{"record":{"id":"6bcda8579b340d51","repo":"srbhr/Resume-Matcher","slug":"confirmation-required-pass-confirm-reset-all-data","errorCode":null,"errorMessage":"Confirmation required. Pass confirm=RESET_ALL_DATA in request body.","messagePattern":"Confirmation required\\. Pass confirm=RESET_ALL_DATA in request body\\.","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"apps/backend/app/routers/config.py","lineNumber":669,"sourceCode":"\n    WARNING: This action is irreversible. It will:\n    1. Truncate all database tables (resumes, jobs, improvements)\n    2. Delete all uploaded files\n\n    Requires confirmation token for safety.\n\n    Args:\n        request: Request body containing confirmation token\n\n    Returns:\n        Success message\n\n    Note:\n        This is a local-only endpoint for single-user deployments.\n        In production/multi-user scenarios, add proper authentication.\n    \"\"\"\n    if request.confirm != \"RESET_ALL_DATA\":\n        raise HTTPException(\n            status_code=400,\n            detail=\"Confirmation required. Pass confirm=RESET_ALL_DATA in request body.\",\n        )\n    await db.reset_database()\n    return {\"message\": \"Database and all data have been reset successfully\"}\n","sourceCodeStart":651,"sourceCodeEnd":675,"githubUrl":"https://github.com/srbhr/Resume-Matcher/blob/116f9cc3b00e1ac91734a6c2679bf41ea64a0edc/apps/backend/app/routers/config.py#L651-L675","documentation":"Raised by the reset_database_endpoint in apps/backend/app/routers/config.py as a destructive-action safeguard. The endpoint wipes the database only when the request body explicitly carries confirm=\"RESET_ALL_DATA\"; anything else gets a 400 before db.reset_database() runs.","triggerScenarios":"POSTing to the database reset endpoint with a missing, misspelled, or wrong confirm field (e.g. confirm=true, confirm=\"reset\", or omitting the body entirely).","commonSituations":"Client UI not sending the exact sentinel string; testing the endpoint with an empty body; calling it via curl/Postman without the JSON body; API clients assuming a simple confirmation flag.","solutions":["Send a JSON body of {\"confirm\": \"RESET_ALL_DATA\"} exactly, case-sensitive","Verify the request Content-Type is application/json and the body is parsed into the request model","Confirm the client model field is named confirm and typed as a string","Back up data first — a confirmed call irreversibly resets the database"],"exampleFix":"// before\nPOST /config/reset-database  {}\n// after\nPOST /config/reset-database  {\"confirm\": \"RESET_ALL_DATA\"}","handlingStrategy":"validation","validationCode":"if (body?.confirm !== 'RESET_ALL_DATA') throw new Error('Reset requires confirm=RESET_ALL_DATA');","typeGuard":null,"tryCatchPattern":"try { await api.resetDatabase({confirm:'RESET_ALL_DATA'}); } catch (e) { if (e.status === 400) console.error('Confirmation string missing/incorrect'); else throw e; }","preventionTips":["Copy the exact sentinel string from the API docs; it is case-sensitive","Back up the DB before any reset call","Gate the reset button behind a typed confirmation in the UI","Never construct the body dynamically from user free-text"],"tags":["http","validation","destructive-action","confirmation"],"backgroundTag":"missing-confirmation-token","analyzedSha":"116f9cc3b00e1ac91734a6c2679bf41ea64a0edc","analyzedAt":"2026-08-28T22:51:40.999Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}