fix(auth): protect GET /api/stats with read-only API key router

[solomonneas]

Fixes #7

Summary

/api/stats was registered directly on the FastAPI app, bypassing require_api_key when CODE_SEARCH_API_KEY was configured. The route now uses protected_api, matching /api/projects and /api/summary-stats.

Regression coverage checks all three project-metadata endpoints when the key is unset and when requests provide no key, a wrong key, a valid X-API-Key, or a valid bearer token. The repository verification script now installs pytest in its throwaway environment and runs the full Python suite.

Scope

• src/code_search_api/server.py: register /api/stats on the read-only protected router
• tests/test_auth.py: cover metadata endpoint authentication
• README.md: mark /api/stats as authenticated
• scripts/verify: run the Python suite in the throwaway environment
• AGENTS.md: describe the Python test gate

Impact analysis

GraphTrail attributed tests/test_auth.py, including test_metadata_routes_open_when_key_unset and test_metadata_routes_require_valid_key_when_configured. It also found the existing stats -> get_conn call and the MCP client path CodeSearchClient.stats -> CodeSearchClient.request.

Verification

Exact updated head: ea3247b3b614da4d01d1409ee20d8e851c3ba5f6

GitHub Actions run 31432855009:

• Python 3.10.20: 21 MCP tests, 23 Python tests, and the loopback smoke test passed
• Python 3.12.13: 21 MCP tests, 23 Python tests, and the loopback smoke test passed

The smoke tests used OS-assigned loopback ports and throwaway databases. git diff --check origin/main...HEAD and git status --short produced no output.

Risk notes

Operators who configure CODE_SEARCH_API_KEY must now authenticate /api/stats; behavior remains open when the key is unset. No client code or dependencies changed. The MCP client already uses the shared request helper that attaches the configured API key.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a31893f4-5844-470e-94f2-3d862cb103a7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}