fix(oauth-provider): omit given_name and family_name when the user has no name - #11201

Closes #11193

The bug

splitDisplayName in packages/oauth-provider/src/standard-claims.ts takes a plain string and immediately calls name.split(" "). Resolving given_name or family_name for a user whose stored name is null throws a TypeError out of the claim resolver, surfacing as 500 from /userinfo, and from the token endpoint whenever an ID token is issued. Any client requesting the profile scope for such a user hits it.

Why this is a contract violation, not just bad data

userSchema types name as z.string(), so the null does not come from the type contract. It comes from how this module already treats the value:

name:        { scope: "profile", resolve: (user) => user.name ?? undefined },              // guards
given_name:  { scope: "profile", resolve: (user) => splitDisplayName(user.name).given },   // throws
family_name: { scope: "profile", resolve: (user) => splitDisplayName(user.name).family },  // throws

userNormalClaims in userinfo.ts does the same for the subject (sub: user.id ?? undefined). So the module already treats these fields as runtime-nullable — three claims resolve a missing value to an absent claim, and two dereference it one line later. That inconsistency is the defect: a claim the provider cannot resolve should be omitted, not fail the entire response including the claims that did resolve.

The change

splitDisplayName now accepts a nullish name and returns no claims for it. It is a module-private helper, so no exported type changes and User["name"] stays z.string() — the runtime guard is not being used to loosen the public type contract.

Testing

New packages/oauth-provider/src/standard-claims.test.ts exercises the resolvers directly: two-part and multi-part names, single word, blank, null, and undefined. The null and undefined cases fail on main with the reported TypeError and pass with this change.

• vitest packages/oauth-provider — 42 files, 948 tests passing
• pnpm typecheck — passing

AI assistance

Disclosed per CONTRIBUTING: this change was AI-assisted (Claude Code) — the investigation, patch and tests were produced with it. I have reviewed the full diff myself and verified it locally by running the commands above. Happy to discuss any of it in review.

Summary by cubic

Fixes the OAuth provider so given_name and family_name claims are omitted for users with no name instead of failing the request. Previously, requesting the profile scope for such a user returned 500 from /userinfo and from the token endpoint when an ID token was issued.

• splitDisplayName now accepts a nullish name and returns no claims.
• Added tests covering two-part, multi-part, single-word, blank, null, and undefined names.

^{Written for commit 2a264c8. Summary will update on new commits.}