fix(showcase): harden railway-token resolver (whitespace/non-object guards, type-safe narrowing)

Treat whitespace-only token strings as empty so the resolver falls through
to the next candidate instead of returning a bearer that fails at Railway
with a confusing 401.

Guard against non-object JSON input (null/undefined/string/number/array)
defensively before property access — the config originates from
JSON.parse of ~/.railway/config.json (untrusted).

Replace non-null assertions on re-accessed expressions with
locally-captured values so the nonEmpty narrowing actually applies; no
behavior change for the happy path.

Comment cleanups: replace stale line-number reference with a symbolic
one, reword the Ruby-parity note to acknowledge the per-project token
fallback that is intentionally not honored, drop the rotting
"(43+ chars)" parenthetical, and soften the deprecation timeline to
"a future release."

Author: jpr5

showcase/scripts/lib/__tests__/railway-token.test.ts

@@ -66,4 +66,83 @@ describe("resolveRailwayTokenFromConfig", () => {
         const result = resolveRailwayTokenFromConfig(cfg, { warn });
         expect(result).toBeUndefined();
     });
+
+    it("treats whitespace-only user.accessToken as empty and falls through", () => {
+        const cfg: RailwayConfigShape = {
+            user: { accessToken: "   " },
+        };
+        const warn = vi.fn();
+        const result = resolveRailwayTokenFromConfig(cfg, { warn });
+        expect(result).toBeUndefined();
+        expect(warn).not.toHaveBeenCalled();
+    });
+
+    it("falls through whitespace-only user.accessToken to legacy user.token with warn", () => {
+        const cfg: RailwayConfigShape = {
+            user: {
+                accessToken: "\n\t  ",
+                token: "legacy-short-token-aaaaaaaaaa",
+            },
+        };
+        const warn = vi.fn();
+        const result = resolveRailwayTokenFromConfig(cfg, { warn });
+        expect(result).toBe("legacy-short-token-aaaaaaaaaa");
+        expect(warn).toHaveBeenCalledTimes(1);
+    });
+
+    it("treats whitespace-only tokens at every layer as empty", () => {
+        const cfg: RailwayConfigShape = {
+            user: { accessToken: "  ", token: "\t" },
+            accessToken: "\n",
+            token: "   ",
+        };
+        const warn = vi.fn();
+        const result = resolveRailwayTokenFromConfig(cfg, { warn });
+        expect(result).toBeUndefined();
+        expect(warn).not.toHaveBeenCalled();
+    });
+
+    it("returns undefined when config is null", () => {
+        const warn = vi.fn();
+        const result = resolveRailwayTokenFromConfig(null, { warn });
+        expect(result).toBeUndefined();
+        expect(warn).not.toHaveBeenCalled();
+    });
+
+    it("returns undefined when config is undefined", () => {
+        const warn = vi.fn();
+        const result = resolveRailwayTokenFromConfig(undefined, { warn });
+        expect(result).toBeUndefined();
+        expect(warn).not.toHaveBeenCalled();
+    });
+
+    it("returns undefined when config is a string (non-object JSON)", () => {
+        const warn = vi.fn();
+        const result = resolveRailwayTokenFromConfig(
+            "not-an-object" as unknown as RailwayConfigShape,
+            { warn },
+        );
+        expect(result).toBeUndefined();
+        expect(warn).not.toHaveBeenCalled();
+    });
+
+    it("returns undefined when config is a number", () => {
+        const warn = vi.fn();
+        const result = resolveRailwayTokenFromConfig(
+            42 as unknown as RailwayConfigShape,
+            { warn },
+        );
+        expect(result).toBeUndefined();
+        expect(warn).not.toHaveBeenCalled();
+    });
+
+    it("returns undefined when config is an array", () => {
+        const warn = vi.fn();
+        const result = resolveRailwayTokenFromConfig(
+            [] as unknown as RailwayConfigShape,
+            { warn },
+        );
+        expect(result).toBeUndefined();
+        expect(warn).not.toHaveBeenCalled();
+    });
 });

showcase/scripts/lib/railway-token.ts

@@ -1,13 +1,16 @@
 /**
  * railway-token.ts — Shared resolver for the Railway GraphQL bearer.
  *
- * The Railway CLI stores the public-GraphQL bearer in `user.accessToken`
- * (43+ chars). The shorter `user.token` is a legacy CLI session token
- * that does NOT authenticate to the public GraphQL API. Older configs
- * still on disk have `user.token` set and `user.accessToken` empty;
- * those callers get a one-cycle deprecation warning and still work.
+ * The Railway CLI stores the public-GraphQL bearer in `user.accessToken`.
+ * The shorter `user.token` is a legacy CLI session token that does NOT
+ * authenticate to the public GraphQL API. Older configs still on disk
+ * have `user.token` set and `user.accessToken` empty; those callers get
+ * a one-cycle deprecation warning and still work.
  *
- * Resolution order mirrors `showcase/bin/railway:115-119`:
+ * Resolution order matches the first four candidates of
+ * `showcase/bin/railway` `Auth.token`; the per-project
+ * `projects.<id>.token` fallback is intentionally not honored (no
+ * project-scoped tokens here):
  *   1. user.accessToken
  *   2. accessToken (top-level)
  *   3. user.token        (legacy → warn)
@@ -35,29 +38,41 @@ const DEPRECATION_MESSAGE =
     "`user.token` / top-level `token` no longer authenticates the public " +
     "GraphQL API. The Railway CLI now writes `user.accessToken`; re-run " +
     "`railway login` to refresh ~/.railway/config.json. Support for the " +
-    "legacy field will be removed in the next release cycle.";
+    "legacy field will be removed in a future release.";
 
 function nonEmpty(v: unknown): v is string {
-    return typeof v === "string" && v.length > 0;
+    return typeof v === "string" && v.trim().length > 0;
 }
 
 export function resolveRailwayTokenFromConfig(
     config: RailwayConfigShape | null | undefined,
     deps: ResolverDeps = {},
 ): string | undefined {
-    if (!config) return undefined;
+    // Defensive guard: config originates from JSON.parse of
+    // ~/.railway/config.json (untrusted). Reject anything that isn't a
+    // plain object before property access.
+    if (config === null || config === undefined) return undefined;
+    if (typeof config !== "object") return undefined;
+    if (Array.isArray(config)) return undefined;
+
     const warn = deps.warn ?? ((m: string) => console.warn(m));
 
-    if (nonEmpty(config.user?.accessToken)) return config.user!.accessToken;
-    if (nonEmpty(config.accessToken)) return config.accessToken;
+    const userAccess = config.user?.accessToken;
+    if (nonEmpty(userAccess)) return userAccess;
+
+    const topAccess = config.accessToken;
+    if (nonEmpty(topAccess)) return topAccess;
 
-    if (nonEmpty(config.user?.token)) {
+    const userLegacy = config.user?.token;
+    if (nonEmpty(userLegacy)) {
         warn(DEPRECATION_MESSAGE);
-        return config.user!.token;
+        return userLegacy;
     }
-    if (nonEmpty(config.token)) {
+
+    const topLegacy = config.token;
+    if (nonEmpty(topLegacy)) {
         warn(DEPRECATION_MESSAGE);
-        return config.token;
+        return topLegacy;
     }
     return undefined;
 }