From 7e834b89eb0d04057fa84abd82c5b9b8d92e1661 Mon Sep 17 00:00:00 2001
From: swissnode admin <admin@workflowapi.com.br>
Date: Fri, 10 Jul 2026 12:51:52 -0300
Subject: [PATCH] fix: Redis password empty string treated as None

When REDIS_PASSWORD is set to an empty string in docker-compose
(common in community setups without Redis AUTH), os.getenv returns
'' instead of None. redis-py sends AUTH even for empty string,
causing Redis to reject with:
  AUTH <password> called without any password configured for the
  default user. Are you sure your configuration is correct?

Fix in two places:
1. get_redis_config() now normalizes empty/whitespace-only password
   to None before returning the config dict.
2. MCPToolCache.__init__ adds a defensive check that also normalizes
   the password, in case get_redis_config is bypassed in the future.
---
 src/config/redis.py           | 9 ++++++++-
 src/services/adk/mcp_cache.py | 9 ++++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/config/redis.py b/src/config/redis.py
index 2519e57..24eb4ca 100644
--- a/src/config/redis.py
+++ b/src/config/redis.py
@@ -52,11 +52,18 @@ def get_redis_config():
     Returns:
         dict: Redis configuration parameters
     """
+    # Treat empty string as None — Redis server without a password rejects
+    # AUTH when a non-None password is sent (redis-py sends AUTH even for ""),
+    # raising: "AUTH <password> called without any password configured".
+    redis_password = os.getenv("REDIS_PASSWORD", None)
+    if redis_password is not None and redis_password.strip() == "":
+        redis_password = None
+
     return {
         "host": os.getenv("REDIS_HOST", "localhost"),
         "port": int(os.getenv("REDIS_PORT", 6379)),
         "db": int(os.getenv("REDIS_DB", 0)),
-        "password": os.getenv("REDIS_PASSWORD", None),
+        "password": redis_password,
         "ssl": os.getenv("REDIS_SSL", "false").lower() == "true",
         "key_prefix": os.getenv("REDIS_KEY_PREFIX", "a2a:"),
         "default_ttl": int(os.getenv("REDIS_TTL", 3600)),
diff --git a/src/services/adk/mcp_cache.py b/src/services/adk/mcp_cache.py
index 24e0aec..e97391c 100644
--- a/src/services/adk/mcp_cache.py
+++ b/src/services/adk/mcp_cache.py
@@ -69,11 +69,18 @@ def __init__(self):
                 f"Redis configuration: host={redis_config['host']}, port={redis_config['port']}, db={redis_config['db']}"
             )
 
+            # Defensive: ensure empty string password becomes None to avoid
+            # "AUTH called without any password configured" error on Redis servers
+            # that run without AUTH (common in community Docker setups).
+            redis_password = redis_config.get("password")
+            if redis_password is not None and str(redis_password).strip() == "":
+                redis_password = None
+
             self.redis = redis.Redis(
                 host=redis_config["host"],
                 port=redis_config["port"],
                 db=redis_config["db"],
-                password=redis_config["password"],
+                password=redis_password,
                 ssl=redis_config["ssl"],
                 decode_responses=False,  # We need bytes for pickle
             )