{"record":{"id":"793ec7f601d17957","repo":"odysseus-dev/odysseus","slug":"ids-must-be-a-list","errorCode":null,"errorMessage":"ids must be a list","messagePattern":"ids must be a list","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"routes/note/note_routes.py","lineNumber":908,"sourceCode":"            finally:\n                db.close()\n\n        return await dispatch_reminder(\n            title=title, note_body=note_body, note_id=note_id,\n            owner=caller or \"\",\n            queue_browser=False,\n            settings_override=_override or None,\n        )\n\n    # --- REORDER NOTES ---\n    @router.post(\"/reorder\")\n    async def reorder_notes(request: Request):\n        \"\"\"Update sort_order for a list of note IDs in the order provided.\"\"\"\n        user = _owner(request)\n        body = await request.json()\n        ids = body.get(\"ids\", [])\n        if not isinstance(ids, list):\n            raise HTTPException(400, \"ids must be a list\")\n        # v2 review HIGH-12: drop the legacy `(owner == user) | (owner ==\n        # None)` OR which let an authenticated user silently reorder\n        # every legacy-null-owner note belonging to other accounts. In\n        # an unconfigured (single-user) auth deploy the OR is still safe\n        # because there's no second user to attack; we keep that branch\n        # explicit and gated on AuthManager.is_configured.\n        try:\n            from core.auth import AuthManager\n            _allow_null = not AuthManager().is_configured\n        except Exception:\n            _allow_null = False\n        db = SessionLocal()\n        try:\n            for i, nid in enumerate(ids):\n                q = db.query(Note).filter(Note.id == nid)\n                if user is not None:\n                    if _allow_null:\n                        q = q.filter((Note.owner == user) | (Note.owner == None))  # noqa: E711","sourceCodeStart":890,"sourceCodeEnd":926,"githubUrl":"https://github.com/odysseus-dev/odysseus/blob/f9235ebbf13f693a6fd29ce70b097f6ec83705bf/routes/note/note_routes.py#L890-L926","documentation":"Error \"ids must be a list\" thrown in odysseus-dev/odysseus.","triggerScenarios":"Triggered when the corresponding server-side validation or runtime check at the recorded location rejects the request or operation and returns this error message to the caller.","commonSituations":"See trigger scenarios.","solutions":["Send ids as a JSON array in the request body.","Fix the client payload shape for the bulk operation."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"f9235ebbf13f693a6fd29ce70b097f6ec83705bf","analyzedAt":"2026-08-14T21:47:48.359Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}