mirror of
https://github.com/supabase/supabase.git
synced 2026-10-06 09:55:06 +03:00
<!-- ccr-slack-attribution --> _Requested by **Ali Waseem** · [Slack thread](https://supabase.slack.com/archives/C063LNYJJKS/p1787146439389169)_ ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix. ## What is the current behavior? Opening `/authorize` for an OAuth app whose `name` the platform API omitted crashed the entire page with `TypeError: Cannot read properties of undefined (reading 'toLowerCase')` ([SUPABASE-APP-K7E](https://supabase.sentry.io/issues/7679644991/)). The user got a full-page error instead of a consent screen, and could neither authorize nor decline. The same class of crash hit the project-level OAuth apps list ([SUPABASE-APP-JB1](https://supabase.sentry.io/issues/7502074939/)). Typing in the search box called `.toLowerCase()` on `client_name` for every app, so one app registered without a name broke search for the whole list. The project-claim page crashed the same way, reading the first character of the name for the fallback avatar. ## What is the new behavior? The trusted-partner helpers treat a missing name as "no trusted partner matched" and return `null`. The apps filter treats a missing name or client ID as "does not match the search string". The claim page falls back to a placeholder initial instead of indexing into `undefined`. The authorize page now renders normally, minus the optional partner-impersonation caution, which cannot be evaluated without a name. Three changes: - `apps/studio/components/interfaces/Organization/OAuthApps/OAuthApps.utils.ts` — `findTrustedPartnerByName` accepts `string | null | undefined` and returns `null` early on a falsy name; `getOAuthImpersonationWarning`'s `name` param widened to match (its existing `if (!namedPartner) return null` already handles the rest). - `apps/studio/components/interfaces/Auth/OAuthApps/oauthApps.utils.ts` — `filterOAuthApps` optional-chains `client_name` and `client_id` before `.toLowerCase()`, defaulting each match to `false`. - `apps/studio/components/interfaces/Organization/ProjectClaim/confirm.tsx` — `{requester.name?.[0] ?? '?'}` for the fallback avatar initial. Each is a separate commit so any one can be dropped independently. ## Additional context ### Root cause, not fixed here `apps/studio/data/api-authorization/api-authorization-query.ts:37` returns `data as ApiAuthorizationResponse`, an unchecked cast with no runtime validation, even though the openapi-fetch client already types the endpoint from the generated schema. Both the generated `GetOAuthAuthorizationResponse` and the hand-written local type declare `name: string` as required, so this was invisible to TypeScript. The durable fix is to derive the type from the schema and drop the cast, which is the house pattern elsewhere in `apps/studio/data`, and to correct the OpenAPI spec at source if the API can legitimately omit `name`. Left out deliberately to keep this cherry-pickable. ### Not in scope `requester.scopes` is optional in the schema but required in the local type, and is read unguarded in several places. Defaulting it to `[]` would tell a user an app requested no permissions on a live consent screen, so it needs a product decision rather than a drive-by guard. ### Testing No local checks were run. This clone has no `node_modules` and `pnpm install` is blocked in the environment, so `npm run build`, typecheck, lint, Prettier and tests were all left to CI. Please treat CI as the verification for this PR. There is also a coverage gap worth noting: `apps/studio/tests/components/ApiAuthorization.test.tsx:48-62` hardcodes `name: 'Test App'` in `createMockAuthResponse`, and no test omits the field, which is why none of these crashes were caught. --- _Generated by [Claude Code](https://claude.ai/code/session_01P489vrPdHcJfMfzCGM9rZ5)_ --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Ali Waseem <waseema393@gmail.com>
54 lines
1.3 KiB
TypeScript
54 lines
1.3 KiB
TypeScript
import type { OAuthClient } from '@supabase/supabase-js'
|
|
|
|
export const OAUTH_APP_REGISTRATION_TYPE_OPTIONS = [
|
|
{ name: 'Manual', value: 'manual' },
|
|
{ name: 'Dynamic', value: 'dynamic' },
|
|
]
|
|
|
|
export const OAUTH_APP_CLIENT_TYPE_OPTIONS = [
|
|
{ name: 'Public', value: 'public' },
|
|
{ name: 'Confidential', value: 'confidential' },
|
|
]
|
|
|
|
interface FilterOAuthAppsParams {
|
|
apps: OAuthClient[]
|
|
searchString?: string
|
|
registrationTypes?: string[]
|
|
clientTypes?: string[]
|
|
}
|
|
|
|
export function filterOAuthApps({
|
|
apps,
|
|
searchString,
|
|
registrationTypes = [],
|
|
clientTypes = [],
|
|
}: FilterOAuthAppsParams): OAuthClient[] {
|
|
return apps.filter((app) => {
|
|
// Filter by search string
|
|
if (searchString) {
|
|
const searchLower = searchString.toLowerCase()
|
|
const matchesName = app.client_name?.toLowerCase().includes(searchLower) ?? false
|
|
const matchesClientId = app.client_id?.toLowerCase().includes(searchLower) ?? false
|
|
if (!matchesName && !matchesClientId) {
|
|
return false
|
|
}
|
|
}
|
|
|
|
// Filter by registration type
|
|
if (registrationTypes.length > 0) {
|
|
if (!registrationTypes.includes(app.registration_type)) {
|
|
return false
|
|
}
|
|
}
|
|
|
|
// Filter by client type
|
|
if (clientTypes.length > 0) {
|
|
if (!clientTypes.includes(app.client_type)) {
|
|
return false
|
|
}
|
|
}
|
|
|
|
return true
|
|
})
|
|
}
|