fix: harden response parsing and add missing None guards

ejirocodes · ejirocodes · commit e9105b3f687f · 2026-03-26T10:21:42.000+01:00
- Guard int() on x-stack-actual-status header against malformed values
  in _parse_response and both retry loops (ValueError falls back to
  response.status_code)
- Validate response.json() returns dict before calling .get() on
  known-error body (non-dict JSON falls back to empty dict)
- Add None guard to get_email_delivery_stats before model_validate
  (matches pattern used by get_user, get_team, get_item)
diff --git a/sdks/implementations/python/src/stack_auth/_app.py b/sdks/implementations/python/src/stack_auth/_app.py
@@ -1369,6 +1369,8 @@ def get_email_delivery_stats(self) -> EmailDeliveryInfo:
             An :class:`EmailDeliveryInfo` with delivery counts and statuses.
         """
         data = self._client.request("GET", "/emails/delivery-stats")
+        if data is None:
+            return EmailDeliveryInfo(delivered=0, bounced=0, complained=0, total=0)
         return EmailDeliveryInfo.model_validate(data)
 
     # -- data vault ----------------------------------------------------------
@@ -2707,6 +2709,8 @@ async def get_email_delivery_stats(self) -> EmailDeliveryInfo:
             An :class:`EmailDeliveryInfo` with delivery counts and statuses.
         """
         data = await self._client.request("GET", "/emails/delivery-stats")
+        if data is None:
+            return EmailDeliveryInfo(delivered=0, bounced=0, complained=0, total=0)
         return EmailDeliveryInfo.model_validate(data)
 
     # -- data vault ----------------------------------------------------------
diff --git a/sdks/implementations/python/src/stack_auth/_client.py b/sdks/implementations/python/src/stack_auth/_client.py
@@ -78,13 +78,20 @@ def _parse_response(self, response: httpx.Response) -> tuple[int, dict[str, Any]
         """
         # Determine real status
         actual_status_header = response.headers.get("x-stack-actual-status")
-        actual_status = int(actual_status_header) if actual_status_header else response.status_code
+        if actual_status_header:
+            try:
+                actual_status = int(actual_status_header)
+            except ValueError:
+                actual_status = response.status_code
+        else:
+            actual_status = response.status_code
 
         # Known-error dispatch
         known_error = response.headers.get("x-stack-known-error")
         if known_error:
             try:
-                body = response.json()
+                parsed = response.json()
+                body = parsed if isinstance(parsed, dict) else {}
             except Exception:
                 body = {}
             raise StackAuthError.from_response(
@@ -170,7 +177,10 @@ def request(
 
                 # Check for 429 via x-stack-actual-status
                 actual_status_hdr = resp.headers.get("x-stack-actual-status")
-                actual_status = int(actual_status_hdr) if actual_status_hdr else resp.status_code
+                try:
+                    actual_status = int(actual_status_hdr) if actual_status_hdr else resp.status_code
+                except ValueError:
+                    actual_status = resp.status_code
 
                 # 429 retries apply to ALL methods (including POST/PATCH).
                 # Unlike network errors, a 429 guarantees the server did NOT
@@ -251,7 +261,10 @@ async def request(
                 )
 
                 actual_status_hdr = resp.headers.get("x-stack-actual-status")
-                actual_status = int(actual_status_hdr) if actual_status_hdr else resp.status_code
+                try:
+                    actual_status = int(actual_status_hdr) if actual_status_hdr else resp.status_code
+                except ValueError:
+                    actual_status = resp.status_code
 
                 # 429 retries apply to ALL methods (including POST/PATCH).
                 # Unlike network errors, a 429 guarantees the server did NOT
