From 1bb2b8b0a239fce3afe841fc7829d96f415a162f Mon Sep 17 00:00:00 2001 From: lorentz Date: Sat, 11 Jul 2026 07:22:59 -0400 Subject: [PATCH] fix(12): WR-03 validate PAX8 token response shape in Pax8Client.getToken() --- lib/services/pax8-client.ts | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/lib/services/pax8-client.ts b/lib/services/pax8-client.ts index a796206..0885f0d 100644 --- a/lib/services/pax8-client.ts +++ b/lib/services/pax8-client.ts @@ -51,9 +51,16 @@ export class Pax8Client { } const data = await res.json(); + // WR-03: a 200 response with an unexpected body shape (proxy/CDN error + // page reshaped as JSON, a future API version renaming the field, etc.) + // must not silently set accessToken to undefined and mask the failure + // behind a confusing 401 from the data endpoint later. + if (!data.access_token || typeof data.expires_in !== 'number') { + throw new Error('PAX8 token response missing access_token/expires_in'); + } this.accessToken = data.access_token; this.tokenExpiry = Date.now() + data.expires_in * 1000; - return this.accessToken!; + return this.accessToken; } // Phase 11/12 will extend this with 429-aware Retry-After backoff for the