{"record":{"id":"599ffb2f6a5ad0ee","repo":"router-for-me/CLIProxyAPI","slug":"auth-path-is-empty-599ffb","errorCode":null,"errorMessage":"auth path is empty","messagePattern":"auth path is empty","errorType":"http","errorClass":null,"httpStatus":500,"severity":"warning","filePath":"internal/api/handlers/management/auth_files_fields.go","lineNumber":672,"sourceCode":"\t\treturn strings.EqualFold(left, right)\n\t}\n\treturn left == right\n}\n\nfunc cleanAuthFilePath(path string) string {\n\tpath = strings.TrimSpace(path)\n\tif path == \"\" {\n\t\treturn \"\"\n\t}\n\tif abs, errAbs := filepath.Abs(path); errAbs == nil && strings.TrimSpace(abs) != \"\" {\n\t\tpath = abs\n\t}\n\treturn filepath.Clean(path)\n}\n\nfunc (h *Handler) deleteTokenRecord(ctx context.Context, path string) error {\n\tif strings.TrimSpace(path) == \"\" {\n\t\treturn fmt.Errorf(\"auth path is empty\")\n\t}\n\tstore := h.tokenStoreWithBaseDir()\n\tif store == nil {\n\t\treturn fmt.Errorf(\"token store unavailable\")\n\t}\n\treturn store.Delete(ctx, path)\n}\n\nfunc (h *Handler) tokenStoreWithBaseDir() coreauth.Store {\n\tif h == nil {\n\t\treturn nil\n\t}\n\tstore := h.tokenStore\n\tif store == nil {\n\t\tstore = sdkAuth.GetTokenStore()\n\t\th.tokenStore = store\n\t}\n\tif h.cfg != nil {","sourceCodeStart":654,"sourceCodeEnd":690,"githubUrl":"https://github.com/router-for-me/CLIProxyAPI/blob/78f0c4079e3e6273d65d03b5549cffc898703264/internal/api/handlers/management/auth_files_fields.go#L654-L690","documentation":"deleteTokenRecord was called with a path that is empty after trimming. The handler refuses rather than calling store.Delete with a blank path, which could resolve to the wrong record depending on the store backend. This is a caller or record-shape problem: the auth being deleted has no file path attribute.","triggerScenarios":"DELETE of an auth record whose \"path\" attribute is missing or blank (record from an external store or a custom synthesizer); internal calls passing an untrimmed empty string.","commonSituations":"Deleting credentials created programmatically without a backing file; attribute stripping when records round-trip through Postgres/git/object stores; test fixtures with minimal records.","solutions":["GET the auth record and inspect its attributes to see whether a path is expected","If the record is file-backed, repair or regenerate it so the path attribute is populated, then retry the delete","If it is intentionally file-less, remove it via the store's own delete endpoint rather than the file-based path","Audit custom code that creates auth records without setting the path attribute"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if strings.TrimSpace(path) == \"\" {\n    return errors.New(\"cannot delete token record: auth has no file path\")\n}","typeGuard":"func authHasFilePath(auth *coreauth.Auth) bool {\n    return auth != nil && strings.TrimSpace(authAttribute(auth, \"path\")) != \"\"\n}","tryCatchPattern":null,"preventionTips":["Ensure record-creation flows always set the path attribute","Prefer store-native delete endpoints for file-less records"],"tags":["validation","auth","nil-guard"],"backgroundTag":null,"analyzedSha":"78f0c4079e3e6273d65d03b5549cffc898703264","analyzedAt":"2026-08-15T12:26:37.444Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}