha256_key(raw_key),
         )
 
         return render(request, 'maas/provider_new.html', {