From 7c1b9d578c2daac900ac2b52e6592f3988ebac94 Mon Sep 17 00:00:00 2001
From: OpenClaw Bot <ai-agent@topdoglabs.com>
Date: Sat, 21 Feb 2026 12:59:22 -0600
Subject: [PATCH] Signed-off-by: OpenClaw Bot <ai-agent@topdoglabs.com>

---
 src/app/settings/page.tsx | 74 ++++++++++++++++++++++++++-------------
 1 file changed, 49 insertions(+), 25 deletions(-)

diff --git a/src/app/settings/page.tsx b/src/app/settings/page.tsx
index 5eb4958..d793a18 100644
--- a/src/app/settings/page.tsx
+++ b/src/app/settings/page.tsx
@@ -47,19 +47,29 @@ export default function SettingsPage() {
           if (isMounted) router.replace("/login")
           return
         }
-        const data = await res.json()
+        const data = await res.json().catch(() => null)
+        const user = data?.user
+        if (
+          !user
+          || typeof user.id !== "string"
+          || typeof user.name !== "string"
+          || typeof user.email !== "string"
+        ) {
+          if (isMounted) router.replace("/login")
+          return
+        }
         if (!isMounted) return
 
-        setName(data.user.name || "")
-        setEmail(data.user.email || "")
-        setProfileAvatarUrl(data.user.avatarUrl || "")
-        setCurrentUserId(data.user.id || "")
-        setInitialEmail(data.user.email || "")
+        setName(user.name || "")
+        setEmail(user.email || "")
+        setProfileAvatarUrl(typeof user.avatarUrl === "string" ? user.avatarUrl : "")
+        setCurrentUserId(user.id || "")
+        setInitialEmail(user.email || "")
         setCurrentUser({
-          id: data.user.id,
-          name: data.user.name,
-          email: data.user.email,
-          avatarUrl: data.user.avatarUrl,
+          id: user.id,
+          name: user.name,
+          email: user.email,
+          avatarUrl: typeof user.avatarUrl === "string" ? user.avatarUrl : undefined,
         })
         setAuthReady(true)
       } catch {
@@ -111,23 +121,35 @@ export default function SettingsPage() {
         body: JSON.stringify(payload),
       })
 
-      const data = await res.json()
+      const data = await res.json().catch(() => null)
       if (!res.ok) {
-        setProfileError(data.error || "Failed to update profile")
+        setProfileError(
+          data && typeof data.error === "string" ? data.error : "Failed to update profile"
+        )
+        return
+      }
+      const user = data?.user
+      if (
+        !user
+        || typeof user.id !== "string"
+        || typeof user.name !== "string"
+        || typeof user.email !== "string"
+      ) {
+        setProfileError("Profile update returned invalid data")
         return
       }
 
       setCurrentUser({
-        id: data.user.id,
-        name: data.user.name,
-        email: data.user.email,
-        avatarUrl: data.user.avatarUrl,
+        id: user.id,
+        name: user.name,
+        email: user.email,
+        avatarUrl: typeof user.avatarUrl === "string" ? user.avatarUrl : undefined,
       })
-      setName(data.user.name)
-      setEmail(data.user.email)
-      setProfileAvatarUrl(data.user.avatarUrl || "")
-      setCurrentUserId(data.user.id)
-      setInitialEmail(data.user.email)
+      setName(user.name)
+      setEmail(user.email)
+      setProfileAvatarUrl(typeof user.avatarUrl === "string" ? user.avatarUrl : "")
+      setCurrentUserId(user.id)
+      setInitialEmail(user.email)
       setProfileCurrentPassword("")
       setProfileSuccess("Profile updated")
     } catch {
@@ -161,7 +183,7 @@ export default function SettingsPage() {
     [avatarSeed, name, email]
   )
   const avatarPresets = useMemo(
-    () => buildAvatarPresets(avatarSeed, name || email || "User", 8),
+    () => Array.from(new Set(buildAvatarPresets(avatarSeed, name || email || "User", 8))),
     [avatarSeed, name, email]
   )
   const profilePreviewAvatarUrl = profileAvatarUrl || generatedAvatarUrl
@@ -194,9 +216,11 @@ export default function SettingsPage() {
         }),
       })
 
-      const data = await res.json()
+      const data = await res.json().catch(() => null)
       if (!res.ok) {
-        setPasswordError(data.error || "Failed to update password")
+        setPasswordError(
+          data && typeof data.error === "string" ? data.error : "Failed to update password"
+        )
         return
       }
 
@@ -295,7 +319,7 @@ export default function SettingsPage() {
                 <div className="flex flex-wrap gap-2">
                   {avatarPresets.map((presetUrl, index) => (
                     <button
-                      key={presetUrl}
+                      key={`${avatarSeed}-preset-${index}`}
                       type="button"
                       onClick={() => setProfileAvatarUrl(presetUrl)}
                       className={`rounded-full p-0.5 border ${profileAvatarUrl === presetUrl ? "border-blue-400" : "border-slate-700 hover:border-slate-500"}`}