fix(api-keys): never echo an internal key-creation failure to the caller

The unauthenticated CLI poll route and the settings routes returned the
raw error message for an internal failure. Return a fixed message and keep
the cause in the server log; a conflict still names the existing key. The
CLI's comment now says a 400 can also be a refused key creation.

Author: waleedlatif1

apps/sim/lib/api-key/orchestration/index.test.ts

@@ -0,0 +1,54 @@
+import { dbChainMockFns, resetDbChainMock } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { createWorkspaceKey } = vi.hoisted(() => ({ createWorkspaceKey: vi.fn() }))
+vi.mock('@/lib/api-key/auth', () => ({
+  createApiKey: vi.fn(),
+  createWorkspaceApiKey: createWorkspaceKey,
+}))
+
+import {
+  performCreatePersonalApiKey,
+  performCreateWorkspaceApiKey,
+} from '@/lib/api-key/orchestration'
+
+const INTERNAL_DETAIL = 'connect ECONNREFUSED 10.0.0.5:5432 for role april'
+
+describe('API key creation failures', () => {
+  beforeEach(() => {
+    resetDbChainMock()
+    createWorkspaceKey.mockReset()
+  })
+
+  it('never echoes an internal personal-key failure to the caller', async () => {
+    dbChainMockFns.limit.mockRejectedValueOnce(new Error(INTERNAL_DETAIL))
+
+    const result = await performCreatePersonalApiKey({ userId: 'user-1', name: 'CLI' })
+
+    expect(result).toMatchObject({ success: false, errorCode: 'internal' })
+    expect(result.error).not.toContain('ECONNREFUSED')
+  })
+
+  it('never echoes an internal workspace-key failure, but still names a conflict', async () => {
+    createWorkspaceKey.mockRejectedValueOnce(new Error(INTERNAL_DETAIL))
+    const internal = await performCreateWorkspaceApiKey({
+      workspaceId: 'ws-1',
+      userId: 'user-1',
+      name: 'CLI',
+    })
+    expect(internal).toMatchObject({ success: false, errorCode: 'internal' })
+    expect(internal.error).not.toContain('ECONNREFUSED')
+
+    createWorkspaceKey.mockRejectedValueOnce(new Error('A key named "CLI" already exists'))
+    const conflict = await performCreateWorkspaceApiKey({
+      workspaceId: 'ws-1',
+      userId: 'user-1',
+      name: 'CLI',
+    })
+    expect(conflict).toEqual({
+      success: false,
+      errorCode: 'conflict',
+      error: 'A key named "CLI" already exists',
+    })
+  })
+})

apps/sim/lib/api-key/orchestration/index.ts

@@ -208,7 +208,8 @@ export async function performCreatePersonalApiKey(
     return { success: true, key: { ...created, key: plainKey } }
   } catch (error) {
     logger.error('Failed to create personal API key', { error })
-    return { success: false, errorCode: 'internal', error: toError(error).message }
+    // The CLI poll route is unauthenticated, so an internal failure never echoes its cause.
+    return { success: false, errorCode: 'internal', error: 'Failed to create API key' }
   }
 }
 
@@ -266,10 +267,10 @@ export async function performCreateWorkspaceApiKey(
   } catch (error) {
     const message = toError(error).message
     logger.error('Failed to create workspace API key', { error })
-    return {
-      success: false,
-      error: message,
-      errorCode: message.includes('already exists') ? 'conflict' : 'internal',
+    if (message.includes('already exists')) {
+      return { success: false, error: message, errorCode: 'conflict' }
     }
+    // The CLI poll route is unauthenticated, so an internal failure never echoes its cause.
+    return { success: false, error: 'Failed to create API key', errorCode: 'internal' }
   }
 }

packages/sim-cli/src/auth/device-flow.ts

@@ -39,8 +39,9 @@ const POLL_PATH = '/api/cli/auth/poll'
  * 429 is the poll cadence hitting the per-IP bucket, not a refusal.
  *
  * Everything else stays terminal: 400 means a malformed request id or verifier,
- * and 401/403/404 mean the server is refusing on purpose. Retrying those just
- * spins until the 15-minute timeout.
+ * or a key the server refused to create as requested, which the same poll would
+ * be refused again for; 401/403/404 mean the server is refusing on purpose.
+ * Retrying those just spins until the 15-minute timeout.
  */
 const RETRYABLE_POLL_STATUSES = new Set([409, 429, 500, 502, 503, 504])