{"record":{"id":"37d48c27f9aa1412","repo":"router-for-me/CLIProxyAPI","slug":"plugin-sync-item-d-auth-d-w","errorCode":null,"errorMessage":"plugin sync item %d auth %d: %w","messagePattern":"plugin sync item (.+?) auth (.+?): %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/pluginstore/home_sync.go","lineNumber":76,"sourceCode":"\t\treturn fmt.Errorf(\"plugin sync response expired\")\n\t}\n\tseen := make(map[string]struct{}, len(r.Items))\n\tfor index := range r.Items {\n\t\titem := &r.Items[index]\n\t\tif errManifest := item.Manifest.Validate(); errManifest != nil {\n\t\t\treturn fmt.Errorf(\"plugin sync item %d: %w\", index, errManifest)\n\t\t}\n\t\tif errURLs := validatePluginSyncManifestURLs(item.Manifest); errURLs != nil {\n\t\t\treturn fmt.Errorf(\"plugin sync item %d: %w\", index, errURLs)\n\t\t}\n\t\tid := strings.TrimSpace(item.Manifest.ID)\n\t\tif _, exists := seen[id]; exists {\n\t\t\treturn fmt.Errorf(\"plugin sync response contains duplicate plugin %q\", id)\n\t\t}\n\t\tseen[id] = struct{}{}\n\t\tfor authIndex := range item.Auth {\n\t\t\tif errAuth := ValidateResolvedAuthConfig(item.Auth[authIndex]); errAuth != nil {\n\t\t\t\treturn fmt.Errorf(\"plugin sync item %d auth %d: %w\", index, authIndex, errAuth)\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc validatePluginSyncManifestURLs(manifest Manifest) error {\n\tif manifest.InstallType() != InstallTypeDirect {\n\t\treturn nil\n\t}\n\tplan := NormalizeInstallPlan(manifest.Install)\n\tif len(plan.Artifacts) == 0 {\n\t\treturn fmt.Errorf(\"direct plugin sync manifest requires pinned artifacts\")\n\t}\n\tfor index, artifact := range plan.Artifacts {\n\t\tparsed, errParse := url.Parse(strings.TrimSpace(artifact.URL))\n\t\tif errParse != nil || !strings.EqualFold(parsed.Scheme, \"https\") {\n\t\t\treturn fmt.Errorf(\"direct plugin sync artifact %d must use https\", index)","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/router-for-me/CLIProxyAPI/blob/78f0c4079e3e6273d65d03b5549cffc898703264/internal/pluginstore/home_sync.go#L58-L94","documentation":"Inside item N, one of the pre-resolved auth entries (ResolvedAuthConfig) failed ValidateResolvedAuthConfig, wrapped with both the item index and auth index. Sync-delivered auth must already be fully resolved and valid — a malformed entry aborts the whole response.","triggerScenarios":"Validate on a sync response where item N's auth array entry K has an invalid resolved value — unsupported auth type, missing token/secret fields, empty values.","commonSituations":"Server bug emitting partially-resolved auth; auth scheme change not reflected in the index; an entry intended for a different plugin type.","solutions":["Inspect the wrapped error to see which auth field is invalid","Fix or remove the auth entry at item N, auth K in the sync index","Re-fetch the index after the server corrects the payload"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"for i := range resp.Items {\n    for k := range resp.Items[i].Auth {\n        if err := pluginstore.ValidateResolvedAuthConfig(resp.Items[i].Auth[k]); err != nil {\n            return fmt.Errorf(\"item %d auth %d invalid: %w\", i, k, err)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \" auth \") {\n    // identify item/auth indexes from the message; drop or fix that auth entry\n}","preventionTips":["Server side: run ValidateResolvedAuthConfig on every auth entry before serving","Never ship partially-resolved auth configs in the index","Re-validate on the client after schema/auth format changes"],"tags":["auth","sync","validation","go"],"backgroundTag":null,"analyzedSha":"78f0c4079e3e6273d65d03b5549cffc898703264","analyzedAt":"2026-08-15T12:26:37.444Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}