Skip to content

Conversation

@KaparthyReddy
Copy link

What does this PR do?

This PR resolves a 500 Server Error occurring when a null value is explicitly passed for the name parameter in user creation endpoints. I've updated the action signatures to be nullable and added a null-coalescing fallback to an empty string.

Which issue does it fix?

Fixes #8785

Checklist

  • All user creation variants (bcrypt, argon2, etc.) updated in users.php.
  • Param type-hint updated to ?string.
  • Fallback $name ?? '' added to prevent downstream errors.

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Dec 24, 2025

📝 Walkthrough

Walkthrough

The changes modify the account and user creation endpoints to accept nullable string values for the name parameter instead of requiring non-nullable strings. Each affected endpoint adds a fallback that converts null values to empty strings ($name = $name ?? '') before processing. This allows nine endpoints across two files—the account creation endpoint and eight user creation endpoints (standard, bcrypt, MD5, Argon2, SHA, PHPass, Scrypt, and Scrypt Modified)—to gracefully handle cases where the name field is explicitly passed as null.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Pre-merge checks and finishing touches

✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely summarizes the main change: handling null name parameters in user and account creation endpoints.
Description check ✅ Passed The description is directly related to the changeset, explaining the problem, solution, and affected endpoints with clear references to issue #8785.
Linked Issues check ✅ Passed The PR successfully addresses issue #8785 by making the name parameter nullable and adding null-coalescing fallbacks across all user creation endpoints as required.
Out of Scope Changes check ✅ Passed All changes are directly scoped to resolving issue #8785: making name nullable and adding fallbacks in user and account creation endpoints.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions
Copy link

Security Scan Results for PR

Docker Image Scan Results

Package Version Vulnerability Severity
libpng 1.6.51-r0 CVE-2025-66293 HIGH
libpng-dev 1.6.51-r0 CVE-2025-66293 HIGH

Source Code Scan Results

🎉 No vulnerabilities found!

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
app/controllers/api/users.php (1)

299-305: Fix /v1/users/scrypt-modified endpoint to accept nullable name parameter and normalize it

The scrypt-modified endpoint at lines 546-553 still uses string $name without normalization, whereas all other "create user with ___ password" variants have been updated to accept ?string $name with a normalization line. Since createUser expects a non-nullable string, this endpoint remains at risk of type errors if the framework passes null for the name parameter (e.g., client sends name: null).

Update the endpoint signature to ?string $name and add $name = $name ?? ''; as the first line in the action to match the pattern applied across all other create-user endpoints.

Also applies to: 338-343, 376-381, 415-422, 456-461, 499-510, 546-553

🧹 Nitpick comments (2)
app/controllers/api/account.php (1)

369-382: Null-safe name handling for account.create is correct; consider validator semantics

Changing the action signature to ?string $name and normalizing with $name = $name ?? ''; safely handles a nullable name inside the handler and downstream (e.g., in PersonalData and search fields).

If the intended behavior is to accept a JSON name: null on the wire (not reject it with a 4xx), you may also want to align the parameter validator with that intent by making the param nullable (for example, param('name', null, new Nullable(new Text(128)), ...)) so the framework doesn’t reject null before it reaches this action. Please verify how Text currently treats an explicit null here.

app/controllers/api/users.php (1)

249-267: /v1/users null-name handling is correct, but clean up comments and consider nullable validator

The updated signature ?string $name plus $name = $name ?? ''; gives you the right runtime behavior and prevents type errors when name is null.

Two follow-ups:

  1. The inline comments // 1. Add the '?' before string $name and // 2. Add this line at the very top of the action function are PR-instructional and should be removed before merge.

  2. If the goal is to accept a JSON name: null and treat it like “no name” rather than rejecting it at validation, consider making the param nullable (e.g., param('name', null, new Nullable(new Text(128)), ...)) so the framework doesn’t block null before it reaches this action. Please verify how the current Text validator behaves for null.

Proposed cleanup for the action header and normalization
-    // 1. Add the '?' before string $name
-    ->action(function (string $userId, ?string $email, ?string $phone, ?string $password, ?string $name, Response $response, Document $project, Database $dbForProject, Hooks $hooks) {
-        
-        // 2. Add this line at the very top of the action function
-        $name = $name ?? ''; 
+    ->action(function (string $userId, ?string $email, ?string $phone, ?string $password, ?string $name, Response $response, Document $project, Database $dbForProject, Hooks $hooks) {
+        $name = $name ?? '';
📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 44ec8de and a976f61.

📒 Files selected for processing (2)
  • app/controllers/api/account.php
  • app/controllers/api/users.php
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: ItzNotABug
Repo: appwrite/appwrite PR: 9693
File: src/Appwrite/Platform/Modules/Databases/Http/Indexes/Get.php:54-54
Timestamp: 2025-05-05T03:49:58.171Z
Learning: In Appwrite's API handlers, path parameters can use `null` as the default value rather than empty strings, as this pattern is consistent with existing code in the codebase.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

🐛 Bug Report: All Users.CreateUser... endpoints return a vague server error is null name is provided

1 participant