fix: skip nil RequestOptions to prevent nil pointer dereferences on option.apply(r)

authentication/authentication_request.go

@@ -47,6 +47,10 @@ func (a *Authentication) NewRequest(
 	request.Header.Add("Content-Type", "application/json")
 
 	for _, option := range opts {
+		if option == nil {
+			continue
+		}
+
 		option.apply(request, nil)
 	}
 
@@ -70,6 +74,10 @@ func (a *Authentication) NewFormRequest(
 	request.Header.Add("Content-Type", "application/x-www-form-urlencoded")
 
 	for _, option := range opts {
+		if option == nil {
+			continue
+		}
+
 		option.apply(request, payload)
 	}
 

management/actions.go

@@ -229,6 +229,10 @@ func applyActionsListDefaults(options []RequestOption) RequestOption {
 		PerPage(50).apply(r)
 
 		for _, option := range options {
+			if option == nil {
+				continue
+			}
+
 			option.apply(r)
 		}
 	})

management/job.go

@@ -202,6 +202,10 @@ func (m *JobManager) ImportUsers(ctx context.Context, j *Job, opts ...RequestOpt
 	request.Header.Add("Content-Type", mp.FormDataContentType())
 
 	for _, option := range opts {
+		if option == nil {
+			continue
+		}
+
 		option.apply(request)
 	}
 

management/management_request.go

@@ -128,6 +128,10 @@ func (m *Management) NewRequest(
 	m.applyCustomDomainHeader(request, uri)
 
 	for _, option := range options {
+		if option == nil {
+			continue
+		}
+
 		option.apply(request)
 	}
 
@@ -251,6 +255,10 @@ func applyListDefaults(options []RequestOption) RequestOption {
 		IncludeTotals(true).apply(r)
 
 		for _, option := range options {
+			if option == nil {
+				continue
+			}
+
 			option.apply(r)
 		}
 	})
@@ -261,6 +269,10 @@ func applyListCheckpointDefaults(options []RequestOption) RequestOption {
 		Take(50).apply(r)
 
 		for _, option := range options {
+			if option == nil {
+				continue
+			}
+
 			option.apply(r)
 		}
 	})

management/management_request_test.go

@@ -123,11 +123,41 @@ func TestNewRequest(t *testing.T) {
 			expectedError: "",
 			expectedBody:  `{"name":"TestClient","description":"Test description"}` + "\n",
 		},
+		{
+			name:     "Request with nil options mixed with valid options",
+			method:   http.MethodPost,
+			endpoint: api.URI("clients"),
+			payload:  nil,
+			options: []RequestOption{
+				nil,
+				Body([]byte(`{"test":"value"}`)),
+				nil,
+			},
+			expectedError: "",
+			expectedBody:  `{"test":"value"}`,
+		},
+		{
+			name:     "Request with all nil options",
+			method:   http.MethodPost,
+			endpoint: api.URI("clients"),
+			payload:  &Client{Name: auth0.String("TestClient")},
+			options: []RequestOption{
+				nil,
+				nil,
+			},
+			expectedError: "",
+			expectedBody:  `{"name":"TestClient"}` + "\n",
+		},
 	}
 
 	for _, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
-			request, err := api.NewRequest(context.Background(), testCase.method, testCase.endpoint, testCase.payload, testCase.options...)
+			request, err := api.NewRequest(
+				context.Background(),
+				testCase.method,
+				testCase.endpoint,
+				testCase.payload,
+				testCase.options...)
 
 			if testCase.expectedError != "" {
 				assert.EqualError(t, err, testCase.expectedError)
@@ -145,10 +175,43 @@ func TestNewRequest(t *testing.T) {
 			assert.Equal(t, testCase.expectedBody, string(requestBody))
 
 			if testCase.expectedBody != "" {
-				assert.Equal(t, "application/json", request.Header.Get("Content-Type"))
+				assert.Equal(
+					t,
+					"application/json",
+					request.Header.Get("Content-Type"),
+				)
 			} else {
 				assert.Empty(t, request.Header.Get("Content-Type"))
 			}
 		})
 	}
 }
+
+// TestNilOptionsInHelperFunctions tests that helper functions handle nil options correctly.
+func TestNilOptionsInHelperFunctions(t *testing.T) {
+	t.Run("applyListDefaults with nil options", func(t *testing.T) {
+		req, err := http.NewRequest("GET", "https://example.com", nil)
+		require.NoError(t, err)
+
+		// Test with nil options mixed with valid ones
+		listDefaults := applyListDefaults([]RequestOption{nil, Page(2), nil})
+		listDefaults.apply(req)
+
+		query := req.URL.Query()
+		assert.Equal(t, "2", query.Get("page"))
+		assert.Equal(t, "50", query.Get("per_page"))         // default
+		assert.Equal(t, "true", query.Get("include_totals")) // default
+	})
+
+	t.Run("applyListCheckpointDefaults with nil options", func(t *testing.T) {
+		req, err := http.NewRequest("GET", "https://example.com", nil)
+		require.NoError(t, err)
+
+		// Test with nil options mixed with valid ones
+		checkpointDefaults := applyListCheckpointDefaults([]RequestOption{nil, Take(25), nil})
+		checkpointDefaults.apply(req)
+
+		query := req.URL.Query()
+		assert.Equal(t, "25", query.Get("take"))
+	})
+}