Address channel connection review comments

backend/tests/test_channel_connections_repository.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import logging
 from datetime import UTC, datetime, timedelta
 
 import pytest
@@ -122,6 +123,26 @@ class TestChannelConnectionRepository:
         assert credentials["expires_at"] == expires_at
         assert credentials["extra"] == {"bot_user_id": "B123"}
 
+    @pytest.mark.anyio
+    async def test_get_credentials_returns_none_when_decryption_fails(self, repo, caplog):
+        connection = await repo.upsert_connection(
+            owner_user_id="alice",
+            provider="slack",
+            external_account_id="U-alice",
+            workspace_id="T1",
+        )
+        await repo.store_credentials(connection["id"], access_token="xoxb-secret-access-token")
+        wrong_key_repo = ChannelConnectionRepository(
+            repo.session_factory,
+            cipher=ChannelCredentialCipher.from_key("wrong-encryption-key"),
+        )
+
+        with caplog.at_level(logging.WARNING, logger="deerflow.persistence.channel_connections.sql"):
+            credentials = await wrong_key_repo.get_credentials(connection["id"])
+
+        assert credentials is None
+        assert any("Unable to decrypt channel connection credentials" in record.message for record in caplog.records)
+
     @pytest.mark.anyio
     async def test_conversations_are_scoped_by_connection(self, repo):
         alice = await repo.upsert_connection(

backend/tests/test_channel_connections_router.py

@@ -188,6 +188,20 @@ def test_get_providers_uses_existing_channels_config(tmp_path):
     anyio.run(repo.close)
 
 
+def test_get_providers_degrades_when_persistence_is_unavailable(monkeypatch):
+    monkeypatch.setattr(channel_connections, "get_session_factory", lambda: None)
+    app = _make_app(_enabled_connections_config(), None, _channels_config())
+
+    with TestClient(app) as client:
+        response = client.get("/api/channels/providers")
+
+    assert response.status_code == 200
+    by_provider = {item["provider"]: item for item in response.json()["providers"]}
+    assert by_provider["slack"]["configured"] is True
+    assert by_provider["slack"]["connectable"] is True
+    assert by_provider["slack"]["connection_status"] == "connected"
+
+
 def test_get_providers_reports_unconfigured_when_runtime_channel_is_missing(tmp_path):
     import anyio
 

backend/tests/test_gateway_services.py

@@ -48,6 +48,12 @@ def test_format_sse_no_event_id():
     assert "id:" not in frame
 
 
+def test_sanitize_log_param_strips_control_characters():
+    from app.gateway.utils import sanitize_log_param
+
+    assert sanitize_log_param("thread\nid\rwith\x00controls") == "threadidwithcontrols"
+
+
 def test_normalize_stream_modes_none():
     from app.gateway.services import normalize_stream_modes