chore(changelog): add entry for API key sharing and flexible authentication in version 0.0.9 #3
Conversation
…cation in version 0.0.9
Reviewer's GuideThis PR implements flexible JWT/API key authentication for chat routes, adds endpoints to share and retrieve agents via API keys, refactors the streaming task processor to handle content-based chunks, and updates the CHANGELOG for version 0.0.9. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey @DavidsonGomes - I've reviewed your changes and found some issues that need to be addressed.
Blocking issues:
-
Avoid logging raw auth_data to prevent leaking credentials (link)
-
The flexible JWT/API key authentication logic is duplicated in both get_agent_by_api_key and websocket_chat—consider extracting it into a shared dependency or helper to reduce duplication and improve maintainability.
-
In _stream_task_process you now skip any chunk without a 'content' key silently; consider adding a debug log or fallback handling for unexpected chunk formats to make debugging easier.
Here's what I looked at during the review
- 🟡 General issues: 4 issues found
- 🔴 Security: 1 blocking issue
- 🟢 Testing: all looks good
- 🟢 Documentation: all looks good
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| api_key: Optional[str] = Header(None, alias="x-api-key"), | ||
| authorization: Optional[str] = Header(None), |
There was a problem hiding this comment.
suggestion (bug_risk): Use explicit alias for the Authorization header
FastAPI’s Header defaults to lowercase 'authorization', but clients send 'Authorization'. Add alias='Authorization' so it's recognized.
| api_key: Optional[str] = Header(None, alias="x-api-key"), | |
| authorization: Optional[str] = Header(None), | |
| api_key: Optional[str] = Header(None, alias="x-api-key"), | |
| authorization: Optional[str] = Header(None, alias="Authorization"), |
| # Verify if the user has access to the agent's client | ||
| await verify_user_client(payload, db, agent.client_id) | ||
| return agent | ||
| except Exception as e: |
There was a problem hiding this comment.
suggestion (bug_risk): Avoid catching generic Exception in JWT flow
Don't catch Exception; it hides HTTPExceptions (e.g., 404). Only catch token-validation errors and re-raise others.
| try: | ||
| auth_data = await websocket.receive_json() | ||
| logger.info(f"Received authentication data: {auth_data}") | ||
| logger.info(f"Authentication data received: {auth_data}") |
There was a problem hiding this comment.
🚨 issue (security): Avoid logging raw auth_data to prevent leaking credentials
auth_data can include tokens or API keys, so cleartext logging may expose secrets. Log only non-sensitive fields (e.g. auth_data['type']).
| ) | ||
| async def chat( | ||
| request: ChatRequest, | ||
| _=Depends(get_agent_by_api_key), |
There was a problem hiding this comment.
suggestion: Capture the authenticated agent instead of discarding it
Rename _ to agent so the handler can use the validated agent directly and skip extra lookups.
| _=Depends(get_agent_by_api_key), | |
| agent=Depends(get_agent_by_api_key), |
| logger.error( | ||
| f"Error processing chunk: {e}, chunk: {chunk_data}" | ||
| ) | ||
| for part in parts: |
There was a problem hiding this comment.
issue: Guard against non-dict parts before calling part.get()
Check isinstance(part, dict) before using part.get(), or enforce that all parts are dicts to avoid errors when parts include raw strings.
|
|
||
|
|
||
| @router.websocket("/ws/{agent_id}/{external_id}") | ||
| async def websocket_chat( |
There was a problem hiding this comment.
issue (code-quality): Low code quality found in websocket_chat - 21% (low-code-quality)
Explanation
The quality score for this function is below the quality threshold of 25%.This score is a combination of the method length, cognitive complexity and working memory.
How can you solve this?
It might be worth refactoring this function to make it shorter and more readable.
- Reduce the function length by extracting pieces of functionality out into
their own functions. This is the most important thing you can do - ideally a
function should be less than 10 lines. - Reduce nesting, perhaps by introducing guard clauses to return early.
- Ensure that variables are tightly scoped, so that code using related concepts
sits together within the function rather than being scattered.
Summary by Sourcery
Add API key sharing endpoints and extend chat routes to support flexible authentication (JWT or API key), refactor streaming chunk processing, and update the changelog
New Features:
Enhancements:
Documentation: