fix(api): validate api key prefix

src/langbot/pkg/api/http/service/apikey.py

@@ -52,6 +52,9 @@ class ApiKeyService:
 
     async def verify_api_key(self, key: str) -> bool:
         """Verify if an API key is valid"""
+        if not isinstance(key, str) or not key.startswith('lbk_'):
+            return False
+
         result = await self.ap.persistence_mgr.execute_async(
             sqlalchemy.select(apikey.ApiKey).where(apikey.ApiKey.key == key)
         )

src/langbot/pkg/plugin/connector.py

@@ -35,10 +35,6 @@ from ..core import taskmgr
 from ..entity.persistence import plugin as persistence_plugin
 
 
-class PluginRuntimeNotConnectedError(RuntimeError):
-    """Raised when plugin runtime operations are requested before connection."""
-
-
 class PluginRuntimeConnector:
     """Plugin runtime connector"""
 
@@ -196,7 +192,7 @@ class PluginRuntimeConnector:
 
     async def ping_plugin_runtime(self):
         if not hasattr(self, 'handler'):
-            raise PluginRuntimeNotConnectedError('Plugin runtime is not connected')
+            raise Exception('Plugin runtime is not connected')
 
         return await self.handler.ping()
 

tests/unit_tests/api/test_apikey_service.py

@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, Mock
+
+import pytest
+
+from langbot.pkg.api.http.service.apikey import ApiKeyService
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize('api_key', [None, 123, b'lbk_bytes', '', 'plain_key', ' LBK_bad', 'sk-lbk_fake'])
+async def test_verify_api_key_rejects_non_lbk_keys_without_db_query(api_key):
+    persistence_mgr = SimpleNamespace(execute_async=AsyncMock())
+    service = ApiKeyService(SimpleNamespace(persistence_mgr=persistence_mgr))
+
+    result = await service.verify_api_key(api_key)
+
+    assert result is False
+    persistence_mgr.execute_async.assert_not_awaited()
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    ('db_row', 'expected'),
+    [
+        (object(), True),
+        (None, False),
+    ],
+)
+async def test_verify_api_key_keeps_db_validation_for_lbk_keys(db_row, expected):
+    query_result = Mock()
+    query_result.first.return_value = db_row
+    persistence_mgr = SimpleNamespace(execute_async=AsyncMock(return_value=query_result))
+    service = ApiKeyService(SimpleNamespace(persistence_mgr=persistence_mgr))
+
+    result = await service.verify_api_key('lbk_valid_format')
+
+    assert result is expected
+    persistence_mgr.execute_async.assert_awaited_once()

tests/unit_tests/plugin/test_connector_ping.py

@@ -1,32 +0,0 @@
-from __future__ import annotations
-
-from types import SimpleNamespace
-from unittest.mock import AsyncMock
-
-import pytest
-
-from langbot.pkg.plugin.connector import PluginRuntimeConnector, PluginRuntimeNotConnectedError
-
-
-def make_connector() -> PluginRuntimeConnector:
-    app = SimpleNamespace(instance_config=SimpleNamespace(data={'plugin': {'enable': True}}))
-    return PluginRuntimeConnector(app, AsyncMock())
-
-
-@pytest.mark.asyncio
-async def test_ping_plugin_runtime_raises_specific_error_when_not_connected():
-    connector = make_connector()
-
-    with pytest.raises(PluginRuntimeNotConnectedError, match='Plugin runtime is not connected'):
-        await connector.ping_plugin_runtime()
-
-
-@pytest.mark.asyncio
-async def test_ping_plugin_runtime_delegates_to_connected_handler():
-    connector = make_connector()
-    connector.handler = SimpleNamespace(ping=AsyncMock(return_value='pong'))
-
-    result = await connector.ping_plugin_runtime()
-
-    assert result == 'pong'
-    connector.handler.ping.assert_awaited_once()