{"record":{"id":"69cdb1809e6ab47b","repo":"iOfficeAI/AionUi","slug":"webui-api-webui-reset-password-returned-no-new","errorCode":null,"errorMessage":"[WebUI] /api/webui/reset-password returned no new_password","messagePattern":"\\[WebUI\\] /api/webui/reset-password returned no new_password","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/desktop/src/process/bridge/webuiBridge.ts","lineNumber":74,"sourceCode":"  }\n  const statusRes = await fetch(`http://127.0.0.1:${port}/api/auth/status`);\n  if (!statusRes.ok) {\n    throw new Error(`[WebUI] /api/auth/status returned ${statusRes.status}`);\n  }\n  const statusJson = (await statusRes.json()) as { needs_setup?: boolean; data?: { needs_setup?: boolean } };\n  const needsSetup = statusJson.needs_setup ?? statusJson.data?.needs_setup ?? false;\n  if (!needsSetup) {\n    setDesktopWebUIInitialPassword(undefined);\n    return;\n  }\n  const resetRes = await fetch(`http://127.0.0.1:${port}/api/webui/reset-password`, { method: 'POST' });\n  if (!resetRes.ok) {\n    throw new Error(`[WebUI] /api/webui/reset-password returned ${resetRes.status}`);\n  }\n  const resetJson = (await resetRes.json()) as { data?: { new_password?: string }; new_password?: string };\n  const newPassword = resetJson.data?.new_password ?? resetJson.new_password;\n  if (!newPassword) {\n    throw new Error('[WebUI] /api/webui/reset-password returned no new_password');\n  }\n  setDesktopWebUIInitialPassword(newPassword);\n}\n\nexport function initWebuiBridge(): void {\n  ipcBridge.webui.getStatus.provider(async () => {\n    const snapshot = getDesktopWebUIStatus();\n    const adminUsername = await fetchAdminUsername();\n    return { ...snapshot, adminUsername };\n  });\n\n  ipcBridge.webui.start.provider(async (params) => {\n    await maybeSeedInitialPassword();\n    const handle = await startDesktopWebUI({\n      port: params?.port,\n      allowRemote: params?.allowRemote,\n    });\n    ipcBridge.webui.statusChanged.emit({","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/iOfficeAI/AionUi/blob/711aa0550ee183ea495dc33e2c05c7943b70a60a/packages/desktop/src/process/bridge/webuiBridge.ts#L56-L92","documentation":"Thrown when POST /api/webui/reset-password succeeds (2xx) but the JSON response contains no new_password field (neither data.new_password nor top-level new_password). The seeding flow cannot capture a credential to show the user.","triggerScenarios":"Backend returns 200 with a differently shaped payload, e.g. {data:{}} or a renamed field, so newPassword is undefined.","commonSituations":"Backend API version drift where the response schema changed (field renamed, nesting moved), or an error payload returned with 200 status.","solutions":["Inspect the actual response body (add a log of resetJson before throwing)","Align the desktop client with the backend's current response schema (data.new_password vs new_password)","Pin or upgrade together desktop and aioncore backend versions so schemas match","Add backend-side contract tests for the reset-password response shape"],"exampleFix":"// before\nconst newPassword = resetJson.data?.new_password ?? resetJson.new_password;\n\n// after (also accept token-style shapes and log for diagnosis)\nconst newPassword = resetJson.data?.new_password ?? resetJson.new_password ?? resetJson.data?.password;\nif (!newPassword) {\n  console.error('[WebUI] reset-password unexpected payload:', JSON.stringify(resetJson));\n  throw new Error('[WebUI] /api/webui/reset-password returned no new_password');\n}","handlingStrategy":"type-guard","validationCode":"const json = (await resetRes.json()) as { data?: { new_password?: string } };\nif (!json.data?.new_password) { /* log payload, surface schema mismatch clearly */ }","typeGuard":"function hasNewPassword(v: unknown): v is { data: { new_password: string } } {\n  return typeof (v as { data?: { new_password?: unknown } })?.data?.new_password === 'string';\n}","tryCatchPattern":"catch (err) { log.error('[WebUI] reset payload:', err.message, rawBody); throw err; }","preventionTips":["Share response types between desktop and backend packages","Log raw payloads when shape checks fail","Add schema tests for auth/reset endpoints"],"tags":["webui","password-reset","api-contract","schema"],"backgroundTag":"missing-response-field","analyzedSha":"711aa0550ee183ea495dc33e2c05c7943b70a60a","analyzedAt":"2026-08-28T07:56:06.558Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}