From 35cf21209f33da70a9e3e7cade0f04a235ec153a Mon Sep 17 00:00:00 2001
From: Michael SCHAL <michaelschal@gmail.com>
Date: Mon, 18 May 2026 12:32:11 +0200
Subject: [PATCH] fix(settings): prevent empty string API keys from being saved
 or preserved

- Add .min(1) validation to insertOpenrouterConfigSchema
- Strip empty/whitespace-only apiKey before fallback to existing key
- Return 400 if resulting apiKey is empty (forces user to enter valid key)
---
 server/routes.ts | 9 +++++++--
 shared/schema.ts | 2 ++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/server/routes.ts b/server/routes.ts
index 7e3d172..16e32bd 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -1898,12 +1898,17 @@ export async function registerRoutes(app: Express): Promise<Server> {
           userId,
         });
 
-        // Si apiKey n'est pas fourni, garder l'ancien
+        // Si apiKey n'est pas fourni ou vide, garder l'ancien
+        const incomingKey = updateData.apiKey?.trim() || undefined;
         const finalData = {
           ...updateData,
-          apiKey: updateData.apiKey || existingConfig.apiKey,
+          apiKey: incomingKey || existingConfig.apiKey,
         };
 
+        if (!finalData.apiKey) {
+          return res.status(400).json({ error: "Clé API OpenRouter manquante. Veuillez entrer une clé API valide." });
+        }
+
         config = await storage.updateOpenrouterConfig(userId, finalData);
       } else {
         // Pour les créations, exiger tous les champs
diff --git a/shared/schema.ts b/shared/schema.ts
index 6b88bde..b2c4b43 100644
--- a/shared/schema.ts
+++ b/shared/schema.ts
@@ -410,6 +410,8 @@ export const insertOpenrouterConfigSchema = createInsertSchema(openrouterConfig)
   id: true,
   createdAt: true,
   updatedAt: true,
+}).extend({
+  apiKey: z.string().min(1, "La clé API ne peut pas être vide"),
 });
 
 export const updateOpenrouterConfigSchema = insertOpenrouterConfigSchema.partial({