Skip to content

Fix: guard rewriteConfiguration against non-array and nullish config values#7131

Draft
lizkenyon wants to merge 6 commits intomainfrom
03-30-fix_guard_rewriteconfiguration_against_non-array_and_nullish_config_values
Draft

Fix: guard rewriteConfiguration against non-array and nullish config values#7131
lizkenyon wants to merge 6 commits intomainfrom
03-30-fix_guard_rewriteconfiguration_against_non-array_and_nullish_config_values

Conversation

@lizkenyon
Copy link
Copy Markdown
Contributor

@lizkenyon lizkenyon commented Mar 30, 2026

Summary

Fixes shop/issues#8553config2.map is not a function

  • Add null/undefined guard at the top of rewriteConfiguration to short-circuit when config value is missing
  • Add Array.isArray guard in the ZodArray branch before calling .map()
  • Add tests covering undefined, null, and non-array config values against array/object schemas

Root Cause

When loadOpaqueApp (introduced in #6751) can't Zod-validate a local TOML config (e.g., a third-party template without client_id), it falls back to raw, unvalidated TOML data. This raw data is deep-merged with the remote config and passed to writeAppConfigurationFile, where rewriteConfiguration walks the Zod schema and assumes the config values match schema types. The ZodArray branch calls .map() on the config value without checking if it's actually an array, crashing on null, undefined, or type-mismatched values from the unvalidated data.

Triggered by app dev --reset (or any link flow) on apps using third-party templates.

Why this fix

rewriteConfiguration's job is to reorder config keys to match schema structure — not to validate data. It should handle whatever data it receives gracefully, which is consistent with how it already passes through unknown schema types at the end of the function (return config). The loadOpaqueApp raw TOML fallback is a legitimate feature for supporting third-party templates with config keys the CLI doesn't understand, so the defensive guard is the right layer for this fix.

Test plan

  • New unit tests for rewriteConfiguration covering null, undefined, and non-array config values
  • Verify existing writeAppConfigurationFile tests still pass
  • Manual: shopify app init with a template that lacks client_id, then shopify app dev --reset — should no longer crash

🤖 Generated with Claude Code

Copy link
Copy Markdown
Contributor Author

This stack of pull requests is managed by Graphite. Learn more about stacking.

…values

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@lizkenyon lizkenyon force-pushed the 03-30-fix_guard_rewriteconfiguration_against_non-array_and_nullish_config_values branch from d5d7a44 to 6f517d7 Compare March 30, 2026 21:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant