fix(auth): gate cache deny on non-null user_id to prevent cross-user pollution

[truecallerabreham]

Summary

When user_id is None (anonymous/unauthenticated requests), the outer exception handlers in auth_user call set_cache with a deny value using a generic cache key (empty user segment). Since all anonymous users share the same cache key, one user's auth failure can cause all subsequent anonymous requests to also fail auth for up to 5 minutes.

This fix adds a user_id is not None guard before writing deny entries to the cache, so anonymous failures are not cached globally.

Changes

• api/oss/src/middlewares/auth.py: Added if user_id is not None: guards around set_cache calls in both the UnauthorizedException handler and the generic Exception handler. The _deny logging call is preserved unconditionally so failures are still recorded.
• api/oss/tests/pytest/unit/middlewares/test_cache_deny.py: Added regression tests verifying that deny entries are only cached when user_id is known, and not cached for anonymous users.

Demo

Code diff showing the two guarded set_cache calls:

Impact

• High availability fix: Prevents a single anonymous auth failure from blocking all anonymous users for the cache TTL (5 minutes)
• No behavioral change for authenticated users: When user_id is set, the cache deny behavior is unchanged
• Backend-only change: No UI or frontend impact — this is a middleware-level cache key fix

Testing

• Added test_cache_deny_not_written_when_user_id_is_none — verifies set_cache is NOT called with deny when user_id is None
• Added test_cache_deny_written_when_user_id_is_set — verifies set_cache IS called with deny when user_id is set
• Verified the fix by reading the caching._pack function: when user_id is None, the cache key becomes cache:p:{project}:u:{12 dashes}:{namespace}:{key}, which is identical for all anonymous users

[vercel]

@truecallerabreham is attempting to deploy a commit to the agenta projects Team on Vercel.

A member of the Team first needs to authorize it.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

Hi @truecallerabreham, thanks for opening a pull request. 🙏

This PR was automatically closed because it does not yet meet our contribution requirements:

• This PR changes functional code (SDK, API, or frontend) but includes no demo. Add a screenshot or short video of the change. Only test-only, docs-only, or chore changes may skip it.

We ask for this so every change is documented and demonstrably tested before review.

How to get it reopened
Update the PR description (and add a demo recording if your change touches functional code). The bot reopens the PR automatically once the requirements are met. No need to open a new one.

See the Contributing guide and Creating your first PR. If you think this was closed in error, leave a comment and a maintainer will take a look.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0644b1aa-adf8-4c45-bf5f-06553c44c394

📥 Commits

Reviewing files that changed from the base of the PR and between 3b0c0cb and 20cae43.

📒 Files selected for processing (1)

• api/oss/src/middlewares/auth.py

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Improved authentication error handling to avoid creating invalid denial-cache entries when no user identity is available.
  • Preserved expected access-denial behavior for unauthorized and unexpected authentication failures.

Walkthrough

The bearer-token authentication middleware now guards deny-cache writes in both unauthorized and unexpected exception handlers, avoiding cache updates when no user ID was resolved.

Changes

Authentication deny-cache handling

Layer / File(s)	Summary
Conditional deny-cache writes api/oss/src/middlewares/auth.py	Both exception handlers now call set_cache with {"deny": True} only when user_id is not None.

Estimated code review effort: 2 (Simple) | ~5 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}