From 3552a88fbd7987d6e89f3d33486ad54172d5f864 Mon Sep 17 00:00:00 2001
From: Nikolas de Hor <nikolasdehor79@gmail.com>
Date: Tue, 3 Mar 2026 01:20:16 -0300
Subject: [PATCH] fix(providers): address review feedback - APIKey guard, test
 fix

- Add explicit APIKey \!= '' guard in both provider-selection branches to
  prevent routing with empty credentials when only AuthMethod is set
- Fix test to use ModelList (CreateProvider now requires model_list entry)
- Fix test for 3-value return from CreateProvider after upstream changes
---
 pkg/providers/factory.go      | 32 ++++++++++++++++++--------------
 pkg/providers/factory_test.go | 13 +++++++++----
 2 files changed, 27 insertions(+), 18 deletions(-)

diff --git a/pkg/providers/factory.go b/pkg/providers/factory.go
index 2f36a97af..530f16885 100644
--- a/pkg/providers/factory.go
+++ b/pkg/providers/factory.go
@@ -86,14 +86,16 @@ func resolveProviderSelection(cfg *config.Config) (providerSelection, error) {
 					sel.providerType = providerTypeClaudeAuth
 					return sel, nil
 				}
-				sel.apiKey = cfg.Providers.Anthropic.APIKey
-				sel.apiBase = cfg.Providers.Anthropic.APIBase
-				sel.proxy = cfg.Providers.Anthropic.Proxy
-				if sel.apiBase == "" {
-					sel.apiBase = defaultAnthropicAPIBase
+				if cfg.Providers.Anthropic.APIKey != "" {
+					sel.apiKey = cfg.Providers.Anthropic.APIKey
+					sel.apiBase = cfg.Providers.Anthropic.APIBase
+					sel.proxy = cfg.Providers.Anthropic.Proxy
+					if sel.apiBase == "" {
+						sel.apiBase = defaultAnthropicAPIBase
+					}
+					sel.providerType = providerTypeClaudeAPIKey
+					return sel, nil
 				}
-				sel.providerType = providerTypeClaudeAPIKey
-				return sel, nil
 			}
 		case "openrouter":
 			if cfg.Providers.OpenRouter.APIKey != "" {
@@ -238,14 +240,16 @@ func resolveProviderSelection(cfg *config.Config) (providerSelection, error) {
 				sel.providerType = providerTypeClaudeAuth
 				return sel, nil
 			}
-			sel.apiKey = cfg.Providers.Anthropic.APIKey
-			sel.apiBase = cfg.Providers.Anthropic.APIBase
-			sel.proxy = cfg.Providers.Anthropic.Proxy
-			if sel.apiBase == "" {
-				sel.apiBase = defaultAnthropicAPIBase
+			if cfg.Providers.Anthropic.APIKey != "" {
+				sel.apiKey = cfg.Providers.Anthropic.APIKey
+				sel.apiBase = cfg.Providers.Anthropic.APIBase
+				sel.proxy = cfg.Providers.Anthropic.Proxy
+				if sel.apiBase == "" {
+					sel.apiBase = defaultAnthropicAPIBase
+				}
+				sel.providerType = providerTypeClaudeAPIKey
+				return sel, nil
 			}
-			sel.providerType = providerTypeClaudeAPIKey
-			return sel, nil
 		case (strings.Contains(lowerModel, "gpt") || strings.HasPrefix(model, "openai/")) &&
 			(cfg.Providers.OpenAI.APIKey != "" || cfg.Providers.OpenAI.AuthMethod != ""):
 			sel.enableWebSearch = cfg.Providers.OpenAI.WebSearch
diff --git a/pkg/providers/factory_test.go b/pkg/providers/factory_test.go
index 9116dd57d..fb1c8647d 100644
--- a/pkg/providers/factory_test.go
+++ b/pkg/providers/factory_test.go
@@ -345,11 +345,16 @@ func TestCreateProviderReturnsClaudeProviderForAnthropicOAuth(t *testing.T) {
 
 func TestCreateProviderReturnsClaudeProviderForAnthropicAPIKey(t *testing.T) {
 	cfg := config.DefaultConfig()
-	cfg.Agents.Defaults.Provider = "anthropic"
-	cfg.Agents.Defaults.Model = "claude-opus-4-6"
-	cfg.Providers.Anthropic.APIKey = "sk-ant-api03-test"
+	cfg.Agents.Defaults.Model = "test-claude-apikey"
+	cfg.ModelList = []config.ModelConfig{
+		{
+			ModelName: "test-claude-apikey",
+			Model:     "anthropic/claude-opus-4-6",
+			APIKey:    "sk-ant-api03-test",
+		},
+	}
 
-	provider, err := CreateProvider(cfg)
+	provider, _, err := CreateProvider(cfg)
 	if err != nil {
 		t.Fatalf("CreateProvider() error = %v", err)
 	}