feat(api-key)!: use generic message for invalid API keys

src/Middlewares/ApiKeyMiddleware.cs

@@ -23,24 +23,24 @@ public async Task InvokeAsync(HttpContext context)
 
         if (!context.Request.Headers.TryGetValue("X-Api-Key", out var providedKey))
         {
-            await Unauthorized(context, "Missing API Key.");
+            await Unauthorized(context);
             return;
         }
 
         var providedKeyBytes = Encoding.UTF8.GetBytes(providedKey.ToString());
 
         if (!CryptographicOperations.FixedTimeEquals(_apiKeyBytes, providedKeyBytes))
         {
-            await Unauthorized(context, "Invalid API Key.");
+            await Unauthorized(context);
             return;
         }
 
         await next(context);
     }
 
-    private static async Task Unauthorized(HttpContext context, string message)
+    private static async Task Unauthorized(HttpContext context)
     {
-        Result result = Result.Unauthorized(message);
+        Result result = Result.Unauthorized("Invalid API Key.");
         context.Response.StatusCode = StatusCodes.Status401Unauthorized;
         await context.Response.WriteAsJsonAsync(result);
     }

tests/Middlewares/ApiKeyMiddlewareTests.cs

@@ -14,7 +14,7 @@ public async Task Post_WhenCreatingTesterWithoutApiKey_ShouldReturnUnauthorized(
         // Arrange
         var client = ApplicationFactory.CreateClient();
         var request = new CreateTesterRequest(Name: "Tester1");
-        var expectedMessage = "Missing API Key.";
+        var expectedMessage = "Invalid API Key.";
 
         // Act
         var response = await client.PostAsJsonAsync("/api/testers", request);