From 6f1a7ddadd17c3a5ae0391ae58a9a3d68dc842db Mon Sep 17 00:00:00 2001
From: Hiep Le <69354317+hieptl@users.noreply.github.com>
Date: Tue, 3 Mar 2026 20:54:10 +0700
Subject: [PATCH] fix(backend): resolve timezone mismatch in validate_api_key
 causing database error (#13158)

---
 enterprise/storage/api_key_store.py         |  2 +-
 enterprise/tests/unit/test_api_key_store.py | 35 +++++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/enterprise/storage/api_key_store.py b/enterprise/storage/api_key_store.py
index e22229a5ab..3af7424e65 100644
--- a/enterprise/storage/api_key_store.py
+++ b/enterprise/storage/api_key_store.py
@@ -79,7 +79,7 @@ class ApiKeyStore:
             await session.execute(
                 update(ApiKey)
                 .where(ApiKey.id == key_record.id)
-                .values(last_used_at=now)
+                .values(last_used_at=now.replace(tzinfo=None))
             )
             await session.commit()
 
diff --git a/enterprise/tests/unit/test_api_key_store.py b/enterprise/tests/unit/test_api_key_store.py
index 68b9dce26e..fb163f978a 100644
--- a/enterprise/tests/unit/test_api_key_store.py
+++ b/enterprise/tests/unit/test_api_key_store.py
@@ -211,6 +211,41 @@ async def test_validate_api_key_not_found(api_key_store, async_session_maker):
     assert result is None
 
 
+@pytest.mark.asyncio
+async def test_validate_api_key_stores_timezone_naive_last_used_at(
+    api_key_store, async_session_maker
+):
+    """Test that validate_api_key stores a timezone-naive datetime for last_used_at."""
+    # Arrange
+    user_id = str(uuid.uuid4())
+    org_id = uuid.uuid4()
+    api_key_value = 'test-timezone-naive-key'
+
+    async with async_session_maker() as session:
+        key_record = ApiKey(
+            key=api_key_value,
+            user_id=user_id,
+            org_id=org_id,
+            name='Test Key',
+            last_used_at=None,
+        )
+        session.add(key_record)
+        await session.commit()
+
+    # Act
+    with patch('storage.api_key_store.a_session_maker', async_session_maker):
+        await api_key_store.validate_api_key(api_key_value)
+
+    # Assert
+    async with async_session_maker() as session:
+        result_db = await session.execute(
+            select(ApiKey).filter(ApiKey.key == api_key_value)
+        )
+        api_key = result_db.scalars().first()
+        assert api_key.last_used_at is not None
+        assert api_key.last_used_at.tzinfo is None
+
+
 @pytest.mark.asyncio
 async def test_delete_api_key(api_key_store, async_session_maker):
     """Test deleting an API key."""