| """ |
| Utility: Hashing and security functions. |
| """ |
|
|
| import hashlib |
| import hmac |
| import secrets |
| import string |
| import os |
|
|
| def generate_api_key() -> str: |
| """ |
| Generate a secure random API key. |
| Format: fw_live_<32 random hex chars> |
| """ |
| return f"fw_live_{secrets.token_hex(32)}" |
|
|
|
|
| def hash_api_key(key: str) -> str: |
| """Hash an API key for storage using HMAC-SHA256 (never store raw keys).""" |
| pepper = os.getenv("API_KEY_PEPPER", "change_me_to_a_random_string_in_production") |
| return hmac.new( |
| pepper.encode("utf-8"), |
| key.encode("utf-8"), |
| hashlib.sha256 |
| ).hexdigest() |
|
|
|
|
| def hash_prompt(prompt: str) -> str: |
| """ |
| Hash a prompt for logging. NEVER store raw prompts. |
| Uses SHA-256 for deterministic, irreversible hashing. |
| """ |
| return hashlib.sha256(prompt.encode("utf-8")).hexdigest() |
|
|
| def hash_normalized_prompt(prompt: str) -> str: |
| """ |
| Hash a normalized version of the prompt (lowercase, no punctuation, single spaces) |
| Used for graph replay cache deduplication. |
| """ |
| normalized = prompt.lower().translate(str.maketrans('', '', string.punctuation)) |
| normalized = " ".join(normalized.split()) |
| return hash_prompt(normalized) |
|
|
