security: force key masking

internal/handler/keys.go

@@ -85,15 +85,29 @@ func HandleGenKey(w http.ResponseWriter, r *http.Request) {
 	json.NewEncoder(w).Encode(map[string]string{"key": key, "name": name})
 }
 func HandleStats(w http.ResponseWriter, r *http.Request) {
-	store.mu.Lock()
-	defer store.mu.Unlock()
-	
+store.mu.Lock()
+defer store.mu.Unlock()
+w.Header().Set("Content-Type", "application/json")
+
 type KeyPublic struct {
 Name     string `json:"name"`
 Key      string `json:"key"`
 Requests int    `json:"requests"`
 Tokens   int    `json:"tokens"`
 }
+
+publicKeys := make(map[string]KeyPublic)
+for k, v := range store.Keys {
+masked := k[:8] + "..."
+publicKeys[masked] = KeyPublic{
+Name:     v.Name,
+Key:      masked,
+Requests: v.Requests,
+Tokens:   v.Tokens,
+}
+}
+json.NewEncoder(w).Encode(map[string]interface{}{"keys": publicKeys})
+}
 publicKeys := make(map[string]KeyPublic)
 for k, v := range store.Keys {
 // Mostramos solo el prefijo y los primeros 3 caracteres de la key