{"record":{"id":"bc2ef87edacbc492","repo":"can1357/oh-my-pi","slug":"security-scans-require-a-stored-oauth-account-for","errorCode":null,"errorMessage":"Security scans require a stored OAuth account for ${provider}","messagePattern":"Security scans require a stored OAuth account for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/security/auth.ts","lineNumber":45,"sourceCode":"\t\t(account.organizationName !== undefined && account.organizationName !== resolution.orgName)\n\t) {\n\t\tthrow new Error(\"Security scan authentication identity mismatch\");\n\t}\n}\n\nexport function selectSecurityAccount(\n\tauthStorage: AuthStorage,\n\tprovider: string,\n\trequestedCredentialId?: number,\n\tsessionId?: string,\n): SecurityAccountRef {\n\tconst accounts = authStorage.listOAuthAccounts(provider, sessionId);\n\tconst selected =\n\t\trequestedCredentialId !== undefined\n\t\t\t? accounts.find(account => account.credentialId === requestedCredentialId)\n\t\t\t: (accounts.find(account => account.active) ?? (accounts.length === 1 ? accounts[0] : undefined));\n\tif (!selected) {\n\t\tif (accounts.length === 0) throw new Error(`Security scans require a stored OAuth account for ${provider}`);\n\t\tif (requestedCredentialId !== undefined) {\n\t\t\tthrow new Error(`Security OAuth credential ${requestedCredentialId} is not available for ${provider}`);\n\t\t}\n\t\tthrow new Error(\n\t\t\t`Multiple OAuth accounts are available for ${provider}; supply credentialId to pin one exact account`,\n\t\t);\n\t}\n\tconst account: SecurityAccountRef = { provider, credentialId: selected.credentialId };\n\tif (selected.accountId !== undefined) account.accountId = selected.accountId;\n\tif (selected.email !== undefined) account.email = selected.email;\n\tif (selected.orgId !== undefined) account.organizationId = selected.orgId;\n\tif (selected.orgName !== undefined) account.organizationName = selected.orgName;\n\treturn account;\n}\n\nexport async function resolveExactSecurityOAuthAccess(\n\tauthStorage: AuthStorage,\n\taccount: SecurityAccountRef,","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/security/auth.ts#L27-L63","documentation":"selectSecurityAccount looks up stored OAuth accounts for the given provider (optionally scoped to a session). If none exist at all, it throws this error because security scans require an authenticated account to run under.","triggerScenarios":"Requesting a security scan for a provider that has zero OAuth accounts in authStorage (for that session id).","commonSituations":"Never having run the OAuth login flow for the provider; scanning in a fresh environment/container without copied credentials; session-scoped accounts not visible to the current session id.","solutions":["Complete the OAuth login flow for the provider so an account is stored","Check you are passing the right provider name and sessionId","Copy/import credentials into the auth storage if migrating environments"],"exampleFix":"// before\nawait runScan({ provider: \"github\" }); // no stored OAuth account\n// after\nawait authenticateProvider(\"github\"); // OAuth flow first\nawait runScan({ provider: \"github\" });","handlingStrategy":"validation","validationCode":"const accounts = authStorage.listOAuthAccounts(provider, sessionId);\nif (accounts.length === 0) {\n  throw new Error(`no stored OAuth account for ${provider}; run the login flow first`);\n}","typeGuard":"null","tryCatchPattern":"try {\n  const account = selectSecurityAccount(authStorage, provider, requestedCredentialId, sessionId);\n} catch (err) {\n  if (err instanceof Error && err.message.startsWith(\"Security scans require a stored OAuth account\")) {\n    await runOAuthLogin(provider);\n  } else throw err;\n}","preventionTips":["Run the OAuth login flow for each provider before enabling security scans","In CI, provision credentials into auth storage before the scan step","Double-check provider name spelling and sessionId scoping"],"tags":["auth","oauth","configuration"],"backgroundTag":"missing-oauth-account","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}