fix: treat empty-string credentials as missing and skip malformed media reference segments

[lorenzozanee]

Fixes langfuse/langfuse#15280

What does this PR do?

Treats empty-string credentials as missing so Langfuse disables itself at initialization with the existing warning instead of building a fully-wired client and failing later with an opaque auth error on the first request. An unset LANGFUSE_PUBLIC_KEY or LANGFUSE_SECRET_KEY rendered as "" by a templated Docker/Kubernetes env file previously bypassed the is None guard; the guard now checks falsiness, restoring the pre-v3.0.0 behavior.

Also makes LangfuseMedia.parse_reference_string skip pipe-separated segments without =, so a malformed segment or a trailing | no longer raises a raw ValueError: not enough values to unpack. Genuinely incomplete references still raise the documented ValueError: Missing required fields in reference string.

Type of change

• Bug fix
• New feature
• Breaking change
• Refactor
• Documentation update
• Tooling, CI, or repo maintenance

Verification

pytest tests/unit/test_initialization.py tests/unit/test_media.py -q -p no:xdist

• 44 passed on the two touched test files.
• The 5 new regression tests fail on main and pass with this change.

Checklist

• I self-reviewed the diff using code_review.md.
• I added or updated tests for behavior changes.
• I updated docs, examples, or .env.template if needed.
• I did not hand-edit generated files; if generated files changed, I used the upstream regeneration path.
• I did not commit secrets or credentials.

Note: #1772 also addresses this issue with a broader scope; this PR keeps the change minimal and focused on the two behaviors described in the issue.

Greptile Summary

The PR makes client initialization fail closed when either credential resolves to an empty string and makes media-reference parsing tolerate malformed pipe-separated segments while retaining required-field validation.

• Empty public or secret keys now produce a disabled no-op client instead of a fully initialized client that later fails authentication.
• Media-reference segments without = are ignored, including trailing empty segments.
• Regression tests cover both credential cases and malformed media references.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or non-blocking defects identified in the changed behavior.

Empty credentials now follow the established disabled-client path, and malformed media segments are skipped without bypassing required-field validation.

_{Reviews (1): Last reviewed commit: "fix: treat empty-string credentials as m..." | Re-trigger Greptile}

Context used:

• Knowledge Base — Client Core
• Knowledge Base — Media Module

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}