{"record":{"id":"c10f058cf8911ee4","repo":"windmill-labs/windmill","slug":"unexpected-oauths-value-type-typeof-s-value","errorCode":null,"errorMessage":"Unexpected oauths value type: ${typeof s.value}","messagePattern":"Unexpected oauths value type: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"cli/src/core/settings.ts","lineNumber":543,"sourceCode":"): Promise<GlobalSetting[]> {\n  const encKey = process.env.WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY;\n  if (encKey) {\n    const res: GlobalSetting[] = [];\n\n    for (const s of settings) {\n      if (SENSITIVE_FIELD.includes(s.name) && typeof s.value === \"string\") {\n        res.push(\n          (await processField(s, \"value\", encKey, mode)) as GlobalSetting\n        );\n      } else if (s.name == \"oauths\") {\n        if (typeof s.value === \"object\") {\n          const oauths = s.value as { [key: string]: any };\n          for (const [k, v] of Object.entries(oauths)) {\n            oauths[k] = await processField(v, \"secret\", encKey, mode);\n          }\n          res.push(s);\n        } else {\n          log.warn(`Unexpected oauths value type: ${typeof s.value}`);\n          res.push(s);\n        }\n      } else {\n        res.push(s);\n      }\n    }\n    return res;\n  } else {\n    log.warn(\n      \"No encryption key found, skipping encryption. Recommend setting WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY\"\n    );\n  }\n  return settings;\n}\n\nasync function processField(\n  obj: { [key: string]: any },\n  field: string,","sourceCodeStart":525,"sourceCodeEnd":561,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/cli/src/core/settings.ts#L525-L561","documentation":"processInstanceSettings encrypts/decrypts sensitive fields when syncing instance settings. For the `oauths` setting it expects s.value to be an object mapping oauth client names to {secret: ...} objects. If the value is not an object (null, string, array, etc.), it skips encryption for that setting and logs this warning, pushing the setting through unprocessed. The `oauths` check uses typeof === \"object\" which does not guard against null, so a null value in YAML is the classic hit.","triggerScenarios":"Calling processInstanceSettings (via processedSettings, pullInstanceSettings, or pushInstanceSettings) when the `oauths` setting's value is not a plain object — typically a null, a string, or an array in instance_settings.yaml.","commonSituations":"Hand-editing instance_settings.yaml and setting `oauths:` with no value (YAML null); a partial copy of settings between instances; a tool that stringified the oauths block; pulling from an instance where oauths was never configured and serializing oddly.","solutions":["Open instance_settings.yaml and make the oauths value a mapping of client name to {secret: ...}, e.g. `oauths:\\n  google:\\n    secret: <value>`.","Replace a bare `oauths:` (null) with either a proper mapping or remove the setting entirely to sync nothing.","Re-run `wmill settings pull` to regenerate the file in the correct shape from the remote.","Re-pull if the file came from another instance/format conversion that flattened oauths."],"exampleFix":"// before (broken YAML)\noauths:\n\n// after\noauths:\n  google:\n    client_id: my-id\n    secret: my-secret","handlingStrategy":"type-guard","validationCode":"const settings = yaml.parse(readFileSync(\"instance_settings.yaml\", \"utf8\")) as GlobalSetting[];\nconst oauths = settings.find((s) => s.name === \"oauths\");\nif (oauths && (oauths.value === null || typeof oauths.value !== \"object\")) {\n  throw new Error(\"oauths must be a mapping of client name to {secret: ...}\");\n}","typeGuard":"function isOAuthsValue(v: unknown): v is Record<string, { secret: string }> {\n  return typeof v === \"object\" && v !== null && !Array.isArray(v) && Object.values(v).every((c) => typeof c === \"object\" && c !== null);\n}","tryCatchPattern":"if (oauthsSetting && !isOAuthsValue(oauthsSetting.value)) {\n  log.warn(\"skipping oauths: expected mapping of client -> {secret}\");\n}","preventionTips":["Never leave `oauths:` with a null value in instance_settings.yaml — delete the setting or fill the mapping","Regenerate the file with `wmill settings pull` instead of hand-editing structure","Add a JSON/YAML schema check for settings files in CI","Diff hand edits against a fresh pull to catch shape drift"],"tags":["cli","type-mismatch","yaml","encryption","oauth"],"backgroundTag":"unexpected-value-type","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}