Merge pull request #7 from dv-net/DV-3332

DV-3332: Mask CEX API keys in response from merchant

Author: webster-swift

CHANGELOG.md

@@ -25,6 +25,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Updated email change request to accept string for verification code [DV-3194]
 - Added locale migration for wallets [DV-3210]
 - Sort wallet addresses by blockchain and native token in email notification [DV-3174]
+- Mask response with CEX API keys [DV-3332]
 
 ## [0.6.1] - 2025-08-11
 - Internal/External API withdrawal route now takes a random store ID related to the user for internal requests, and uses the store ID from the XApiKey header for external requests. [DV-2704]

internal/tools/converters/exchange.go

@@ -56,9 +56,18 @@ func NewExchangeKeysResponseFromDto(keys []exchange.KeysExchangeDTO) []exchange_
 }
 
 func NewExchangeKeyResponseByDto(dto exchange.KeysExchangeDTO) exchange_response.ExchangeKey {
+	var maskedValue *string
+	if dto.Value != nil && len(*dto.Value) > 4 {
+		maskedLength := len(*dto.Value) - 4
+		mask := strings.Repeat("*", maskedLength)
+		suffix := (*dto.Value)[len(*dto.Value)-4:]
+		maskedValue = lo.ToPtr(mask + suffix)
+	} else {
+		maskedValue = dto.Value
+	}
 	return exchange_response.ExchangeKey{
 		Name:  dto.Name,
-		Value: dto.Value,
+		Value: maskedValue,
 	}
 }