fix: validate API key name length to prevent opaque 500

API key names longer than 32 characters were rejected by better-auth
with a 400 that surfaced as an opaque INTERNAL_SERVER_ERROR (the generic
"Failed to generate API key" toast). Add a shared name schema (min 1,
max 32, matching better-auth's default maximumNameLength) used by both
the tRPC input and the client form, and surface the limit on the Name
field so users see it before submitting.

Fixes #4798
This commit is contained in:
tanaymishra
2026-07-12 17:42:28 +05:30
parent 2e867c5be1
commit f577778667
4 changed files with 61 additions and 3 deletions

View File

@@ -35,6 +35,7 @@ import { TRPCError } from "@trpc/server";
import * as bcrypt from "bcrypt";
import { and, asc, eq, gt, ne } from "drizzle-orm";
import { z } from "zod";
import { apiKeyNameSchema } from "@/lib/api-keys";
import { audit } from "@/server/api/utils/audit";
import {
adminProcedure,
@@ -45,7 +46,7 @@ import {
} from "../trpc";
const apiCreateApiKey = z.object({
name: z.string().min(1),
name: apiKeyNameSchema,
prefix: z.string().optional(),
expiresIn: z.number().optional(),
metadata: z.object({