AgentOps-AI / AgentOps-AI/agentops

bug: Client.init() silently succeeds with invalid API key — async auth swallows exceptions

Đang mở
#1,336 1 bình luận 0 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
Python
Star
5.8k
Fork
619
Chỉ số merge pull request
Không có pull request nào được merge trong 30 ngày

Mô tả

## Bug Description

`Client.init(api_key="invalid-key")` silently succeeds instead of raising `InvalidApiKeyException` or `ApiServerException`. The async auth refactor moved authentication into a background daemon thread (`_start_auth_task`), so auth errors are swallowed and never propagated to the caller. Users get no feedback when their API key is wrong — they only discover the problem later when span exports silently fail with 401 errors.

## Reproduction

```bash
git clone --depth=1 https://github.com/AgentOps-AI/agentops.git
cd agentops
uv venv .venv && source .venv/bin/activate
uv pip install -e . pytest pytest-asyncio pytest-mock pytest-recording vcrpy requests-mock openai anthropic "openai-agents[voice]"
pytest tests/integration/test_auth_flow.py::test_auth_flow_invalid_key -v --timeout=60 -p no:depends
```

## Stack Trace

```
FAILED tests/integration/test_auth_flow.py::test_auth_flow_invalid_key - Failed: DID NOT RAISE any of
(, )

tests/integration/test_auth_flow.py:49: Failed
with pytest.raises((InvalidApiKeyException, ApiServerException)) as exc_info:
E Failed: DID NOT RAISE any of (...)
```

## Root Cause

`agentops/client/client.py:118-145` — `_start_auth_task()` runs `_fetch_auth_async(api_key)` in a daemon thread via `asyncio.run()`. When `_fetch_auth_async` raises `ApiServerException`, the exception is caught inside the thread and never propagated back to `init()`.

At line 200, `init()` calls `self._start_auth_task(self.config.api_key)` and immediately proceeds, marking `self._initialized = True` at line 246 regardless of auth outcome.

Compare with the working test `test_auth_flow` which doesn't check for errors — it only verifies the happy path.

## Impact

- Users with invalid/expired API keys get silently initialized clients
- No error feedback at init time — auth failures only surface as 401 export errors later
- Breaks the expected contract that `init()` validates the API key

## Suggested Fix

Make the first auth attempt synchronous in `init()`, then switch to async for token refresh:

```python
# In init(), replace _start_auth_task with synchronous first attempt:
if self.config.api_key:
try:
import asyncio
response = asyncio.run(self._fetch_auth_async(self.config.api_key))
if not response:
raise InvalidApiKeyException("Authentication failed")
except ApiServerException:
raise
```

---
Found by running the test suite. Happy to submit a PR if confirmed.

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.