Return 401 for failed internal API authentication

[skyfallwastaken]

Summary of the problem

The revocation endpoint handled its credential separately from the internal API authentication policy. A missing secret could raise an exception and failed authentication redirected callers to an external page.

Describe your changes

Centralises blank handling and digest comparison in the internal API base controller while allowing each controller to supply its expected keys. The revocation controller now supplies HKA_REVOCATION_KEY and failed authentication returns an empty 401 response. The successful revocation response remains unchanged and the documented failure response is now 401.

Screenshots / Media

Not applicable because there are no visual changes.

[greptile-apps]

Greptile Summary

Centralizes internal API credential validation in the base controller and changes failed revocation authentication from an external redirect to an empty 401 response.

• Adds blank-safe, fixed-length SHA-256 digest comparisons for configured internal API keys.
• Supplies the revocation-specific key through an overridable controller method.
• Updates request coverage and OpenAPI documentation for the 401 response.

Confidence Score: 5/5

The PR appears safe to merge with the authentication behavior consistently implemented, tested, and documented.

Invalid or missing revocation credentials now terminate the callback chain with an empty 401, while matching credentials continue to the existing action.

Important Files Changed

Filename	Overview
app/controllers/api/internal/application_controller.rb	Centralizes blank-safe token authentication and returns an empty unauthorized response when no configured key matches.
app/controllers/api/internal/revocations_controller.rb	Reuses the shared authentication path while supplying HKA_REVOCATION_KEY as the endpoint’s expected credential.
spec/requests/api/internal/internal_spec.rb	Updates the documented request example to expect a 401 for an incorrect revocation credential.
test/controllers/api/internal/revocations_controller_test.rb	Adds regression coverage for missing configuration and differently sized invalid bearer tokens.
swagger/admin/swagger.yaml	Updates the revocation endpoint contract from a 302 redirect to a 401 unauthorized response.

_{Reviews (1): Last reviewed commit: "Return 401 for failed internal API authe..." | Re-trigger Greptile}

[Copilot]

Pull request overview

This pull request updates internal API authentication so failed auth for the revocation endpoint returns an empty 401 Unauthorized response instead of redirecting, and so missing/blank credentials are handled safely within the shared internal API base controller.

Changes:

• Centralises internal API key authentication in Api::Internal::ApplicationController, including blank handling and constant-time digest comparison.
• Updates the revocation endpoint to supply its expected key (HKA_REVOCATION_KEY) via expected_api_keys.
• Aligns tests and OpenAPI documentation to the new 401 Unauthorized failure behaviour.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
app/controllers/api/internal/application_controller.rb	Implements shared internal auth that responds with 401 and allows controllers to provide expected keys.
app/controllers/api/internal/revocations_controller.rb	Removes bespoke auth and provides expected_api_keys for revocation-specific credentials.
test/controllers/api/internal/revocations_controller_test.rb	Adds coverage for missing secret and mismatched token scenarios; updates auth header helper.
spec/requests/api/internal/internal_spec.rb	Updates the rswag spec to document/auth-test 401 on failed internal authentication.
swagger/admin/swagger.yaml	Updates generated OpenAPI output to reflect 401 unauthorized instead of a redirect response.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.