{"record":{"id":"caf202dbd972a164","repo":"srbhr/Resume-Matcher","slug":"data-detail-failed-to-clear-api-keys-status","errorCode":null,"errorMessage":"${data.detail || Failed to clear API keys (status ${res.status}).}","messagePattern":"\\$\\{data\\.detail \\|\\| Failed to clear API keys \\(status \\$\\{res\\.status\\}\\)\\.\\}","errorType":"http","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"apps/frontend/lib/api/config.ts","lineNumber":528,"sourceCode":"    credentials: 'include',\n  });\n\n  if (!res.ok) {\n    const data = await res.json().catch(() => ({}));\n    throw new Error(data.detail || `Failed to delete API key (status ${res.status}).`);\n  }\n}\n\n// Clear all API keys\nexport async function clearAllApiKeys(): Promise<void> {\n  const res = await apiFetch('/config/api-keys?confirm=CLEAR_ALL_KEYS', {\n    method: 'DELETE',\n    credentials: 'include',\n  });\n\n  if (!res.ok) {\n    const data = await res.json().catch(() => ({}));\n    throw new Error(data.detail || `Failed to clear API keys (status ${res.status}).`);\n  }\n}\n\n// Reset database\nexport async function resetDatabase(): Promise<void> {\n  const res = await apiFetch('/config/reset', {\n    method: 'POST',\n    credentials: 'include',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({ confirm: 'RESET_ALL_DATA' }),\n  });\n\n  if (!res.ok) {\n    const data = await res.json().catch(() => ({}));\n    throw new Error(data.detail || `Failed to reset database (status ${res.status}).`);\n  }\n}\n","sourceCodeStart":510,"sourceCodeEnd":546,"githubUrl":"https://github.com/srbhr/Resume-Matcher/blob/116f9cc3b00e1ac91734a6c2679bf41ea64a0edc/apps/frontend/lib/api/config.ts#L510-L546","documentation":"clearAllApiKeys performs DELETE /config/api-keys?confirm=CLEAR_ALL_KEYS and throws this on any non-ok response, again preferring the backend `detail` message. The confirm query parameter is required by the backend; without it the server rejects the destructive bulk operation.","triggerScenarios":"Non-2xx on the bulk-clear DELETE: 400/403 when the confirm=CLEAR_ALL_KEYS parameter is missing/incorrect (safety check), 401 (expired session), 404 (route/proxy misconfiguration), 500 (key-store wipe failed).","commonSituations":"Manually constructing the request and forgetting the confirm param; clicking 'Clear all' after session timeout; backend refusing the wipe because the key store is locked or read-only (mounted volume permissions in Docker).","solutions":["Ensure the exact confirm token `CLEAR_ALL_KEYS` is sent as ?confirm=CLEAR_ALL_KEYS — any deviation makes the backend refuse.","401/403 → re-authenticate and retry; 5xx → inspect backend logs and key-store volume permissions.","Confirm the user intent in the UI (confirm-dialog) before calling, since this is irreversible.","Catch in handleClearApiKeys, display the detail, and re-fetch key status so the UI reflects what actually happened."],"exampleFix":"// before\nconst res = await apiFetch('/config/api-keys', { method: 'DELETE', credentials: 'include' });\n\n// after\nconst res = await apiFetch('/config/api-keys?confirm=CLEAR_ALL_KEYS', {\n  method: 'DELETE',\n  credentials: 'include',\n});","handlingStrategy":"validation","validationCode":"const CONFIRM = 'CLEAR_ALL_KEYS';\nconst url = `/config/api-keys?confirm=${encodeURIComponent(CONFIRM)}`;\nif (!url.includes('confirm=CLEAR_ALL_KEYS')) throw new Error('confirm token required');","typeGuard":"function hasClearAllConfirm(params: URLSearchParams): boolean {\n  return params.get('confirm') === 'CLEAR_ALL_KEYS';\n}","tryCatchPattern":"const ok = await confirmDialog({\n  title: 'Clear all API keys?',\n  tone: 'destructive',\n});\nif (!ok) return;\ntry {\n  await clearAllApiKeys();\n  showToast('All keys cleared');\n} catch (e) {\n  showToast(e instanceof Error ? e.message : 'Clear failed');\n}","preventionTips":["Never hand-build the request without the exact confirm token","Require an explicit user confirmation dialog before bulk destructive ops","Re-fetch key status after clearing so the UI matches server state","Check backend key-store volume permissions when 5xx persists"],"tags":["network","http","api-keys","destructive-operation"],"backgroundTag":"missing-confirm-parameter","analyzedSha":"116f9cc3b00e1ac91734a6c2679bf41ea64a0edc","analyzedAt":"2026-08-28T22:51:40.999Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}