Fix ZDR issue for openai by elie222 · Pull Request #1059 · elie222/inbox-zero

2 issues identified (4 code objects reviewed).

• Merge Base: 28df057
• Head: 648e8c3

✅	File Path	Comments Posted
✅	`apps/web/env.ts`	0
❌	`apps/web/utils/llms/model.ts`	1
❌	`apps/web/utils/outlook/client.ts`	1

apps/web/env.ts

line 149: NEXT_PUBLIC_FREE_UNSUBSCRIBE_CREDITS is defined as z.number().default(5) on the client (line 149) but the corresponding value in experimental__runtimeEnv is sourced from process.env.NEXT_PUBLIC_FREE_UNSUBSCRIBE_CREDITS, which is always a string when set. Without z.coerce.number(), providing an env var like "5" will fail validation at runtime instead of being parsed to a number. All other client numeric envs use z.coerce.number(); this one is inconsistent and will cause a runtime parse error when set. [ Out of scope ]

apps/web/utils/llms/model.ts

line 92: providerOptions is accepted by selectModel but is only forwarded in the Provider.OPEN_AI and Provider.OPENROUTER branches. For GOOGLE, GROQ, AI_GATEWAY, BEDROCK, and ANTHROPIC, any provided providerOptions are silently ignored, which breaks interface parity and may lead callers to believe options are applied when they are not. Either document the asymmetry or forward/validate options consistently. [ Low confidence ]
line 355: getBackupModel constructs an OpenRouter client using env.OPENROUTER_API_KEY without checking if it exists. If OPENROUTER_BACKUP_MODEL is set but OPENROUTER_API_KEY is missing, the backup model is created with an undefined API key, likely causing runtime failures when used. Add a check to require the API key or return null. [ Low confidence ]

apps/web/utils/outlook/client.ts

line 126: Refresh token request may be rejected by Microsoft because it omits the scope parameter for the grant_type=refresh_token request to the v2.0 token endpoint. This can lead to invalid_request/invalid_grant responses depending on tenant/app configuration. [ Low confidence ]
line 192: saveTokens is called before validating the token response. If tokens.access_token is missing or empty, createOutlookClient(tokens.access_token) will throw a SafeError, but the function will have already persisted an invalid access_token/expires_at, leaving state in a bad/partially updated condition. [ Low confidence ]
line 195: Potential NaN for expires_at: Math.floor(Date.now() / 1000 + tokens.expires_in) assumes tokens.expires_in is a finite number. If it is missing or not numeric, the result will be NaN and be stored, breaking future expiry checks. [ Low confidence ]