API key protection

src/isn/Program.cs

@@ -12,7 +12,7 @@ namespace Isn
 
         public static void LoadConfig()
         {
-            FileInfo cfgSettingIf = new FileInfo(_configFileName);
+            FileInfo cfgSettingIf = new FileInfo(ConfigFileName);
             if (cfgSettingIf.Exists)
             {
                 var json = File.ReadAllText(cfgSettingIf.FullName);
@@ -29,12 +29,13 @@ namespace Isn
             { "h|help", "show this message and exit", h => shouldShowPushHelp = h != null },
         };
 
-        private static readonly string _configFileName =
-        Path.Combine(
-        Path.Combine(Environment.GetFolderPath(
-            Environment.SpecialFolder.UserProfile), ".isn"),
-            "config.json")
-            ;
+        private static string ConfigDirectory =>
+            Environment.GetEnvironmentVariable("ISN_CONFIG_DIR")
+            ?? Path.Combine(
+                Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
+                ".isn");
+
+        private static string ConfigFileName => Path.Combine(ConfigDirectory, "config.json");
 
         public const string push = "push";
         static readonly OptionSet options = new OptionSet {

src/isn/commands/set-api-key.cs

@@ -61,7 +61,7 @@ namespace Isn
         }
         public static void SaveConfig()
         {
-            FileInfo cfgSettingIf = new FileInfo(_configFileName);
+            FileInfo cfgSettingIf = new FileInfo(ConfigFileName);
             if (!cfgSettingIf.Directory.Exists) cfgSettingIf.Directory.Create();
             File.WriteAllText(
                 cfgSettingIf.FullName, 

src/isnd/Controllers/Packages/PackagesController.Put.cs

@@ -31,12 +31,12 @@ namespace isnd.Controllers
             try
             {
                 var clientVersionId = Request.Headers["X-NuGet-Client-Version"];
-                string apiKey = Request.Headers["X-NuGet-ApiKey"][0];
+                string apiKey = Request.Headers["X-NuGet-ApiKey"].FirstOrDefault() ?? string.Empty;
                 ViewData["versionId"] = typeof(PackagesController).Assembly.FullName;
                 var files = new List<string>();
                 ViewData["files"] = files;
 
-                var clearkey = protector.Unprotect(apiKey);
+                var clearkey = ApiKeyProtector.UnprotectWithFallback(protector, apiKey);
                 var apikey = dbContext.ApiKeys.SingleOrDefault(k => k.Id == clearkey);
                 if (apikey == null)
                 {

src/isnd/Helpers/ApiKeyProtector.cs

@@ -0,0 +1,50 @@
+using System;
+using System.Security.Cryptography;
+using System.Text;
+using Microsoft.AspNetCore.DataProtection;
+
+namespace isnd.Helpers
+{
+    public static class ApiKeyProtector
+    {
+        private const byte LegacyDelta = 145;
+
+        public static string UnprotectWithFallback(IDataProtector protector, string protectedValue)
+        {
+            if (string.IsNullOrWhiteSpace(protectedValue))
+            {
+                return protectedValue;
+            }
+
+            try
+            {
+                return protector.Unprotect(protectedValue);
+            }
+            catch (CryptographicException)
+            {
+                return UnprotectLegacy(protectedValue);
+            }
+            catch (FormatException)
+            {
+                return UnprotectLegacy(protectedValue);
+            }
+        }
+
+        public static string UnprotectLegacy(string protectedValue)
+        {
+            if (string.IsNullOrWhiteSpace(protectedValue))
+            {
+                return protectedValue;
+            }
+
+            var bytes = Convert.FromBase64String(protectedValue);
+            var unprotectedBytes = new byte[bytes.Length];
+            for (var index = 0; index < bytes.Length; index++)
+            {
+                unprotectedBytes[index] = (byte)(bytes[index] ^ LegacyDelta);
+            }
+
+            return Encoding.UTF8.GetString(unprotectedBytes);
+        }
+    }
+}