fix(api): return clean 404 for malformed namespace ID in InNamespace filter

[otavio]

Summary

Follow-up to #6404 / #6405. The InNamespace query option filters on the uuid-typed namespace_id column with a raw, externally-supplied string. A malformed (non-UUID) value reached Postgres and failed with invalid input syntax for type uuid (SQLSTATE 22P02), logging a misleading SQL error — even though the result is effectively not-found. Same root cause as #6404, different code path.

Change

InNamespace now validates the value as a UUID (via the existing pkg/uuid.Parse) and returns store.ErrNoDocuments before appending the filter, so no doomed query is issued. This covers every resolver that scopes by namespace through this option:

• DeviceResolve (on the device-auth path)
• APIKeyResolve
• PublicKeyResolve
• SessionResolve

applyOptions already routes option errors through fromSQLError, which passes store.ErrNoDocuments through unchanged, so the not-found surfaces cleanly without a logged SQL error — no changes needed in utils.go.

Tests

Added a fails with malformed (non-UUID) namespace ID subtest to the shared TestAPIKeyResolve suite, which runs against both Mongo and Postgres backends to verify parity (on Mongo a non-matching string already yields ErrNoDocuments). The full Postgres store suite passes locally.

Fixes: #6406

[github-actions]

Claude finished @otavio's task in 4m 2s —— View job

---

Code Review Complete

Reviewed 2 files across code quality, security, testing, Go patterns, and architecture (including cross-repo impact on cloud/) — no issues found. The code looks good as-is.

Key observations:

• The UUID validation guard in InNamespace correctly returns store.ErrNoDocuments before issuing a doomed query, and the error passes cleanly through fromSQLError (default case) unchanged.
• The QueryOptions interface contract is preserved — no signature or behavioral breaking changes for cloud/ consumers.
• The shared-suite test exercises the observable contract (ErrNoDocuments for malformed namespace IDs) on both Mongo and Postgres backends. On Postgres, reverting the fix would cause the test to fail (raw SQLSTATE 22P02 ≠ ErrNoDocuments), so the coverage is meaningful.
• The change is security-positive: it prevents Postgres type-error messages from propagating and leaking column type information.

To request another review round, comment /review.