Skip to content

fix(oauth): Prevent validation errors from orphaned client tokens#20072

Open
vpomerleau wants to merge 1 commit intomainfrom
FXA-13132
Open

fix(oauth): Prevent validation errors from orphaned client tokens#20072
vpomerleau wants to merge 1 commit intomainfrom
FXA-13132

Conversation

@vpomerleau
Copy link
Copy Markdown
Contributor

@vpomerleau vpomerleau commented Feb 17, 2026

Because

  • Sentry showed ValidationError: "[0].name" is required
  • OAuth token queries use LEFT OUTER JOIN with clients table
  • When a client is deleted but tokens remain (orphaned), the JOIN returns NULL
  • This may be converted to undefined, which fails Joi validation

This pull request

  • Add nullish coalescing in factories.ts when merging OAuth client names
  • Fix shared reference bug in getDefaultClientFields() to return copy of defaults
  • Add regression test for undefined client_name handling

Issue that this pull request solves

Closes: FXA-13132

Checklist

Put an x in the boxes that apply

  • My commit is GPG signed.
  • If applicable, I have modified or added tests which pass locally.
  • I have added necessary documentation (if appropriate).
  • I have verified that my changes render correctly in RTL (if appropriate).

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Any other information that is important to this pull request.

@vpomerleau vpomerleau marked this pull request as ready for review February 18, 2026 23:15
@vpomerleau vpomerleau requested a review from a team as a code owner February 18, 2026 23:15
@vpomerleau vpomerleau requested review from Copilot April 9, 2026 17:54
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses Joi validation failures in connected-services responses when OAuth client tokens become orphaned and client_name comes back as undefined from a left join, by normalizing the display name and adding a regression test.

Changes:

  • Coerce oauthClient.client_name to null (instead of propagating undefined) when populating AttachedClient.name.
  • Return a copy from getDefaultClientFields() to avoid sharing the defaults object.
  • Add a regression test covering undefined client_name handling.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
packages/fxa-shared/connected-services/factories.ts Normalizes missing OAuth client names to null; returns cloned defaults for client field initialization.
packages/fxa-shared/test/connected-services/factories.ts Adds regression test ensuring undefined client_name is coerced to null.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…nt tokens

Because:

* Sentry showed ValidationError: "[0].name" is required
* OAuth token queries use LEFT OUTER JOIN with clients table
* When a client is deleted but tokens remain (orphaned), the JOIN returns NULL
* This may be converted to undefined, which fails Joi validation

This commit:

* Add nullish coalescing in factories.ts when merging OAuth and device client names; Joi validation explicitily allows null
* Fix shared reference bug in getDefaultClientFields() to return copy of defaults
* Add regression test for undefined client_name and device name handling

Closes #FXA-13132
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants