Improve error handling for API key validation (fixes #357)

[DecentMakeover]

Summary

This PR enhances error handling for API key validation in api_key_service.py, ensuring clear, specific, and secure error responses across validation scenarios. It also simplifies router logic and adds comprehensive test coverage.

Changes Made

1. Enhanced Error Handling (app/modules/auth/api_key_service.py:104–166)

• Invalid format → Returns HTTP 401 when API key doesn’t start with sk-
• Not found → Returns HTTP 401 if API key hash isn’t found in DB
• Internal errors → Returns HTTP 500 with detailed logs for DB/internal issues
• Logging added → All failure scenarios logged for easier debugging
• Docstring updated → Improved documentation of return values and exceptions

2. Simplified Router Logic (app/api/router.py:69–74)

• Removed redundant error handling since validate_api_key() now raises HTTPException directly
• Centralized and cleaner error flow

3. Comprehensive Test Coverage (app/modules/auth/tests/api_key_service_test.py)

Added 25 unit tests covering:

• API key generation: format, uniqueness, length
• Hashing: consistency, hex format
• Validation scenarios:
  • ✅ Successful validation
  • ❌ Invalid/missing prefix
  • ❌ Empty strings
  • ❌ API key not found in DB
  • ❌ Wrong prefix
  • ❌ Database errors
  • ❌ Special characters, unicode, whitespace
  • ❌ SQL injection attempts
  • ❌ Null bytes
  • ❌ Very long keys
• API key creation: new vs existing users
• API key revocation: success and edge cases

All tests pass successfully (25/25).

Test Results## Security Improvements

• Proper handling of SQL injection attempts
• Safe processing of malformed input (unicode, null bytes, special chars)
• Consistent error messages without leaking sensitive info
• Appropriate HTTP codes (401 for auth failures, 500 for server errors)

Fixes

Closes #357

Summary by CodeRabbit

• Bug Fixes

  • Enhanced API key validation with improved error handling and clearer error messages for invalid, missing, or malformed keys.

• Tests

  • Added comprehensive test coverage for API key management, including generation, validation, creation, and revocation scenarios.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

📥 Commits

Reviewing files that changed from the base of the PR and between 5e3aca3 and 575078e.

📒 Files selected for processing (3)

• app/api/router.py (1 hunks)
• app/modules/auth/api_key_service.py (2 hunks)
• app/modules/auth/tests/api_key_service_test.py (1 hunks)

 ________________________________________________________________
< CodeHamster is my sidekick. She powers the GPU with her wheel. >
 ----------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

Tip

You can get early access to new features in CodeRabbit.

Enable the early_access setting in your project's settings in CodeRabbit to enable early access features such as new models, tools, and more.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud