fix(app-shell): unwrap the {success,data} envelope in apiHandler so resultDialog fields resolve#2396
Merged
Merged
Conversation
…esultDialog fields resolve
apiHandler's absolute-URL branch returned the whole `{ success, data }` response
body as `result.data`, while flowHandler and serverActionHandler both unwrap
`json.data`. Action `resultDialog` field paths (`user.email`, `temporaryPassword`,
`client.client_id`, `totpURI`, …) are written relative to the inner `data`, so
leaking the envelope made ActionResultDialog's readPath resolve to undefined and
blanked every reveal dialog. Most visibly "Create User": the one-shot temporary
password rendered empty, so the freshly created user could never sign in.
Unwrap the envelope (guarded so bare, non-enveloped better-auth bodies pass
through unchanged), aligning apiHandler with its two sibling handlers and the
documented "path into `data`" contract. Fixes create_user, set_user_password,
enable_two_factor and create_oauth_application reveal dialogs at once.
Companion: objectstack-ai/framework drops the now-redundant `data.` prefix from
sys_sso_provider's resultDialog paths (the lone spec that compensated for this
bug) — the two must ship together.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
❌ Console Performance Budget
📦 Bundle Size Report
Size Limits
|
Contributor
✅ Console Performance Budget
📦 Bundle Size Report
Size Limits
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Creating a user via Setup → Users → Create User (
sys_usercreate_useraction) succeeds on the backend (POST /api/v1/auth/admin/create-user→ 200) but the "User Created" reveal dialog shows an empty Email and empty Temporary Password. The admin never sees the one-shot temporary password, so the freshly created user can't sign in — the feature is effectively broken.Root cause
useConsoleActionRuntimeregisters three action handlers.flowHandlerandserverActionHandlerboth unwrap the ObjectStack{ success, data }envelope (json.data), butapiHandler's absolute-URL branch returned the whole envelope asresult.data.Every action
resultDialogfieldpath(user.email,temporaryPassword,client.client_id,totpURI, …) is written relative to the innerdata. Leaking the envelope makesActionResultDialog'sreadPath(envelope, 'user.email')resolve toundefined; thesecret/textrenderers then degrade to an empty<pre>— blank fields.Change
Unwrap the envelope in
apiHandler, guarded so bare, non-enveloped better-auth bodies pass through unchanged:This aligns
apiHandlerwith its two sibling handlers and the documented "a dotpathintodata" contract. Fixes not justcreate_userbut alsoset_user_password,enable_two_factorandcreate_oauth_applicationreveal dialogs, which had the same latent bug.Companion / release-coupling
sys_sso_providerwas the only spec that compensated for this bug with adata.prefix; it's fixed in objectstack-ai/objectstack#2842. The two must ship together — only the niche opt-in SSO domain-verification dialog is affected in any transition window.Tests
useConsoleActionRuntime.test.tsx→ 24/24 pass (new:apiHandlerunwraps the envelope; existing: bare responses pass through unchanged).ActionRunner.resultDialog.test.ts→ 11/11 pass.:3000backend): "Create User" now renderstestuser3@example.com+ the masked temporary password (reveal/copy work). DOM read:codeBlocks: ["testuser3@example.com", "••••…"], preBlocks: [].🤖 Generated with Claude Code