{"record":{"id":"08589e8ece7e1253","repo":"immich-app/immich","slug":"password-is-required","errorCode":null,"errorMessage":"password is required","messagePattern":"password is required","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"server/src/services/user-admin.service.ts","lineNumber":37,"sourceCode":"import { getCalendarHeatmap } from 'src/services/shared/user-methods';\nimport { findOrFail } from 'src/utils/misc';\nimport { getPreferences, getPreferencesPartial, mergePreferences } from 'src/utils/preferences';\n\n@Injectable()\nexport class UserAdminService extends BaseService {\n  async search(auth: AuthDto, dto: UserAdminSearchDto): Promise<UserAdminResponseDto[]> {\n    const users = await this.userRepository.getList({\n      id: dto.id,\n      withDeleted: dto.withDeleted,\n    });\n    return users.map((user) => mapUserAdmin(user));\n  }\n\n  async create(dto: UserAdminCreateDto): Promise<UserAdminResponseDto> {\n    const { notify, ...userDto } = dto;\n    const config = await this.getConfig({ withCache: false });\n    if (!config.oauth.enabled && !userDto.password) {\n      throw new BadRequestException('password is required');\n    }\n\n    const user = await this.createUser(userDto);\n\n    await this.eventRepository.emit('UserSignup', {\n      notify: !!notify,\n      id: user.id,\n      password: userDto.password,\n    });\n\n    return mapUserAdmin(user);\n  }\n\n  async get(auth: AuthDto, id: string): Promise<UserAdminResponseDto> {\n    const user = await this.findOrFail(id, { withDeleted: true });\n    return mapUserAdmin(user);\n  }\n","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/immich-app/immich/blob/199723261c6ffa897fec8ccdaea6359e39c37cc3/server/src/services/user-admin.service.ts#L19-L55","documentation":"Thrown (as BadRequestException) by UserAdminService.create when OAuth is disabled in system config and the supplied UserAdminCreateDto carries no password. Without OAuth as an auth alternative, a newly created user must have a password set, so the create is rejected before the user record is written.","triggerScenarios":"POST /admin/users with an empty/omitted password field while config.oauth.enabled is false.","commonSituations":"Admin attempts passwordless invite without having enabled OAuth; frontend invite form skipped the password step; automated provisioning forgot the field.","solutions":["Include a non-empty password in the create payload.","Enable and fully configure OAuth in System Config, then retry without a password.","If migrating from OAuth to password auth, set a temporary password and force a reset."],"exampleFix":"// before\nawait usersApi.create({ email, name: 'Jane' });\n// after\nawait usersApi.create({ email, name: 'Jane', password: tempPassword });","handlingStrategy":"validation","validationCode":"const config = await configApi.getConfig();\nfunction needsPassword() { return !config.oauth.enabled; }\nif (needsPassword() && !dto.password) { /* require password in the form */ }","typeGuard":null,"tryCatchPattern":"try { await usersApi.create(dto); }\ncatch (e) {\n  if (e instanceof BadRequestException && e.message === 'password is required') {\n    // prompt for a password or enable OAuth in System Config\n  }\n}","preventionTips":["Frontend: make password required when System Config shows OAuth disabled.","Re-check oauth.enabled after config changes, not just at login.","For bulk provisioning, generate a strong temp password server-side."],"tags":["users","auth","oauth","validation","bad-request"],"backgroundTag":null,"analyzedSha":"199723261c6ffa897fec8ccdaea6359e39c37cc3","analyzedAt":"2026-08-12T04:54:27.085Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}