{"record":{"id":"9be4078de2a3ed4d","repo":"diegosouzapw/OmniRoute","slug":"management-password-as-credential","errorCode":"MANAGEMENT_PASSWORD_AS_CREDENTIAL","errorMessage":"That value is the dashboard login password, not a provider API key. Storing it would send it upstream on every request routed through this connection.","messagePattern":"That value is the dashboard login password, not a provider API key\\. Storing it would send it upstream on every request routed through this connection\\.","errorType":"validation","errorClass":"ManagementPasswordAsCredentialError","httpStatus":null,"severity":"error","filePath":"src/lib/db/providers.ts","lineNumber":139,"sourceCode":"    // bootstrapped a password has nothing to collide with.\n    if (!isBcryptHash(stored)) return;\n    // Both forms of the value, because neither the login route nor the\n    // set-password route trims: a paste carries whitespace the password does\n    // not have, and a password is allowed to carry whitespace of its own. The\n    // second comparison only runs when the first fails on a different string.\n    const matches =\n      (await verifyManagementPassword(trimmed, stored)) ||\n      (trimmed !== apiKey && (await verifyManagementPassword(apiKey, stored)));\n    if (!matches) return;\n  } catch (err) {\n    console.warn(\n      \"[Providers] could not check the credential against the dashboard password:\",\n      err instanceof Error ? err.message : String(err)\n    );\n    return;\n  }\n\n  throw new ManagementPasswordAsCredentialError();\n}\n\ninterface StatementLike<TRow = unknown> {\n  all: (...params: unknown[]) => TRow[];\n  get: (...params: unknown[]) => TRow | undefined;\n  run: (...params: unknown[]) => { changes?: number };\n}\n\ninterface DbLike {\n  prepare: <TRow = unknown>(sql: string) => StatementLike<TRow>;\n  transaction: <T>(fn: () => T) => () => T;\n}\n\n// Real column set for provider_connections (must match the CREATE TABLE in\n// core.ts's SCHEMA_SQL). getProviderConnections()'s optional `columns`\n// projection is interpolated directly into the SELECT clause, so every\n// requested name must be validated against this allowlist before use —\n// there is no current caller that passes untrusted input, but the","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/lib/db/providers.ts#L121-L157","documentation":"Error \"That value is the dashboard login password, not a provider API key. Storing it would send it upstream on every request routed through this connection.\" thrown in diegosouzapw/OmniRoute.","triggerScenarios":"Thrown at src/lib/db/providers.ts:139 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","schemaVersion":2},"datasetVersion":"2026-08-25T21:54:21.419Z"}