From a1ee29a1b843d51f4e714a8bf0253c52fae32e49 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 2 Jul 2026 15:54:57 +0000
Subject: [PATCH] Fix biased random API key generation and improve review
 feedback

---
 lib/generators.js      | 5 +++--
 public/js/dashboard.js | 7 ++++++-
 routes/dashboard.js    | 9 +++++++--
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/lib/generators.js b/lib/generators.js
index 4d69e2d..b542bd7 100644
--- a/lib/generators.js
+++ b/lib/generators.js
@@ -10,11 +10,12 @@ function generatePlaceId() {
 }
 
 // Generates a random alphanumeric+symbol API key of the given length (default 64 characters).
+// Uses crypto.randomInt for unbiased selection of each character (rather than bytes % length,
+// which would skew towards characters at the start of the alphabet).
 function generateApiKey(length = API_KEY_LENGTH) {
-	const bytes = crypto.randomBytes(length);
 	let key = '';
 	for (let i = 0; i < length; i++) {
-		key += API_KEY_CHARS[bytes[i] % API_KEY_CHARS.length];
+		key += API_KEY_CHARS[crypto.randomInt(API_KEY_CHARS.length)];
 	}
 	return key;
 }
diff --git a/public/js/dashboard.js b/public/js/dashboard.js
index efe52d0..201455a 100644
--- a/public/js/dashboard.js
+++ b/public/js/dashboard.js
@@ -241,11 +241,16 @@ document.getElementById('toggle-api-key-btn').addEventListener('click', () => {
 document.getElementById('copy-api-key-btn').addEventListener('click', async () => {
 	const value = document.getElementById('place-api-key-display').value;
 	if (!value) return;
+
+	const btn = document.getElementById('copy-api-key-btn');
+	const originalLabel = btn.textContent;
 	try {
 		await navigator.clipboard.writeText(value);
+		btn.textContent = 'Copied!';
 	} catch (err) {
-		// Clipboard API may be unavailable; fail silently.
+		btn.textContent = 'Copy failed';
 	}
+	setTimeout(() => { btn.textContent = originalLabel; }, 1500);
 });
 
 document.getElementById('regenerate-api-key-btn').addEventListener('click', async () => {
diff --git a/routes/dashboard.js b/routes/dashboard.js
index d0741e6..bb004f5 100644
--- a/routes/dashboard.js
+++ b/routes/dashboard.js
@@ -103,8 +103,13 @@ router.post('/places', (req, res) => {
 		return res.status(403).json({ success: false, message: "Only admins can set a custom place id or API key" });
 	}
 
-	id = canSetCustomValues && id ? String(id).trim() : '';
-	apiKey = canSetCustomValues && apiKey ? String(apiKey).trim() : '';
+	if (!canSetCustomValues) {
+		id = '';
+		apiKey = '';
+	} else {
+		id = id ? String(id).trim() : '';
+		apiKey = apiKey ? String(apiKey).trim() : '';
+	}
 
 	if (!id) id = generatePlaceId();
 	if (!apiKey) apiKey = generateApiKey();