Function checkAPIKey

server/api_key.go:46–74

Client signature validation key: client's secret key Returns application id, key type.

(apikey string)

//
// Returns application id, key type.
func checkAPIKey(apikey string) (isValid, isRoot bool) {
	if declen := base64.URLEncoding.DecodedLen(len(apikey)); declen != apikeyLength {
		return
	}

	data, err := base64.URLEncoding.DecodeString(apikey)
	if err != nil {
		logs.Warn.Println("failed to decode.base64 appid ", err)
		return
	}
	if data[0] != 1 {
		logs.Warn.Println("unknown appid signature algorithm ", data[0])
		return
	}

	hasher := hmac.New(md5.New, globals.apiKeySalt)
	hasher.Write(data[:apikeyVersion+apikeyAppID+apikeySequence+apikeyWho])
	check := hasher.Sum(nil)
	if !bytes.Equal(data[apikeyVersion+apikeyAppID+apikeySequence+apikeyWho:], check) {
		logs.Warn.Println("invalid apikey signature")
		return
	}

	isRoot = (data[apikeyVersion+apikeyAppID+apikeySequence] == 1)

	isValid = true

	return
}