Merge pull request #812 from Sun1090/fix/oauth-excluded-null-payload

🐛 fix(web): preserve explicit null oauth excluded wrappers

Author: seakee

apps/web/src/services/api/authFiles.test.ts

@@ -42,6 +42,62 @@ beforeEach(() => {
   mocks.delete.mockReset();
 });
 
+describe('authFilesApi OAuth excluded model normalization', () => {
+  it.each([
+    { 'oauth-excluded-models': null },
+    { 'oauth-excluded-models': {} },
+    { items: null },
+    { items: {} },
+    {},
+    null,
+  ])('returns an empty map for %j', async (payload) => {
+    mocks.get.mockResolvedValue(payload);
+
+    await expect(authFilesApi.getOauthExcludedModels()).resolves.toEqual({});
+    expect(mocks.get).toHaveBeenCalledWith('/oauth-excluded-models');
+  });
+
+  it.each([
+    { 'oauth-excluded-models': { ' Codex ': [' model-a ', 'MODEL-A', 'model-b'] } },
+    { items: { ' Codex ': [' model-a ', 'MODEL-A', 'model-b'] } },
+    { ' Codex ': [' model-a ', 'MODEL-A', 'model-b'] },
+    { codex: ' model-a, MODEL-A\nmodel-b ' },
+  ])('preserves supported response formats and normalization for %j', async (payload) => {
+    mocks.get.mockResolvedValue(payload);
+
+    await expect(authFilesApi.getOauthExcludedModels()).resolves.toEqual({
+      codex: ['model-a', 'model-b'],
+    });
+  });
+
+  it('does not fall through an explicit null wrapper to items or provider keys', async () => {
+    mocks.get.mockResolvedValue({
+      'oauth-excluded-models': null,
+      items: { codex: ['model-a'] },
+      codex: ['model-b'],
+    });
+
+    await expect(authFilesApi.getOauthExcludedModels()).resolves.toEqual({});
+  });
+
+  it('does not fall through an explicit null items wrapper to provider keys', async () => {
+    mocks.get.mockResolvedValue({ items: null, codex: ['model-a'] });
+
+    await expect(authFilesApi.getOauthExcludedModels()).resolves.toEqual({});
+  });
+
+  it('prefers the canonical wrapper over items', async () => {
+    mocks.get.mockResolvedValue({
+      'oauth-excluded-models': { codex: ['model-a'] },
+      items: { codex: ['model-b'] },
+    });
+
+    await expect(authFilesApi.getOauthExcludedModels()).resolves.toEqual({
+      codex: ['model-a'],
+    });
+  });
+});
+
 describe('authFilesApi OAuth model alias normalization', () => {
   it('preserves display-name and force-mapping returned by CPA', async () => {
     mocks.get.mockResolvedValue({

apps/web/src/services/api/authFiles.ts

@@ -962,7 +962,12 @@ const normalizeOauthExcludedModels = (payload: unknown): Record<string, string[]
   if (!payload || typeof payload !== 'object') return {};
 
   const record = payload as Record<string, unknown>;
-  const source = record['oauth-excluded-models'] ?? record.items ?? payload;
+  // An explicit null wrapper means no exclusions, not a bare provider map.
+  const source = Object.prototype.hasOwnProperty.call(record, 'oauth-excluded-models')
+    ? record['oauth-excluded-models']
+    : Object.prototype.hasOwnProperty.call(record, 'items')
+      ? record.items
+      : payload;
   if (!source || typeof source !== 'object') return {};
 
   const result: Record<string, string[]> = {};

apps/web/src/services/api/transformers.test.ts

@@ -104,3 +104,43 @@ describe('normalizeConfigResponse Claude fingerprint profile', () => {
     expect(config.claudeApiKeys?.[0]).not.toHaveProperty('fingerprintProfile');
   });
 });
+
+describe('normalizeConfigResponse OAuth excluded models', () => {
+  it.each([{}, { 'oauth-excluded-models': null }])(
+    'leaves missing or null config fields unset: %j',
+    (raw) => {
+      expect(normalizeConfigResponse(raw).oauthExcludedModels).toBeUndefined();
+    }
+  );
+
+  it.each([
+    { 'oauth-excluded-models': null },
+    { items: null },
+    { 'oauth-excluded-models': null, items: { codex: ['model-a'] } },
+    { items: null, codex: ['model-a'] },
+  ])('does not interpret an empty wrapper as a provider: %j', (payload) => {
+    const config = normalizeConfigResponse({ 'oauth-excluded-models': payload });
+
+    expect(config.oauthExcludedModels).toBeUndefined();
+  });
+
+  it.each([{}, { 'oauth-excluded-models': {} }, { items: {} }])(
+    'preserves empty maps: %j',
+    (payload) => {
+      expect(
+        normalizeConfigResponse({ 'oauth-excluded-models': payload }).oauthExcludedModels
+      ).toEqual({});
+    }
+  );
+
+  it.each([
+    { codex: ['model-a'] },
+    { 'oauth-excluded-models': { codex: ['model-a'] } },
+    { items: { codex: ['model-a'] } },
+    { 'oauth-excluded-models': { codex: ['model-a'] }, items: { codex: ['model-b'] } },
+  ])('preserves supported maps and wrapper precedence: %j', (payload) => {
+    expect(
+      normalizeConfigResponse({ 'oauth-excluded-models': payload }).oauthExcludedModels
+    ).toEqual({ codex: ['model-a'] });
+  });
+});

apps/web/src/services/api/transformers.ts

@@ -379,7 +379,12 @@ const normalizeOpenAIProvider = (provider: unknown): OpenAIProviderConfig | null
 
 const normalizeOauthExcluded = (payload: unknown): Record<string, string[]> | undefined => {
   if (!isRecord(payload)) return undefined;
-  const source = payload['oauth-excluded-models'] ?? payload.items ?? payload;
+  // An explicit null wrapper means no exclusions, not a bare provider map.
+  const source = Object.prototype.hasOwnProperty.call(payload, 'oauth-excluded-models')
+    ? payload['oauth-excluded-models']
+    : Object.prototype.hasOwnProperty.call(payload, 'items')
+      ? payload.items
+      : payload;
   if (!isRecord(source)) return undefined;
   const map: Record<string, string[]> = {};
   Object.entries(source).forEach(([provider, models]) => {