fix(db): dedup duplicate API keys per provider on connection create (#3023)

[diegosouzapw]

Closes #3023

Problem

Adding the same API key twice for one provider (e.g. with a different or blank name) created a second connection row.

Root cause

createProviderConnection only deduped apikey connections by (provider, auth_type, name). There was no comparison of the key value, so a duplicate key under a new name inserted a fresh row.

Fix

In the apikey branch, after the name-based upsert check, also look up existing apikey connections for the provider and compare the decrypted key (stored keys use non-deterministic AES-GCM, so ciphertext can't be compared — decrypt + compare trimmed plaintext). A match reuses/updates the existing connection.

Tests — tests/unit/provider-connection-apikey-dedup.test.ts

• same key under a different name → 1 connection (dedups onto the existing id) (fails pre-fix)
• same key with surrounding whitespace → still dedups (fails pre-fix)
• genuinely different keys → 2 connections (passes both ways)

3 pass / 0 fail (RED→GREEN verified). ESLint clean (0 errors).

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[gemini-code-assist]

Code Review

This pull request implements API key deduplication in createProviderConnection to prevent duplicate connection rows for the same provider when the same API key is added under different names, and includes corresponding unit tests. The review feedback correctly points out a runtime error in the new test file where beforeEach and after hooks are incorrectly accessed as properties of the default test export from node:test instead of being imported as named exports.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

In node:test, hooks like beforeEach and after are not properties of the default test export. They must be imported as named exports to avoid runtime TypeErrors.

import { test, beforeEach, after } from "node:test";

[gemini-code-assist]

Call the imported beforeEach and after hooks directly instead of accessing them as properties of test.

beforeEach(resetStorage);

after(() => {
  core.resetDbInstance();
  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
});

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	1
WARNING	0
SUGGESTION	0

Issue Details (click to expand)

CRITICAL

File	Line	Issue
tests/unit/provider-connection-apikey-dedup.test.ts	9	Test sets API_KEY_SECRET but the dedup logic relies on decryptConnectionFields() from encryption.ts which checks STORAGE_ENCRYPTION_KEY (via isEncryptionEnabled()). While the test passes in passthrough mode (where keys are plaintext), it does not verify the encryption path where the fix is most critical — encrypted keys with non-deterministic AES-GCM ciphertext would not match without decrypting first. The test should set STORAGE_ENCRYPTION_KEY to enable encryption for proper verification.

Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

File	Line	Issue
tests/unit/provider-connection-apikey-dedup.test.ts	9	The test sets API_KEY_SECRET without preserving/restoring the original value in test.after(). While the `

Positive observations

• The implementation in src/lib/db/providers.ts (lines 208-224) correctly decrypts stored API keys before comparison, handling the non-deterministic AES-GCM ciphertext issue mentioned in the PR description.
• The code structure properly falls back to name-based upsert first, then key-value comparison, maintaining backward compatibility.
• Edge case handling for whitespace-only differences is well-designed.

Files Reviewed (3 files)

• src/lib/db/providers.ts - Implementation (no issues in this file)
• tests/unit/provider-connection-apikey-dedup.test.ts - 1 CRITICAL issue
• CHANGELOG.md - Changelog entry (no issues)

---

_{Reviewed by laguna-m.1-20260312:free · 3,620,309 tokens}