fix(sync): treat cloud API key as opaque credential

[shark0F0497]

Pull Request Checklist

Please ensure your PR meets the following requirements:

• Code follows the style guidelines
• Tests pass locally
• Code is formatted
• Documentation updated if needed
• Commit messages follow conventional commits
• PR description is complete and clear

---

Summary

This PR changes Keystone cloud sync authentication so KEYSTONE_CLOUD_API_KEY is treated as an opaque cloud-issued credential and forwarded directly to AuthService.ExchangeCredential as credential_base64.

---

Motivation

• The cloud AuthService owns API key interpretation and validation.
• Keystone is only an upload client and should not decode, split, or enforce the internal API key format.
• Removing client-side parsing avoids coupling Keystone to cloud credential internals such as site_id and secret layout.

---

Changes

Modified Files

• README.md - Documents the opaque credential contract for KEYSTONE_CLOUD_API_KEY.
• docs/designs/cloud-sync-ui-implementation.md - Adds credential handling guidance for cloud sync configuration.
• internal/config/config.go - Removes API key decoding and derived SiteID / APISecret fields; validation now only requires a non-empty trimmed API key when sync is enabled.
• cmd/keystone-edge/main.go - Passes the configured API key directly into the cloud auth client.
• internal/cloud/auth_client.go - Forwards the opaque API key directly as credential_base64 instead of rebuilding it from parsed components.
• internal/config/config_test.go - Updates validation tests to accept arbitrary opaque API keys and verify trimming behavior.
• internal/cloud/auth_client_test.go - Replaces encoding-format tests with opaque credential pass-through tests.

Added Files

None.

Deleted Files

None.

---

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update (documentation changes only)
• Refactoring (code improvement without functional changes)
• Performance improvement (code changes that improve performance)
• Test changes (adding, modifying, or removing tests)

---

Impact Analysis

Breaking Changes

None.

Backward Compatibility

Backward compatible for valid cloud-issued credentials. Keystone no longer rejects credentials based on local assumptions about their internal encoding; invalid credentials are rejected by the cloud AuthService during credential exchange.

---

Testing

Test Environment

Local Keystone Go test environment.

Test Cases

• Unit tests pass locally
• Integration tests pass locally
• E2E tests pass (if applicable)
• Manual testing completed

Manual Testing Steps

Not applicable; this change is covered by Go unit/package tests.

Test Coverage

• New tests added
• Existing tests updated
• Coverage maintained or improved

Commands run:

go test ./internal/config ./internal/cloud
go test ./...

---

Screenshots / Recordings

Not applicable.

---

Performance Impact

• Memory usage: No change
• CPU usage: No change
• Throughput: No change
• Lock contention: No change

---

Documentation

• README.md updated
• ARCHITECTURE.md updated
• CONTRIBUTING.md updated
• API documentation updated
• Design docs updated in docs/designs/
• No documentation changes needed

---

Related Issues

None.

---

Additional Notes

The gRPC field name remains credential_base64 because it is part of the existing cloud auth API. Keystone now treats the configured API key as the exact value to send in that field.

---

Reviewers

N/A

---

Notes for Reviewers

• Please review the cloud credential flow in internal/config/config.go and internal/cloud/auth_client.go.
• Confirm that Keystone should continue trimming surrounding whitespace from KEYSTONE_CLOUD_API_KEY before sending it to cloud auth.

---

Checklist for Reviewers

• Code changes are correct and well-implemented
• Tests are adequate and pass
• Documentation is updated and accurate
• No unintended side effects
• Performance impact is acceptable
• Backward compatibility maintained (if applicable)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (7 files)

• README.md
• cmd/keystone-edge/main.go
• docs/designs/cloud-sync-ui-implementation.md
• internal/cloud/auth_client.go
• internal/cloud/auth_client_test.go
• internal/config/config.go
• internal/config/config_test.go

EOF

---

_{Reviewed by nemotron-3-super-120b-a12b-20230311:free · 70,432 tokens}