fix(api): guard malformed GraphQL error responses

Author: kali

lib/github.test.ts

@@ -135,10 +135,34 @@ describe('fetchGitHubContributions', () => {
       })
     );
 
-    // Only the first error surfaces — the source always reads errors[0].
+    // Preserve the existing behavior of surfacing the first GitHub error message.
     await expect(fetchGitHubContributions('octocat')).rejects.toThrow('Bad credentials');
   });
 
+  it('throws a stable fallback when GraphQL returns an empty errors array', async () => {
+    vi.mocked(fetch).mockResolvedValue(
+      mockResponse({
+        errors: [],
+      })
+    );
+
+    await expect(fetchGitHubContributions('octocat')).rejects.toThrow(
+      'GitHub GraphQL API returned an unknown error'
+    );
+  });
+
+  it('throws a stable fallback when the first GraphQL error has no message', async () => {
+    vi.mocked(fetch).mockResolvedValue(
+      mockResponse({
+        errors: [{}],
+      })
+    );
+
+    await expect(fetchGitHubContributions('octocat')).rejects.toThrow(
+      'GitHub GraphQL API returned an unknown error'
+    );
+  });
+
   it('throws a descriptive "user not found" error when the username does not exist on GitHub', async () => {
     vi.mocked(fetch).mockResolvedValue(mockResponse({ data: { user: null } }));
 

lib/github.ts

@@ -82,16 +82,35 @@ const GITHUB_GRAPHQL_URL = 'https://api.github.com/graphql';
 const GITHUB_REST_URL = 'https://api.github.com';
 
 type GitHubContributionResponse = {
-  data: {
+  data?: {
     user: {
       contributionsCollection: {
         contributionCalendar: ContributionCalendar;
       };
     } | null;
   };
-  errors?: Array<{ message: string }>;
+  errors?: unknown;
 };
 
+const UNKNOWN_GRAPHQL_ERROR_MESSAGE = 'GitHub GraphQL API returned an unknown error';
+
+function getGraphQLErrorMessage(errors: unknown): string {
+  if (!Array.isArray(errors)) return UNKNOWN_GRAPHQL_ERROR_MESSAGE;
+
+  const firstError = errors[0];
+  if (
+    firstError &&
+    typeof firstError === 'object' &&
+    'message' in firstError &&
+    typeof firstError.message === 'string' &&
+    firstError.message.trim() !== ''
+  ) {
+    return firstError.message;
+  }
+
+  return UNKNOWN_GRAPHQL_ERROR_MESSAGE;
+}
+
 /**
  * Configuration options for GitHub API fetch requests.
  */
@@ -264,11 +283,11 @@ export async function fetchGitHubContributions(
 
   const data: GitHubContributionResponse = await res.json();
 
-  if (data.errors) {
-    throw new Error(data.errors[0].message);
+  if (data.errors !== undefined) {
+    throw new Error(getGraphQLErrorMessage(data.errors));
   }
 
-  if (!data.data.user) {
+  if (!data.data?.user) {
     throw new Error(`GitHub user "${username}" not found`);
   }