fix: address CodeRabbit review findings on PR #2063

- Clear providers.openai.base_url (not just api_key/configured) when
  removing the OpenAI config, so a later re-enable falls back to
  api.openai.com instead of silently reusing a stale gateway URL.
- Reject whitespace-only openai_base_url in SettingsUpdateBody and
  OnboardingBody via a field_validator, instead of silently accepting
  it and stripping it down to an empty (no-op) value downstream.
- Move test_normalize_model_name_still_distinguishes_cohere_variants
  out of the base_url-focused config test file into
  test_embedding_fields.py, where the rest of that module's coverage
  lives.

Author: galovics

src/api/settings/endpoints.py

@@ -677,6 +677,7 @@ async def update_settings(
                 if affected:
                     return _embedding_conflict_response("OpenAI", "openai", affected)
             current_config.providers.openai.api_key = ""
+            current_config.providers.openai.base_url = ""
             current_config.providers.openai.configured = False
             if current_config.agent.llm_provider == "openai":
                 fb = _first_configured_llm_provider(current_config, "openai")

src/api/settings/models.py

@@ -41,6 +41,13 @@ class SettingsUpdateBody(BaseModel):
     # the backend returns 409 and the frontend prompts the user.
     force_remove: bool | None = False
 
+    @field_validator("openai_base_url")
+    @classmethod
+    def reject_whitespace_only_base_url(cls, value: str | None) -> str | None:
+        if value is not None and not value.strip():
+            raise ValueError("openai_base_url must not be blank")
+        return value
+
 
 class OnboardingBody(BaseModel):
     llm_provider: str | None = Field(None, pattern="^(openai|anthropic|watsonx|ollama)$")
@@ -55,6 +62,13 @@ class OnboardingBody(BaseModel):
     watsonx_project_id: str | None = Field(None, min_length=1)
     ollama_endpoint: str | None = Field(None, min_length=1)
 
+    @field_validator("openai_base_url")
+    @classmethod
+    def reject_whitespace_only_base_url(cls, value: str | None) -> str | None:
+        if value is not None and not value.strip():
+            raise ValueError("openai_base_url must not be blank")
+        return value
+
 
 class CitationDisplayData(BaseModel):
     file_path: str | None = None

tests/unit/config/test_openai_base_url_config.py

@@ -128,14 +128,3 @@ def test_env_override_does_not_clobber_other_openai_fields(self, monkeypatch):
 
         assert config.providers.openai.api_key == "sk-from-env"
         assert config.providers.openai.base_url == "http://localhost:4444/v1"
-
-
-def test_normalize_model_name_still_distinguishes_cohere_variants():
-    """Not directly about base_url, but the task calls out locking this in:
-    normalize_model_name() must keep these two Cohere model ids distinct.
-    """
-    from utils.embedding_fields import normalize_model_name
-
-    a = normalize_model_name("cohere.embed-multilingual-v3")
-    b = normalize_model_name("cohere.embed-multilingual-v3.0")
-    assert a != b

tests/unit/test_embedding_fields.py

@@ -14,7 +14,11 @@
 
 import pytest
 
-from utils.embedding_fields import build_knn_vector_field, get_embedding_field_name
+from utils.embedding_fields import (
+    build_knn_vector_field,
+    get_embedding_field_name,
+    normalize_model_name,
+)
 
 
 class TestBuildKnnVectorFieldStructure:
@@ -138,3 +142,12 @@ async def test_create_index_body_uses_configured_shards_and_replicas(
 
         assert body["settings"]["number_of_shards"] == 3
         assert body["settings"]["number_of_replicas"] == 2
+
+
+class TestNormalizeModelName:
+    """normalize_model_name() must produce distinct, safe field-name suffixes."""
+
+    def test_still_distinguishes_cohere_variants(self) -> None:
+        a = normalize_model_name("cohere.embed-multilingual-v3")
+        b = normalize_model_name("cohere.embed-multilingual-v3.0")
+        assert a != b

tests/unit/test_settings_openai_base_url.py

@@ -9,6 +9,7 @@
 from unittest.mock import AsyncMock
 
 import pytest
+from pydantic import ValidationError
 
 import api.settings.endpoints as settings_api
 from config.config_manager import (
@@ -32,10 +33,10 @@ def add_done_callback(self, cb):
         self.done_callback = cb
 
 
-def _make_config(*, edited: bool = True) -> OpenRAGConfig:
+def _make_config(*, edited: bool = True, openai: OpenAIConfig | None = None) -> OpenRAGConfig:
     return OpenRAGConfig(
         providers=ProvidersConfig(
-            openai=OpenAIConfig(),
+            openai=openai if openai is not None else OpenAIConfig(),
             anthropic=AnthropicConfig(),
             watsonx=WatsonXConfig(),
             ollama=OllamaConfig(),
@@ -67,9 +68,7 @@ def _fake_create_task(coro):
         lambda updated_config: True,
         raising=True,
     )
-    monkeypatch.setattr(
-        settings_api.clients, "refresh_patched_client", _noop_refresh, raising=True
-    )
+    monkeypatch.setattr(settings_api.clients, "refresh_patched_client", _noop_refresh, raising=True)
     monkeypatch.setattr(settings_api.TelemetryClient, "send_event", AsyncMock(), raising=True)
     monkeypatch.setattr(settings_api.asyncio, "create_task", _fake_create_task, raising=True)
     return fake_task
@@ -109,6 +108,35 @@ async def test_update_settings_strips_openai_base_url_whitespace(monkeypatch):
     assert config.providers.openai.base_url == "https://gateway.example.com/v1"
 
 
+@pytest.mark.asyncio
+async def test_remove_openai_config_clears_base_url(monkeypatch):
+    """Regression: removing the OpenAI config used to clear api_key/configured
+    but leave a stale base_url behind. A later re-enable of OpenAI would then
+    silently keep routing through the old (possibly now-invalid) gateway
+    instead of falling back to api.openai.com.
+    """
+    settings_api._background_tasks.clear()
+    config = _make_config(
+        openai=OpenAIConfig(
+            api_key="sk-test", base_url="https://gateway.example.com/v1", configured=True
+        )
+    )
+    # remove_openai_config requires another provider to be configured.
+    config.providers.anthropic.configured = True
+    _patch_update_settings_deps(monkeypatch, config)
+
+    response = await settings_api.update_settings(
+        settings_api.SettingsUpdateBody(remove_openai_config=True, force_remove=True),
+        session_manager=object(),
+        user=None,
+    )
+
+    assert isinstance(response, settings_api.SettingsUpdateResponse)
+    assert config.providers.openai.api_key == ""
+    assert config.providers.openai.configured is False
+    assert config.providers.openai.base_url == ""
+
+
 @pytest.mark.asyncio
 async def test_onboarding_persists_openai_base_url(monkeypatch):
     config = _make_config(edited=False)
@@ -123,9 +151,7 @@ async def _noop_refresh():
         lambda updated_config: True,
         raising=True,
     )
-    monkeypatch.setattr(
-        settings_api.clients, "refresh_patched_client", _noop_refresh, raising=True
-    )
+    monkeypatch.setattr(settings_api.clients, "refresh_patched_client", _noop_refresh, raising=True)
     monkeypatch.setattr(settings_api.TelemetryClient, "send_event", AsyncMock(), raising=True)
     monkeypatch.setattr(settings_api, "wait_for_langflow", AsyncMock(), raising=True)
 
@@ -144,3 +170,19 @@ async def _noop_refresh():
     assert isinstance(response, settings_api.OnboardingResponse)
     assert config.providers.openai.base_url == "https://gateway.example.com/v1"
     assert config.providers.openai.configured is False
+
+
+class TestWhitespaceOnlyBaseUrlRejected:
+    """A whitespace-only openai_base_url must fail validation instead of being
+    silently accepted and later stripped down to an empty string by the
+    endpoint handlers (which would look identical to "not configured" with
+    no error surfaced to the caller).
+    """
+
+    def test_settings_update_body_rejects_whitespace_only_base_url(self):
+        with pytest.raises(ValidationError):
+            settings_api.SettingsUpdateBody(openai_base_url="   ")
+
+    def test_onboarding_body_rejects_whitespace_only_base_url(self):
+        with pytest.raises(ValidationError):
+            settings_api.OnboardingBody(openai_base_url="   ")