{"record":{"id":"ab0c74c19b1c33d9","repo":"diegosouzapw/OmniRoute","slug":"oidc-allowed-subjects-required","errorCode":"OIDC_ALLOWED_SUBJECTS_REQUIRED","errorMessage":"oidcAllowedSubjects must contain at least one subject or email when oidcEnabled is true","messagePattern":"oidcAllowedSubjects must contain at least one subject or email when oidcEnabled is true","errorType":"validation","errorClass":null,"httpStatus":400,"severity":"error","filePath":"src/app/api/settings/route.ts","lineNumber":337,"sourceCode":"    // Sanitize model lockout settings: clamp values to valid bounds.\n    if (body.modelLockout) {\n      body.modelLockout = resolveModelLockoutSettings({\n        modelLockout: body.modelLockout as Record<string, unknown>,\n      }) as typeof body.modelLockout;\n    }\n\n    if (body.oidcEnabled === true) {\n      const current = await getSettings();\n      const subjects = Array.isArray(body.oidcAllowedSubjects)\n        ? (body.oidcAllowedSubjects as unknown[])\n        : ((current.oidcAllowedSubjects as unknown[] | undefined) ?? []);\n      const hasAtLeastOne = subjects.some((s) => typeof s === \"string\" && s.trim().length > 0);\n      if (!hasAtLeastOne) {\n        emitSettingsFailureAudit(request, actor, \"OIDC_ALLOWED_SUBJECTS_REQUIRED\", attemptedKeys);\n        return NextResponse.json(\n          {\n            error: {\n              code: \"OIDC_ALLOWED_SUBJECTS_REQUIRED\",\n              message:\n                \"oidcAllowedSubjects must contain at least one subject or email when oidcEnabled is true\",\n            },\n          },\n          { status: 400 }\n        );\n      }\n    }\n\n    // VALIDATED body so we never trip on stray unknown keys. If any security\n    // key is present, require currentPassword + verify against the stored\n    // bcrypt hash. Dedupes with the previous inline newPassword reauth — the\n    // password is verified at most once per PATCH.\n    const touchedSecurityKeys = SECURITY_IMPACTING_KEYS.filter((k) => k in validation.data);\n    if (touchedSecurityKeys.length > 0) {\n      const settings = await getSettings();\n      // Lazy-hash any plaintext INITIAL_PASSWORD migration BEFORE we read the\n      // stored hash, so the gate works on fresh deploys too.","sourceCodeStart":319,"sourceCodeEnd":355,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/app/api/settings/route.ts#L319-L355","documentation":"Error \"oidcAllowedSubjects must contain at least one subject or email when oidcEnabled is true\" thrown in diegosouzapw/OmniRoute.","triggerScenarios":"Thrown at src/app/api/settings/route.ts:337 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","schemaVersion":2},"datasetVersion":"2026-08-25T21:54:21.419Z"}