[HamzaKhanBUIC]

Fixes #74

Summary of Changes

• Constant-Time Verification (agentkit/api/auth.py): Replaced the short-circuiting api_key not in settings.api_keys_list check with constant-time comparison (hmac.compare_digest) across all configured keys to eliminate byte-by-byte timing oracles.
• Key Normalisation: Normalises presented keys (api_key.strip()) identical to Settings.api_keys_list, ensuring that whitespace-padded keys (e.g. ' key ') resolve identically to unpadded keys and that consistent keys are used for downstream rate-limiting and logging.
• UTF-8 Byte Safety: Encodes presented and configured keys to UTF-8 bytes before comparing, preventing TypeError crashes when unauthenticated clients or fuzzers submit non-ASCII / Unicode payloads.
• Tests & Quality:
  • Added unit test cases in tests/unit/test_api_auth.py asserting whitespace-padded keys, whitespace-only keys, invalid keys, and Unicode key support.
  • Added integration test in test_api_key_auth_endpoint_integration verifying identical HTTP 200 responses for padded headers.
  • ruff check ., ruff format --check ., and mypy agentkit/api/auth.py all clean.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.