fix(api): redact statistics API key errors

[nickita-khylkouski]

Summary

• Stop returning plaintext API/subkey material in invalid_apikey errors from /statistics/org/:org_id.
• Cover both org-limited and app-limited scoped API key rejection paths with a focused unit test.

Root cause

The org statistics endpoint attached auth.apikey.key to quickError metadata when a scoped API key could not access org-level statistics. onError returns that metadata to the caller and logs it.

Validation

• bunx vitest run tests/statistics-apikey-redaction.unit.test.ts
• bun x eslint supabase/functions/_backend/public/statistics/index.ts tests/statistics-apikey-redaction.unit.test.ts
• git diff --check

[coderabbitai]

Warning

Rate limit exceeded

@nickita-khylkouski has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 29 minutes and 6 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3db55226-76e6-46be-82dd-f6ea7b93589d

📥 Commits

Reviewing files that changed from the base of the PR and between b69f22a and 1f48d31.

📒 Files selected for processing (2)

• supabase/functions/_backend/public/statistics/index.ts
• tests/statistics-apikey-redaction.unit.test.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing nickita-khylkouski:codex/redact-statistics-org-apikey (1f48d31) with main (b69f22a)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[WcaleNieWolny]

Closing as AI-generated spam. Part of a 50+ PR wave of duplicate redact logs PRs from disposable accounts. If you're human, open an issue first.