{"record":{"id":"792279d7fa3b2b9d","repo":"ruvnet/RuView","slug":"prompt-must-be-a-non-empty-string-792279","errorCode":null,"errorMessage":"prompt must be a non-empty string","messagePattern":"prompt must be a non-empty string","errorType":"validation","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"harness/homecore/src/hosts/codex.js","lineNumber":38,"sourceCode":"    '--json',\n    '--strict-config',\n    '--ignore-user-config',\n    '-',\n  ];\n}\n\nexport async function runCodex({\n  prompt,\n  repoRoot,\n  trustedRoot = repoRoot,\n  allowWrite = false,\n  confirm = false,\n  command = 'codex',\n  commandArgs = [],\n  ...runOptions\n}) {\n  if (typeof prompt !== 'string' || !prompt.trim()) {\n    throw new TypeError('prompt must be a non-empty string');\n  }\n  const root = assertTrustedHomecoreRepo(repoRoot, { trustedRoot });\n  const write = allowWrite === true && confirm === true;\n  const input = `${SAFETY_PREFIX}\\n\\nUser task:\\n${prompt.trim()}`;\n  return runProcess(\n    command,\n    [...commandArgs, ...buildCodexArgs(root, { write })],\n    { ...runOptions, cwd: root, input },\n  );\n}\n\nexport default Object.freeze({ name: 'codex', run: runCodex, buildArgs: buildCodexArgs });\n","sourceCodeStart":20,"sourceCodeEnd":51,"githubUrl":"https://github.com/ruvnet/RuView/blob/4685618388a5e49fad5b3005806f3bdd6a7c25c3/harness/homecore/src/hosts/codex.js#L20-L51","documentation":"The require_role FastAPI dependency (auth.py:450) raises HTTPException 403 \"Role '{role}' required\" when the authenticated user lacks the role. Identical logic to the decorator variant (error 15) but delivered as a proper 403 response object with the role name interpolated.","triggerScenarios":"Depends(require_role('admin')) on an endpoint called by a user whose roles are ['user']; role claim stale in an unexpired token; role string mismatch (case/whitespace) between user provisioning and the dependency argument.","commonSituations":"Default-role users hitting privileged endpoints; forgetting to re-login after an admin grants a role; renaming roles in one place but not in route dependencies.","solutions":["Add the required role to the user's roles and obtain a new token via login","Verify the exact role string matches between check_permission input and provisioned roles","For ops break-glass, use an account with the 'admin' super-role which check_permission always passes"],"exampleFix":"# before\nrouter.get('/api/admin/users', dependencies=[Depends(require_role('admin'))])\n# called with token whose roles=['user'] -> 403\n# after\nuser_manager._users['alice']['roles'] = ['admin']\n# then re-login so the JWT roles claim updates","handlingStrategy":"type-guard","validationCode":"def role_dependency_will_pass(auth_middleware, user_info: dict, role: str) -> bool:\n    \"\"\"Same predicate the dependency applies before raising 403.\"\"\"\n    return bool(user_info) and auth_middleware.check_permission(user_info, role)","typeGuard":"def role_satisfied(user_info, role: str) -> bool:\n    roles = (user_info or {}).get(\"roles\") or []\n    return isinstance(roles, list) and (\"admin\" in roles or role in roles)","tryCatchPattern":"from fastapi import HTTPException\n\ntry:\n    user = require_role(\"admin\")(request)\nexcept HTTPException as e:\n    if e.status_code == 403:\n        log_denied_access(path=request.url.path, required=extract_role(e.detail))\n    raise","preventionTips":["Mint fresh tokens after role changes","Keep a single source of truth for role names (constants module)","Return 403 without detail echoes in public APIs to avoid role enumeration"],"tags":["auth","authorization","rbac","http-403"],"backgroundTag":null,"analyzedSha":"4685618388a5e49fad5b3005806f3bdd6a7c25c3","analyzedAt":"2026-08-16T06:09:40.886Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}