fix: cover API auth guard regressions

Maintainer edit: restore CI by updating serve/onboard tests, add auth/config coverage, and keep auth failures on the OpenAI-compatible error shape.
2026-07-01 13:09:49 +08:00
parent 56443ac6e2
commit ed48325346
6 changed files with 75 additions and 9 deletions
@@ -421,14 +421,9 @@ def create_app(
            return await handler(request)
        auth = request.headers.get("Authorization", "")
        if not auth.startswith("Bearer "):
-            return web.json_response(
-                {"error": "Missing Authorization header. Use: Bearer <api_key>"},
-                status=401,
-            )
+            return _error_json(401, "Missing Authorization header. Use: Bearer <api_key>")
        if not hmac.compare_digest(auth[len("Bearer "):], api_key):
-            return web.json_response(
-                {"error": "Invalid API key"}, status=401,
-            )
+            return _error_json(401, "Invalid API key")
        return await handler(request)

    app.middlewares.append(auth_middleware)