fix(api): handle non-ASCII API keys in constant-time comparison

[seonghobae]

Superseded by canonical successor #520

This PR's valid product delta has been verified as fully inherited by #520 (fix(auth): compare API keys at the raw ASGI boundary) on exact successor head 08d1c3ca20e3e41a703ac9e5c5aea6f702962d2d.

The succession is semantic, not a PR-count cleanup:

• this PR's valid intent — non-ASCII X-API-Key input must reject normally instead of reaching the hmac.compare_digest(str, str) ASCII-only error path — is retained;
• fix(auth): compare API keys at the raw ASGI boundary #520 carries the same test_non_ascii_key_does_not_crash request-path regression and additionally covers configured Unicode credentials, wrong raw UTF-8/high-bit credentials, and duplicate header ambiguity;
• fix(auth): compare API keys at the raw ASGI boundary #520 compares the raw ASGI header bytes directly with configured UTF-8 key bytes, avoiding the weaker decoded-string→UTF-8 re-encoding boundary used here;
• fix(auth): compare API keys at the raw ASGI boundary #520 keeps the production comparison constant-time with hmac.compare_digest(bytes, bytes) and preserves non-reflective 401 behavior;
• fix(auth): compare API keys at the raw ASGI boundary #520 has a code-current CHANGELOG and excludes the generated .jules/sentinel.md doctrine from its effective delta.

Before closing this lane, normal descendant 5f49cbd259c1e069b97e5b93c879acf81908936b restored this PR's generated .jules/sentinel.md entry byte-for-byte to protected main, so the closed branch does not retain a repository-wide doctrine absent from the canonical successor.

Python's authoritative contract remains that the str form of hmac.compare_digest is ASCII-only: https://docs.python.org/3/library/hmac.html#hmac.compare_digest

#520 remains Draft and must satisfy its own exact-head CodeQL/control-plane, credential-registry governance, review, and protected-merge gates. Closing this weaker duplicate does not transfer predecessor workflow evidence or mark #520 complete.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Warning

Review limit reached

Next included review available in 21 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 9d649448-bcc5-4c2e-b803-2c9d81d42607

📥 Commits

Reviewing files that changed from the base of the PR and between 47c6fd2 and 5f49cbd.

📒 Files selected for processing (2)

• saas_web.py
• tests/test_saas_web.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}