{"record":{"id":"c72a628b4b60d8f8","repo":"iflytek/astron-agent","slug":"api-key-must-not-been-empty","errorCode":null,"errorMessage":"api_key must not been empty","messagePattern":"api_key must not been empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"core/tenant/internal/handler/req.go","lineNumber":195,"sourceCode":"\tRequestId string `json:\"request_id\"`\n\tAppId     string `json:\"app_id\"`\n\tApiKey    string `json:\"api_key\"`\n}\n\nfunc newDeleteAuthReq(c *gin.Context) (*DeleteAuthReq, error) {\n\treq := &DeleteAuthReq{}\n\terr := c.BindJSON(req)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif len(req.RequestId) == 0 {\n\t\treturn nil, errors.New(\"request_id must not been empty\")\n\t}\n\tif len(req.AppId) == 0 {\n\t\treturn nil, errors.New(\"app_id must not been empty\")\n\t}\n\tif len(req.ApiKey) == 0 {\n\t\treturn nil, errors.New(\"api_key must not been empty\")\n\t}\n\treturn req, nil\n}\n\ntype VerifyAppAuthReq struct {\n\tApiKey    string `json:\"api_key\"`\n\tApiSecret string `json:\"api_secret\"`\n}\n\nfunc newVerifyAppAuthReq(c *gin.Context) (*VerifyAppAuthReq, error) {\n\treq := &VerifyAppAuthReq{}\n\terr := c.BindJSON(req)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif len(req.ApiKey) == 0 {\n\t\treturn nil, errors.New(\"api_key must not been empty\")\n\t}","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/core/tenant/internal/handler/req.go#L177-L213","documentation":"newDeleteAuthReq validates the DeleteAuth request body before the handler proceeds. When req.ApiKey is an empty string it returns this error, since identifying which app credential to delete requires a non-empty api_key. This is an input validation guard, not an infrastructure failure.","triggerScenarios":"POST/DELETE requests routed to DeleteAuth whose JSON body omits api_key or sets it to \"\"; tests calling newDeleteAuthReq with an empty ApiKey field.","commonSituations":"Client sends a JSON body that names the field differently (apiKey vs api_key due to missing binding tag handling), body truncated by a proxy, or a caller constructing the struct in Go without setting ApiKey.","solutions":["Include a non-empty api_key field in the request JSON body","Check client-side that the API key value is loaded (not an unset env var) before calling the endpoint","Return a 400 with this message from the handler so callers see the missing field explicitly"],"exampleFix":"// before\ncurl -X POST .../auth/delete -d '{\"app_id\":\"app1\"}'\n// after\ncurl -X POST .../auth/delete -d '{\"app_id\":\"app1\",\"api_key\":\"ak-123\"}'","handlingStrategy":"validation","validationCode":"if !req || req.AppId == \"\" || req.ApiKey == \"\" { return errors.New(\"app_id and api_key are required\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always send both app_id and api_key in delete-auth payloads","Validate request bodies client-side before the HTTP call","Keep JSON field names aligned with the Go struct json tags"],"tags":["go","validation","request-body"],"backgroundTag":"empty-required-field","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-19T12:17:13.211Z"}