{"record":{"id":"103128ee1a3316b2","repo":"we-promise/sure","slug":"result-error","errorCode":null,"errorMessage":"{result.error}","messagePattern":"\\{result\\.error\\}","errorType":"exception","errorClass":"Property::AvmImport::Error","httpStatus":null,"severity":"warning","filePath":"app/models/property/avm_import.rb","lineNumber":63,"sourceCode":"        balance: 0,\n        currency: data.currency,\n        status: \"draft\",\n        owner: owner,\n        accountable: Property.new(\n          subtype: data.property_type,\n          year_built: data.year_built,\n          area_value: data.area_value,\n          area_unit: data.area_unit,\n          avm_provider: provider_key,\n          avm_last_synced_on: Date.current,\n          # Providers only cover US addresses, so the country isn't collected\n          # in the lookup form. \"US\" matches the manual form's placeholder.\n          address_attributes: address_attributes.merge(country: \"US\")\n        )\n      )\n\n      result = account.set_current_balance(data.valuation)\n      raise Error.new(result.error) unless result.success?\n\n      account.activate!\n    end\n\n    account.auto_share_with_family! if family.share_all_by_default?\n    account\n  rescue ActiveRecord::RecordInvalid => e\n    raise Error.new(e.record.errors.full_messages.to_sentence.presence || e.message)\n  end\n\n  private\n    attr_reader :family, :owner, :provider_key, :name, :address_attributes\n\n    # The form marks these required, but a forged or JS-less submission can\n    # bypass that — validate locally before spending a monthly-budget request\n    # on a lookup that can't produce a property.\n    def validate_inputs!\n      missing = name.blank? ||","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/we-promise/sure/blob/e69894adb92547273377398c15f45c979cd9416a/app/models/property/avm_import.rb#L45-L81","documentation":"Setting::ValidationError raised by Setting.validate_onboarding_state! when the proposed state is not in ONBOARDING_STATES = %w[open closed invite_only] (app/models/setting.rb:176). The message is I18n-driven (settings.hostings.update.invalid_onboarding_state). This guards self-hosted instance onboarding mode: only those three exact strings are accepted, and unlike the ENV-based default (which silently falls back to 'open' for bad values), the bang validator fails loudly.","triggerScenarios":"Host settings update endpoint receiving a state like 'invite-only' (hyphen), 'Invites', 'public', or 'inviteOnly' — any deviation from the exact snake_case values; passing nil or an empty string; API client sending enum names from a different version.","commonSituations":"Frontend dropdown values drifting from backend enums; API consumers guessing state names; copy-pasting 'invite-only' from docs written with hyphens; upgrading instances where old client code sends legacy state names.","solutions":["Use one of the exact values: open, closed, invite_only","Normalize/whitelist input at the controller boundary against Setting::ONBOARDING_STATES","Check the I18n key settings.hostings.update.invalid_onboarding_state exists in your locale files if the message looks wrong","For ENV config (ONBOARDING_STATE), remember invalid values silently coerce to 'open', not this error — this validator only runs on explicit updates"],"exampleFix":"# before\nSetting.validate_onboarding_state!(params[:state]) # \"invite-only\" -> raises\n\n# after\nstate = params[:state].to_s.underscore.tr(\"-\", \"_\") unless Setting::ONBOARDING_STATES.include?(params[:state])\nSetting.validate_onboarding_state!(state) # \"invite_only\" -> passes","handlingStrategy":"validation","validationCode":"state = params[:state].to_s\nunless Setting::ONBOARDING_STATES.include?(state)\n  return render_error \"state must be one of #{Setting::ONBOARDING_STATES.join(', ')}\"\nend","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Populate UI dropdowns directly from Setting::ONBOARDING_STATES so values can never drift","Whitelist enum inputs at the controller boundary","Remember ONBOARDING_STATE env values silently coerce to 'open' — only explicit updates hit this validator"],"tags":["settings","validation","enum","onboarding","configuration"],"backgroundTag":"invalid-enum-value","analyzedSha":"e69894adb92547273377398c15f45c979cd9416a","analyzedAt":"2026-08-21T18:22:41.165Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}