{"record":{"id":"5685a64840393f82","repo":"diegosouzapw/OmniRoute","slug":"password-mismatch","errorCode":"PASSWORD_MISMATCH","errorMessage":"Invalid current password","messagePattern":"Invalid current password","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"src/app/api/settings/route.ts","lineNumber":391,"sourceCode":"          emitSettingsFailureAudit(request, actor, \"PASSWORD_REQUIRED\", attemptedKeys);\n          return NextResponse.json(\n            {\n              error: {\n                code: \"PASSWORD_REQUIRED\",\n                message: \"currentPassword required for security-impacting setting changes\",\n                keys: touchedSecurityKeys,\n              },\n            },\n            { status: 400 }\n          );\n        }\n        const isValid = await verifyManagementPassword(body.currentPassword, storedPasswordHash);\n        if (!isValid) {\n          emitSettingsFailureAudit(request, actor, \"PASSWORD_MISMATCH\", attemptedKeys);\n          return NextResponse.json(\n            {\n              error: {\n                code: \"PASSWORD_MISMATCH\",\n                message: \"Invalid current password\",\n              },\n            },\n            { status: 401 }\n          );\n        }\n      }\n    }\n\n    // #6540: reject a paid-only webSearchRouteModel target when hidePaidModels\n    // is on. Business-rule check (needs an async DB read), so it runs after\n    // Zod shape validation rather than as a Zod .refine(). Fails open on\n    // \"unknown\" (aliases/combo names) — only a positively-identified paid\n    // catalog entry is blocked.\n    if (typeof body.webSearchRouteModel === \"string\" && body.webSearchRouteModel.trim() !== \"\") {\n      const currentSettings = await getSettings();\n      if ((currentSettings as Record<string, unknown>)?.hidePaidModels === true) {\n        if (isPaidModelTarget(body.webSearchRouteModel) === \"paid\") {","sourceCodeStart":373,"sourceCodeEnd":409,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/app/api/settings/route.ts#L373-L409","documentation":"Error \"Invalid current password\" thrown in diegosouzapw/OmniRoute.","triggerScenarios":"Thrown at src/app/api/settings/route.ts:391 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","schemaVersion":2},"datasetVersion":"2026-08-25T21:54:21.419Z"}