Add API key configuration, fix chat context persistence, and isolate sessions by IP

[Copilot]

Adds optional API key configuration to support remote model services (OpenAI, Azure, etc.), fixes chat context persistence so conversations maintain coherent history across interactions, and isolates chat sessions per user IP address to prevent cross-contamination.

Changes

• Configuration: Added optional ApiKey parameter to appsettings.json (defaults to empty string for local Ollama)

• SemanticKernelClient refactor:

  • Moved Kernel and ChatCompletionService initialization from per-request to constructor
  • Moved system prompt to constructor (was being duplicated on every call)
  • Added exchange counter with fatigue response after 10 turns
  • Constructor now accepts optional apiKey parameter with comprehensive validation
  • Added thread-safety with locks for _chatHistory and _exchangeCount
  • Added .ConfigureAwait(false) to async foreach for consistency with codebase

• Session Isolation:

  • Created IChatClientFactory interface and ChatClientFactory implementation
  • Isolated chat sessions per IP address using MemoryCache with 30-minute sliding expiration
  • Each user gets their own SemanticKernelClient instance with isolated chat history and exchange counter
  • Updated dependency injection in Program.cs to register factory instead of singleton client
  • Updated ChatController to use factory and retrieve client by IP address

• Tests: Added comprehensive unit tests (53 total):

  • Parameter validation tests (null checks, URI validation)
  • Factory tests (session isolation, client reuse, thread-safety)
  • Edge case tests for empty/whitespace messages

Usage

For remote models, configure the API key:

{
  "ServiceUrl": "https://api.openai.com/v1",
  "Model": "gpt-4",
  "ApiKey": "sk-..."
}

For local Ollama (existing behavior):

{
  "ServiceUrl": "http://localhost:11434/v1",
  "Model": "neuraldaredevil-abliterated",
  "ApiKey": ""
}

Security

• ✅ Zero security vulnerabilities detected by CodeQL
• ✅ Thread-safe implementation prevents race conditions
• ✅ Session isolation prevents users from accessing each other's chat histories

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Add Model Parameters to Config</issue_title>
<issue_description>Add optional config values for API key/account to the plumbing of SemanticKernelClient.cs to facilitate swapping in remote models when calling Kernel.CreateBuilder().AddOpenAIChatCompletion().
Bonus points for refactoring to support optional persistent chat context (each interaction is a fresh conversation with the chatbot in the current implementation) so the bot is aware of previous interactions in the same session. After 10 exchanges, have the bot say they're sick of talking about and suggest a new topic at random (the weirder the better).</issue_description>

<agent_instructions>Feel free to use some creative license, but use good coding standards, keep comments minimal, and make sure to add unit tests for any new functionality.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes Add Model Parameters to Config #3

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[rrusson]

The work on SemanticKernelClient is brilliant--you even nailed the tone of the chatbot. Just one suggestion. Can we remove global private variables that are only needed in the CTOR?

[Copilot]

The work on SemanticKernelClient is brilliant--you even nailed the tone of the chatbot. Just one suggestion. Can we remove global private variables that are only needed in the CTOR?

Removed the three private variables (_apiUrl, _model, _apiKey) that were only used in the constructor. The constructor parameters are now used directly. Commit 3ee0b22

[Copilot]

Pull request overview

This PR adds API key configuration support to enable remote AI model services (OpenAI, Azure, etc.) and implements chat context persistence so conversations maintain history across interactions. The implementation refactors SemanticKernelClient to initialize the kernel and chat service once in the constructor rather than per-request, and adds an exchange counter that triggers a fatigue response after 10 interactions.

Changes:

• Added optional ApiKey configuration parameter in appsettings.json (defaults to empty string for local Ollama)
• Refactored SemanticKernelClient to move kernel/service initialization and system prompt to constructor, enabling chat history persistence
• Added exchange counter with fatigue response after 10 turns
• Updated dependency injection in Program.cs to pass API key from configuration
• Added 6 unit tests covering constructor variants and edge cases

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
SemanticKernelHelper/SemanticKernelClient.cs	Refactored to move kernel initialization to constructor, added chat history persistence, exchange counter, and API key support
ClippyWeb/appsettings.json	Added optional ApiKey configuration parameter
ClippyWeb/Program.cs	Updated dependency injection to pass API key to SemanticKernelClient
ClippyWeb.Tests/SemanticKernelClientTests.cs	Added unit tests for constructor variants and empty message handling
ClippyWeb.Tests/ClippyWeb.Tests.csproj	Added project reference to SemanticKernelHelper for testing

[rrusson]

Missed a spot with _kernel, but let's get this merged. Great work!

[rrusson]

LGTM

[sonarqubecloud]

Quality Gate passed

Issues
10 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud