From a5e32a6d328789d4270480930fab02705acfb4e1 Mon Sep 17 00:00:00 2001
From: diegosouzapw <diegosouzapw@users.noreply.github.com>
Date: Mon, 27 Apr 2026 17:40:04 -0300
Subject: [PATCH] fix(auth): align fallback API key format with test setup

Update the deterministic fallback API key to use hyphens instead of
underscores so generated keys match the expected format.

Also set API_KEY_SECRET in unit tests that exercise API key creation to
ensure consistent resolver behavior under test.
---
 src/shared/services/apiKeyResolver.ts       | 2 +-
 tests/unit/guide-settings-route.test.ts     | 1 +
 tests/unit/qwen-api-key-auto-create.test.ts | 1 +
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/shared/services/apiKeyResolver.ts b/src/shared/services/apiKeyResolver.ts
index 9f14926e61..5896c385c1 100644
--- a/src/shared/services/apiKeyResolver.ts
+++ b/src/shared/services/apiKeyResolver.ts
@@ -39,6 +39,6 @@ export async function getOrCreateApiKey(apiKeyId?: string | null): Promise<strin
     return keyRecord.key as string;
   } catch {
     // Fallback: generate a deterministic key if DB write fails
-    return `sk_${machineId}_fallback_${Date.now()}`;
+    return `sk-${machineId}-fallback-${Date.now()}`;
   }
 }
diff --git a/tests/unit/guide-settings-route.test.ts b/tests/unit/guide-settings-route.test.ts
index b0129287de..28c4debec5 100644
--- a/tests/unit/guide-settings-route.test.ts
+++ b/tests/unit/guide-settings-route.test.ts
@@ -51,6 +51,7 @@ test.beforeEach(async () => {
   // Force XDG_CONFIG_HOME so resolveOpencodeConfigPath resolves to our dummy dir
   // (CI runners often have XDG_CONFIG_HOME set, causing path mismatch)
   process.env.XDG_CONFIG_HOME = path.join(DUMMY_HOME, ".config");
+  process.env.API_KEY_SECRET = "test-secret";
   await fs.mkdir(path.dirname(QWEN_CONFIG_PATH), { recursive: true }).catch(() => {});
 });
 
diff --git a/tests/unit/qwen-api-key-auto-create.test.ts b/tests/unit/qwen-api-key-auto-create.test.ts
index ba6e7ff05a..fa4f8b4816 100644
--- a/tests/unit/qwen-api-key-auto-create.test.ts
+++ b/tests/unit/qwen-api-key-auto-create.test.ts
@@ -26,6 +26,7 @@ const originalHomedir = os.homedir;
 
 test.beforeEach(async () => {
   process.env.DATA_DIR = DUMMY_HOME;
+  process.env.API_KEY_SECRET = "test-secret";
   os.homedir = () => DUMMY_HOME;
   await fs.mkdir(DUMMY_HOME, { recursive: true }).catch(() => {});
   // Initialize DB