Description

Reject fuzzing/injection payloads on model, App Attest key_id_b64, and Play Integrity integrity_token before they cost a DB round trip or an external API call.

We were seeing scanner traffic (SQLi, XSS, code injection) landing in these free-text fields. None of it can actually do anything to this stack, but it still triggers a DB query or an external call (LiteLLM, Google Play Integrity) before getting rejected downstream.

Added plain charset + length checks, no whitelist to maintain:

• model: lowercase ascii + digits + .-, max 64 chars, checked in authorize_chat_request before any auth/DB/LiteLLM work
• key_id_b64 (App Attest challenge): base64 charset, max 128 chars, checked before the DB lookup
• integrity_token (Play Integrity): JWT-like charset (-_. + alnum), max 10000 chars, checked before the Google API call

All garbage still gets a 400, just without the round trip.

QA

Unit tests table-driven over real model names / real-shaped tokens (should pass) and the sampled attack payloads (should reject), plus edge cases (empty, over length, bad edge chars). Integration tests confirm the downstream call (_decode_integrity_token, env.valid_service_type_for_model, fxa_auth) is never reached for rejected input, not just that the response is a 400.