HeyPuter/puter · error · HttpError

Authentication required

Error message

Authentication required

What it means

TogetherVideoProvider.generate validates that `prompt` is a non-empty string before resolving the model or honoring test_mode. Same guard and same legacyCode as the other providers; the first thing generate() does after destructuring params.

Source

Thrown at extensions/installedApps.ts:29

    'name',
    'uid',
    'title',
    'installed_at',
] as const;
const ORDER_BY_FIELD_MAP: Record<string, string> = {
    id: 'apps.id',
    name: 'apps.name',
    uid: 'apps.uid',
    title: 'apps.title',
    installed_at: 'installed_at',
};

export const handleInstalledApps = async (
    req: Request,
    res: Response,
): Promise<void> => {
    const actor = Context.get('actor');
    if (!actor?.user?.id) throw new HttpError(401, 'Authentication required');

    const orderBy = String(req.query.orderBy ?? 'installed_at');
    if (!(ALLOWED_ORDER_BY as readonly string[]).includes(orderBy)) {
        throw new HttpError(
            400,
            `Invalid orderBy. Allowed: ${ALLOWED_ORDER_BY.join(', ')}`,
        );
    }

    const page = Math.max(Number(req.query.page) || 1, 1);
    const limit = Math.min(Math.max(Number(req.query.limit) || 100, 1), 100);
    const offset = (page - 1) * limit;
    const orderByField = ORDER_BY_FIELD_MAP[orderBy];
    const sortDirection = req.query.desc ? 'DESC' : 'ASC';

    const installedApps = (await clients.db.read(
        `SELECT
            apps.name,

View on GitHub (pinned to 908ec23eda)

Solutions

1. Trim and validate the prompt is non-empty before calling generate().
2. Gate the submit UI on a non-empty prompt.
3. Coerce with String(value).trim() at the input boundary.
4. Confirm prompt is the `prompt` field of the params object.

Example fix

// before
await together.generate({ prompt: body.prompt });

// after
const prompt = String(body.prompt ?? '').trim();
if (!prompt) return res.status(400).send('prompt required');
await together.generate({ prompt });

function cleanPrompt(p) {
  if (typeof p !== 'string') throw new Error('prompt must be a non-empty string');
  const trimmed = p.trim();
  if (!trimmed) throw new Error('prompt must be a non-empty string');
  return trimmed;
}

function isNonEmptyPrompt(p) { return typeof p === 'string' && p.trim().length > 0; }

When it happens

Trigger: Calling the Together generate path with prompt omitted, null, undefined, non-string, or empty/whitespace. Same shape as the Gemini/OpenAI prompt guard.

Common situations: Form submitted with empty prompt; prompt read from a missing config key; positional arg passed where a params object was expected.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• App owner not found
• Permission denied
• ${key} must be an integer between ${min} and ${max}
• Invalid orderBy. Allowed: ${ALLOWED_ORDER_BY.join(', ')}
• bad_request

AI-assisted analysis of HeyPuter/puter@908ec23eda (2026-08-12). Data as JSON: /api/errors/77ad1fa32e155ffa. Report an issue: GitHub.