https://sonarly.com/issue/13613?type=bug
WorkflowEditActionCreateRecord crashes with TypeError when a CREATE_RECORD workflow step has undefined `settings` or `settings.input`, due to unguarded property access in useState initializer.
Fix: Added defensive optional chaining (`?.`) when accessing `action.settings.input` across all workflow action editor components that handle record CRUD operations and email actions. The fix extracts `action.settings?.input` into a local `actionInput` variable, then uses optional chaining (`actionInput?.fieldName`) with nullish coalescing (`?? ''` or `?? []`) to provide safe defaults when the data is undefined.
**Why this happens:** Workflow step data is stored as JSON in the database and loaded via GraphQL without runtime schema validation on the frontend. TypeScript types (derived from Zod schemas) guarantee `settings.input` exists at compile time, but at runtime the data can be malformed — e.g., after a 502 error during editing, cache corruption, or incomplete data from the API.
**What changed:**
- `WorkflowEditActionCreateRecord.tsx` — the component from the Sentry stack trace
- `WorkflowEditActionUpdateRecord.tsx` — same vulnerable pattern
- `WorkflowEditActionDeleteRecord.tsx` — same vulnerable pattern
- `WorkflowEditActionUpsertRecord.tsx` — same vulnerable pattern
- `WorkflowEditActionEmailBase.tsx` — same vulnerable pattern
- `useEmailForm.ts` — hook used by EmailBase with same pattern
Each file follows the same transformation: `action.settings.input.X` → `actionInput?.X ?? defaultValue`, where `actionInput = action.settings?.input`. The defaults (empty string, empty array) match the initial values used by the server-side step creation code.
Sonarly Claude Code
17694bccdd