fix: resolve 22P02 in api

[oneuptime-test]

Exception Fix

This pull request was automatically generated by OneUptime AI Agent to fix an exception.

Exception Details

Service: api
Type: 22P02
Message (dynamic values and secrets redacted): invalid input syntax for type uuid: ""

Stack Trace

QueryFailedError: invalid input syntax for type uuid: "<ID>"
    at PostgresQueryRunner.query (/usr/src/Common/node_modules/typeorm/src/driver/postgres/PostgresQueryRunner.ts:325:19)
    at processTicksAndRejections (node:internal/process/task_queues:104:5)
    at async SelectQueryBuilder.loadRawResults (/usr/src/Common/node_modules/src/query-builder/SelectQueryBuilder.ts:3818:25)
    at async SelectQueryBuilder.executeEntitiesAndRawResults (/usr/src/Common/node_modules/src/query-builder/SelectQueryBuilder.ts:3564:26)
    at async SelectQueryBuilder.getRawAndEntities (/usr/src/Common/node_modules/src/query-builder/SelectQueryBuilder.ts:1617:29)
    at async SelectQueryBuilder.getMany (/usr/src/Common/node_modules/src/query-builder/SelectQueryBuilder.ts:1707:25)
    at async Service._findBy (/usr/src/Common/Server/Services/DatabaseService.ts:1854:40)
    at async Service.findOneBy (/usr/src/Common/Server/Services/DatabaseService.ts:2019:42)
    at async Service.getProjectIdFromSecretKey (/usr/src/Common/Server/Services/TelemetryIngestionKeyService.ts:94:33)
    at async isAuthorizedServiceMiddleware (/usr/src/Common/Server/Middleware/TelemetryIngest.ts:71:9)

Summary of Changes

The tests mock the service, so they won't be affected by this change.

Summary

Root Cause: In TelemetryIngestionKeyService.getProjectIdFromSecretKey(), the code used a try/catch around new ObjectID(secretKey) to validate the token format. However, the ObjectID constructor does not validate UUID format — it silently accepts any string. When an invalid token (e.g., <ID>) was passed, it created an ObjectID with the invalid value, which was then sent to PostgreSQL via findOneBy(). PostgreSQL rejected it with invalid input syntax for type uuid.

Fix: Replaced the ineffective try/catch with an explicit ObjectID.isValidUUID(secretKey) check before constructing the ObjectID. If the token is not a valid UUID, we cache the negative result (with a short TTL to absorb repeat hits) and return null, matching the existing behavior for unknown/revoked tokens. This prevents the malformed value from ever reaching PostgreSQL.

---

Opened as a draft — review before merging. The fix is AI-authored: verify it actually addresses the exception, then mark the pull request ready for review. Nothing is merged automatically.

This PR was automatically generated by OneUptime AI Agent

ℹ️ Verification

Not verified — the repository has no setup/build/test commands configured. Configure them on the code repository to have fixes verified before the pull request opens.

[simlarsen]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.