From 2bc6144aecfab2de97c5210d14aee85a34565535 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <209825114+claude[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 14:23:54 -0600 Subject: [PATCH] fix(studio): guard unguarded requester.name reads on the OAuth authorize and apps pages (#49267) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit _Requested by **Ali Waseem** ยท [Slack thread](https://supabase.slack.com/archives/C063LNYJJKS/p1787146439389169)_ ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix. ## What is the current behavior? Opening `/authorize` for an OAuth app whose `name` the platform API omitted crashed the entire page with `TypeError: Cannot read properties of undefined (reading 'toLowerCase')` ([SUPABASE-APP-K7E](https://supabase.sentry.io/issues/7679644991/)). The user got a full-page error instead of a consent screen, and could neither authorize nor decline. The same class of crash hit the project-level OAuth apps list ([SUPABASE-APP-JB1](https://supabase.sentry.io/issues/7502074939/)). Typing in the search box called `.toLowerCase()` on `client_name` for every app, so one app registered without a name broke search for the whole list. The project-claim page crashed the same way, reading the first character of the name for the fallback avatar. ## What is the new behavior? The trusted-partner helpers treat a missing name as "no trusted partner matched" and return `null`. The apps filter treats a missing name or client ID as "does not match the search string". The claim page falls back to a placeholder initial instead of indexing into `undefined`. The authorize page now renders normally, minus the optional partner-impersonation caution, which cannot be evaluated without a name. Three changes: - `apps/studio/components/interfaces/Organization/OAuthApps/OAuthApps.utils.ts` โ€” `findTrustedPartnerByName` accepts `string | null | undefined` and returns `null` early on a falsy name; `getOAuthImpersonationWarning`'s `name` param widened to match (its existing `if (!namedPartner) return null` already handles the rest). - `apps/studio/components/interfaces/Auth/OAuthApps/oauthApps.utils.ts` โ€” `filterOAuthApps` optional-chains `client_name` and `client_id` before `.toLowerCase()`, defaulting each match to `false`. - `apps/studio/components/interfaces/Organization/ProjectClaim/confirm.tsx` โ€” `{requester.name?.[0] ?? '?'}` for the fallback avatar initial. Each is a separate commit so any one can be dropped independently. ## Additional context ### Root cause, not fixed here `apps/studio/data/api-authorization/api-authorization-query.ts:37` returns `data as ApiAuthorizationResponse`, an unchecked cast with no runtime validation, even though the openapi-fetch client already types the endpoint from the generated schema. Both the generated `GetOAuthAuthorizationResponse` and the hand-written local type declare `name: string` as required, so this was invisible to TypeScript. The durable fix is to derive the type from the schema and drop the cast, which is the house pattern elsewhere in `apps/studio/data`, and to correct the OpenAPI spec at source if the API can legitimately omit `name`. Left out deliberately to keep this cherry-pickable. ### Not in scope `requester.scopes` is optional in the schema but required in the local type, and is read unguarded in several places. Defaulting it to `[]` would tell a user an app requested no permissions on a live consent screen, so it needs a product decision rather than a drive-by guard. ### Testing No local checks were run. This clone has no `node_modules` and `pnpm install` is blocked in the environment, so `npm run build`, typecheck, lint, Prettier and tests were all left to CI. Please treat CI as the verification for this PR. There is also a coverage gap worth noting: `apps/studio/tests/components/ApiAuthorization.test.tsx:48-62` hardcodes `name: 'Test App'` in `createMockAuthResponse`, and no test omits the field, which is why none of these crashes were caught. --- _Generated by [Claude Code](https://claude.ai/code/session_01P489vrPdHcJfMfzCGM9rZ5)_ --------- Co-authored-by: Claude Co-authored-by: Ali Waseem --- .../interfaces/Auth/OAuthApps/oauthApps.utils.ts | 4 ++-- .../interfaces/Organization/OAuthApps/OAuthApps.utils.ts | 8 ++++++-- .../interfaces/Organization/ProjectClaim/confirm.tsx | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/apps/studio/components/interfaces/Auth/OAuthApps/oauthApps.utils.ts b/apps/studio/components/interfaces/Auth/OAuthApps/oauthApps.utils.ts index f1f6ad52c6e..94d732d0601 100644 --- a/apps/studio/components/interfaces/Auth/OAuthApps/oauthApps.utils.ts +++ b/apps/studio/components/interfaces/Auth/OAuthApps/oauthApps.utils.ts @@ -27,8 +27,8 @@ export function filterOAuthApps({ // Filter by search string if (searchString) { const searchLower = searchString.toLowerCase() - const matchesName = app.client_name.toLowerCase().includes(searchLower) - const matchesClientId = app.client_id.toLowerCase().includes(searchLower) + const matchesName = app.client_name?.toLowerCase().includes(searchLower) ?? false + const matchesClientId = app.client_id?.toLowerCase().includes(searchLower) ?? false if (!matchesName && !matchesClientId) { return false } diff --git a/apps/studio/components/interfaces/Organization/OAuthApps/OAuthApps.utils.ts b/apps/studio/components/interfaces/Organization/OAuthApps/OAuthApps.utils.ts index e8f942cf7a0..13be7546cb2 100644 --- a/apps/studio/components/interfaces/Organization/OAuthApps/OAuthApps.utils.ts +++ b/apps/studio/components/interfaces/Organization/OAuthApps/OAuthApps.utils.ts @@ -86,7 +86,11 @@ export function findTrustedPartnerByRedirectUri( ) } -export function findTrustedPartnerByName(name: string): TrustedOAuthPartner | null { +export function findTrustedPartnerByName( + name: string | null | undefined +): TrustedOAuthPartner | null { + if (!name) return null + const searchable = name.toLowerCase() return ( TRUSTED_OAUTH_PARTNERS.find((partner) => @@ -154,7 +158,7 @@ export function getOAuthImpersonationWarning({ name, redirectUri, }: { - name: string + name: string | null | undefined redirectUri: string | null | undefined }): OAuthImpersonationWarning | null { const namedPartner = findTrustedPartnerByName(name) diff --git a/apps/studio/components/interfaces/Organization/ProjectClaim/confirm.tsx b/apps/studio/components/interfaces/Organization/ProjectClaim/confirm.tsx index c19aa0349c8..fe125a2f998 100644 --- a/apps/studio/components/interfaces/Organization/ProjectClaim/confirm.tsx +++ b/apps/studio/components/interfaces/Organization/ProjectClaim/confirm.tsx @@ -85,7 +85,7 @@ export const ProjectClaimConfirm = ({ }} > {!requester.icon && ( -

{requester.name[0]}

+

{requester.name?.[0] ?? '?'}

)}