{"record":{"id":"142e6c4fba53c694","repo":"diegosouzapw/OmniRoute","slug":"paid-model-target-blocked-142e6c","errorCode":"PAID_MODEL_TARGET_BLOCKED","errorMessage":"This field cannot target a paid-only model while 'Hide paid models' is enabled.","messagePattern":"This field cannot target a paid-only model while 'Hide paid models' is enabled\\.","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"src/app/api/settings/route.ts","lineNumber":414,"sourceCode":"          );\n        }\n      }\n    }\n\n    // #6540: reject a paid-only webSearchRouteModel target when hidePaidModels\n    // is on. Business-rule check (needs an async DB read), so it runs after\n    // Zod shape validation rather than as a Zod .refine(). Fails open on\n    // \"unknown\" (aliases/combo names) — only a positively-identified paid\n    // catalog entry is blocked.\n    if (typeof body.webSearchRouteModel === \"string\" && body.webSearchRouteModel.trim() !== \"\") {\n      const currentSettings = await getSettings();\n      if ((currentSettings as Record<string, unknown>)?.hidePaidModels === true) {\n        if (isPaidModelTarget(body.webSearchRouteModel) === \"paid\") {\n          emitSettingsFailureAudit(request, actor, \"PAID_MODEL_TARGET_BLOCKED\", attemptedKeys);\n          return NextResponse.json(\n            {\n              error: {\n                code: \"PAID_MODEL_TARGET_BLOCKED\",\n                message:\n                  \"This field cannot target a paid-only model while 'Hide paid models' is enabled.\",\n              },\n            },\n            { status: 400 }\n          );\n        }\n      }\n    }\n\n    // Password rotation: hash the new value AFTER the gate has accepted the\n    // currentPassword (or the cold-boot exception fired). The gate already\n    // included `newPassword` in SECURITY_IMPACTING_KEYS, so no separate\n    // verify happens here — strictly hashing + body rewriting.\n    if (body.newPassword) {\n      body.password = await hashManagementPassword(body.newPassword);\n      delete body.newPassword;\n    }","sourceCodeStart":396,"sourceCodeEnd":432,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/app/api/settings/route.ts#L396-L432","documentation":"Error \"This field cannot target a paid-only model while 'Hide paid models' is enabled.\" thrown in diegosouzapw/OmniRoute.","triggerScenarios":"Thrown at src/app/api/settings/route.ts:414 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","schemaVersion":2},"datasetVersion":"2026-08-25T21:54:21.419Z"}