{"record":{"id":"a57b926f3dd3ca8f","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-arguments","errorCode":"error-invalid-arguments","errorMessage":"Invalid arguments","messagePattern":"Invalid arguments","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/auth/oauth2-server/addOAuthApp.ts","lineNumber":41,"sourceCode":"\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'addOAuthApp' });\n\t}\n\n\tif (!applicationParams.name || typeof applicationParams.name.valueOf() !== 'string' || applicationParams.name.trim() === '') {\n\t\tthrow new Meteor.Error('error-invalid-name', 'Invalid name', { method: 'addOAuthApp' });\n\t}\n\n\tif (\n\t\t!applicationParams.redirectUri ||\n\t\ttypeof applicationParams.redirectUri.valueOf() !== 'string' ||\n\t\tapplicationParams.redirectUri.trim() === ''\n\t) {\n\t\tthrow new Meteor.Error('error-invalid-redirectUri', 'Invalid redirectUri', {\n\t\t\tmethod: 'addOAuthApp',\n\t\t});\n\t}\n\n\tif (typeof applicationParams.active !== 'boolean') {\n\t\tthrow new Meteor.Error('error-invalid-arguments', 'Invalid arguments', {\n\t\t\tmethod: 'addOAuthApp',\n\t\t});\n\t}\n\n\tconst application = {\n\t\t...applicationParams,\n\t\tredirectUri: parseUriList(applicationParams.redirectUri),\n\t\tclientId: Random.id(),\n\t\tclientSecret: Random.secret(),\n\t\t_createdAt: new Date(),\n\t\t_updatedAt: new Date(),\n\t\t_createdBy: {\n\t\t\t_id: user._id,\n\t\t\tusername: user.username,\n\t\t},\n\t};\n\n\tif (application.redirectUri.length === 0) {","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/auth/oauth2-server/addOAuthApp.ts#L23-L59","documentation":"addOAuthApp requires applicationParams.active to be a literal boolean. JSON clients that send \"active\": \"true\" (string), 1/0, or omit it are rejected. The REST ajv schema already enforces type boolean, so this Meteor.Error mostly bites direct/internal callers whose values were coerced on the way in.","triggerScenarios":"POST /api/v1/oauth-apps.create with { active: 'true' } or { active: 1 }; direct addOAuthApp calls passing a truthy non-boolean; form serializers that turn checkboxes into strings.","commonSituations":"HTML form encoders serializing booleans as strings; scripting clients using query-string semantics where everything is a string; refactors that changed the field type.","solutions":["Send the JSON literal true or false for active","Coerce on the client before posting: active: Boolean(formData.active) with an explicit checkbox mapping","For direct calls, type-check params against OauthAppsAddParams before invoking"],"exampleFix":"// before\n{ \"name\": \"App\", \"active\": \"true\", \"redirectUri\": \"https://app.example.com/cb\" }\n\n// after\n{ \"name\": \"App\", \"active\": true, \"redirectUri\": \"https://app.example.com/cb\" }","handlingStrategy":"type-guard","validationCode":"// client-side: send a real boolean, not a form-encoded string\nconst active = form.active === true || form.active === 'true'; // explicit mapping\nawait post('/oauth-apps.create', { ...form, active }); // JSON body keeps it boolean","typeGuard":"const isBoolean = (v: unknown): v is boolean => typeof v === 'boolean';\n\nconst isValidActiveFlag = (p: unknown): boolean =>\n  typeof p === 'object' && p !== null && isBoolean((p as any).active);","tryCatchPattern":"try {\n  await addOAuthApp(params, uid);\n} catch (error) {\n  if (error instanceof Meteor.Error && error.error === 'error-invalid-arguments') {\n    setFieldError('active', 'Active must be true or false');\n  } else {\n    throw error;\n  }\n}","preventionTips":["Send JSON bodies so booleans stay booleans","Map checkbox inputs explicitly to booleans instead of relying on serialization","Type-check payloads against the API schema in client code"],"tags":["oauth-apps","validation","type-error","rest-api"],"backgroundTag":"api-request-validation-failed","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}