perf(api): cache Fernet instance in _get_fernet()

[shafeeq27edu-ai]

Description

This PR fixes a performance issue in the vault encryption utility. _get_fernet() was recreating the Fernet instance on every encrypt()/decrypt() call by recomputing SHA-256 and base64-encoding the key material each time. Under load (vault operations, secret reads on every request), this is unnecessary overhead.

Summary

What changed? Added @lru_cache(maxsize=1) to _get_fernet() in api/oss/src/utils/crypting.py.

Why was this change needed? Every call to encrypt() or decrypt() triggered _get_fernet(), which re-derived the Fernet key from AGENTA_CRYPT_KEY via SHA-256 + base64 on every invocation.

What problem does it solve? Eliminates redundant cryptographic key derivation under load. The Fernet instance is now created once and reused for the lifetime of the process.

How the change addresses the root cause: lru_cache(maxsize=1) caches the single Fernet instance. Since the crypt key is static per deployment, there is no benefit to recreating the instance on every call.

Testing

Verified locally

• Ran ruff check api/oss/src/utils/crypting.py — passes with no errors
• Ran ruff format api/oss/src/utils/crypting.py — no changes needed
• Verified _get_fernet() still raises ValueError when AGENTA_CRYPT_KEY is missing

Added or updated tests

N/A — This is a performance optimization with no behavior change. Existing vault/encryption tests cover the functional path.

QA follow-up

N/A — The fix is self-contained and verified by static analysis.

Demo

BEFORE FIX :

AFTER FIX 👍 :

Checklist

• I have included a video or screen recording for UI changes, or marked Demo as N/A
• Relevant tests pass locally
• Relevant linting and formatting pass locally
• I have signed the CLA, or I will sign it when the bot prompts me

[vercel]

@shafeeq27edu-ai is attempting to deploy a commit to the agenta projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: e27db512-a168-46b2-ae07-27554d686509

📥 Commits

Reviewing files that changed from the base of the PR and between 753af38 and d821759.

📒 Files selected for processing (1)

• api/oss/src/utils/crypting.py

Included review availability: Your plan provides up to 8 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Performance Improvements
  • Improved encryption-related performance by reusing the derived security component across repeated operations.

Walkthrough

The crypting utility imports lru_cache and caches one derived Fernet instance in _get_fernet.

Changes

Crypting Cache

Layer / File(s)	Summary
Fernet instance caching api/oss/src/utils/crypting.py	_get_fernet now reuses one cached Fernet instance instead of recreating it on each call.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: 🟡 Moderate · up to d8217

The change reuses one Fernet instance per process, but a runtime encryption-key change could leave that process using stale key material and unable to interoperate with processes using the new key. Required API validation checks are also not recorded as completed, so merge should wait for key-lifetime confirmation and those checks.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 60.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: caching the Fernet instance for performance.
Description check	✅ Passed	The description directly explains the caching change, its performance purpose, testing, and unchanged validation behavior.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}