fix(api): return clean 404 for malformed tenant_id in namespace resolve

[otavio]

Summary

When a device authenticates with a tenant_id that is not a valid UUID, the Postgres store passed the raw string straight into the uuid-typed namespaces.id column. The query failed with invalid input syntax for type uuid (SQLSTATE 22P02) and logged a misleading SQL error — even though the request still returned 404.

With the previous Mongo store, tenant_id was a plain string field, so a malformed value (e.g. a misconfigured agent sending 83176492-e6cl-..., a letter l instead of digit 1) simply matched nothing and returned a silent 404. This restores that behavior.

Change

NamespaceResolve now validates the value as a UUID (via the existing pkg/uuid.Parse) before issuing the query when resolving by tenant ID, returning store.ErrNoDocuments when invalid. This:

• Restores Mongo parity — a malformed tenant_id is a clean not-found, no error logged.
• Avoids a doomed database round-trip for malformed input.
• Flows up exactly as a normal not-found: the service wraps it via NewErrNamespaceNotFound, which maps to HTTP 404. No service/handler changes needed.

The targeted per-resolver validation was chosen over a blanket SQLSTATE 22P02 → not-found mapping in fromSQLError, to avoid masking genuine type-mismatch bugs elsewhere.

Tests

Added a returns ErrNoDocuments for malformed tenant ID subtest to the shared TestNamespaceResolve suite, which runs against both Mongo and Postgres backends to verify parity. The Postgres suite passes locally (the Mongo run requires testcontainers networking unavailable in my local dev setup, but the Mongo path needs no code change — a non-matching string already returns ErrNoDocuments).

Notes

A related latent issue exists at sibling call sites that filter on the same uuid-typed namespace_id via the shared InNamespace query option (DeviceResolve, APIKeyResolve, PublicKeyResolve, SessionResolve). That's out of scope for this issue and could be a follow-up.

Fixes: #6404

[github-actions]

Claude finished @otavio's task in 5m 36s —— View job

---

Code Review Complete

Reviewed 2 files across code quality, security, testing, Go patterns, and architecture — no issues found. The code looks good as-is.

Review highlights:

• UUID validation guard is correctly scoped to NamespaceTenantIDResolver only, using the project's existing pkg/uuid.Parse wrapper
• store.ErrNoDocuments is the correct sentinel — consistent with every other not-found path in the store layer
• The query was already parameterized (bun placeholder binding), so no injection risk existed; the fix prevents a misleading SQLSTATE 22P02 error
• Test is placed in the shared storetest suite, validating both Mongo and Postgres backends
• Cloud store inherits the fix automatically via its s.Store.NamespaceResolve() delegation — no cross-repo impact

---

To request another review round, comment /review.