fix(security): remove salt from database (#5412)

packages/api/src/router/apiKeys.ts

@@ -1,6 +1,6 @@
 import { z } from "zod/v4";
 
-import { createSaltAsync, hashPasswordAsync } from "@homarr/auth";
+import { hashPasswordAsync } from "@homarr/auth";
 import { createId } from "@homarr/common";
 import { generateSecureRandomToken } from "@homarr/common/server";
 import { db, eq } from "@homarr/db";
@@ -14,7 +14,6 @@ export const apiKeysRouter = createTRPCRouter({
       columns: {
         id: true,
         apiKey: false,
-        salt: false,
       },
       with: {
         user: {
@@ -29,14 +28,12 @@ export const apiKeysRouter = createTRPCRouter({
     });
   }),
   create: permissionRequiredProcedure.requiresPermission("admin").mutation(async ({ ctx }) => {
-    const salt = await createSaltAsync();
     const randomToken = generateSecureRandomToken(64);
-    const hashedRandomToken = await hashPasswordAsync(randomToken, salt);
+    const hashedRandomToken = await hashPasswordAsync(randomToken);
     const id = createId();
     await db.insert(apiKeys).values({
       id,
       apiKey: hashedRandomToken,
-      salt,
       userId: ctx.session.user.id,
     });
     return {