Code inside function can break the Netlify site

[thdoan]

Describe the bug

I was in the middle of implementing Netlify Identity using Functions and after pushing the code below, I was a bit concerned to see it broke the https://app.netlify.com/sites/<site>/identity page:

Function:

import fetch from 'node-fetch';

export async function handler(e, context) {
  const { identity, user } = context.clientContext

  if (user) {
    return fetch(identity.url + '/admin/users/' + user.sub, {
      method: 'PUT',
      headers: {
        Authorization: 'Bearer ' + identity.token,
      },
      body: JSON.stringify({
        app_metadata: { roles: 'member' },
      }),
    }).then((response) => response.json()).then((data) => {
      return { statusCode: 204 };
    });
  } else {
    return {
      statusCode: 401,
      body: JSON.stringify({ message: 'Unauthorized' }),
    };
  }
}

The root cause is this line:

        app_metadata: { roles: 'member' },

After changing roles to an array, then the Identity page was fine again.

        app_metadata: { roles: ['member'] },

IMHO no code inside a function should be able to break the page like this.

Configuration

System:
OS: Windows 10 10.0.19044
CPU: (8) x64 Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz
Memory: 12.18 GB / 31.95 GB
Binaries:
Node: 16.20.0 - C:\Program Files\nodejs\node.EXE
npm: 8.19.4 - C:\Program Files\nodejs\npm.CMD