PR Custody

fix(apollo): trim edge whitespace on auth-config credential values

@sohambasu963draftchecks n/achecks…fix/trim-auth-config-credentials → master2 files · +64 −1updated 9h ago

▸Description

Why

Customers paste OAuth credentials from provider dashboards with stray edge whitespace, and we store them verbatim. The OAuth URL builder then URL-encodes the space into the authorization request and the provider rejects it at the consent page with an opaque error.

Live production evidence (Datadog, 2026-06-12): TikTok authorization URLs going out with client_key=+sbawggvixego0nq6wv, client_key=+awr58rza2lvcgiey, client_key=+awnj2m771kki7j65 — the leading + is a URL-encoded space, from three different stored credentials in one day. TikTok rejects these before the consent page.

Plain: TikTok auth failure · DigitalOcean invalid client_id (same class)
The triage KB already tells support to ask customers to check for "leading/trailing spaces" on Shopify secrets — this fixes the class at the source.

What

trimCredentialEdgeWhitespace() applied at validateRequiredFieldsAndPopulateOptionalFields — the shared chokepoint all four auth-config create/update call sites flow through. String values get .trim(); arrays/booleans/numbers and interior whitespace untouched.

Scope notes for review

Existing stored credentials are not fixed — only new creates/updates. If we want to heal existing configs, options: (a) one-off backfill trimming stored credential strings, or (b) defensive trim at OAuth-URL build time. Happy to follow up with either.
Is there any provider whose secret can legitimately have edge whitespace? I couldn't find one; flagging for review anyway.

Tests

validateAuthConfig.unit.test.ts — trims edges, preserves non-strings and interior whitespace. ⚠️ Not run locally (fresh worktree, no deps) — relying on CI.

🤖 Generated with Claude Code

loading diff…