security: complete destruction of keys in public stats

internal/handler/keys.go

@@ -67,10 +67,32 @@ func HandleGenKey(w http.ResponseWriter, r *http.Request) {
     key := GenerateKey(name)
     json.NewEncoder(w).Encode(map[string]string{"key": key, "name": name})
 }
+
 func HandleStats(w http.ResponseWriter, r *http.Request) {
-    store.mu.Lock()
-    defer store.mu.Unlock()
-    type Pub struct { Name string `json:"name"`; Key string `json:"key"`; Requests int `json:"requests"`; Tokens int `json:"tokens"` }
+store.mu.Lock()
+defer store.mu.Unlock()
+w.Header().Set("Content-Type", "application/json")
+
+type Pub struct { 
+Name     string `json:"name"`
+Requests int    `json:"requests"`
+Tokens   int    `json:"tokens"`
+}
+
+res := make(map[string]Pub)
+i := 0
+for _, v := range store.Keys {
+// Usamos un ID genérico para el JSON para que no rastreen nada
+id := fmt.Sprintf("user_%d", i)
+res[id] = Pub{
+Name:     v.Name,
+Requests: v.Requests,
+Tokens:   v.Tokens,
+}
+i++
+}
+json.NewEncoder(w).Encode(map[string]interface{}{"keys": res})
+}
     res := make(map[string]Pub)
     for k, v := range store.Keys { masked := k[:8] + "..."; res[masked] = Pub{Name: v.Name, Key: masked, Requests: v.Requests, Tokens: v.Tokens} }
     json.NewEncoder(w).Encode(map[string]interface{}{"keys": res})