{"record":{"id":"dd5b761b6ef119ca","repo":"paperclipai/paperclip","slug":"authenticated-public-exposure-requires-auth-baseur","errorCode":null,"errorMessage":"authenticated public exposure requires auth.baseUrlMode=explicit","messagePattern":"authenticated public exposure requires auth\\.baseUrlMode=explicit","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/src/index.ts","lineNumber":654,"sourceCode":"  };\n  startupDatabase.close = closeDatabaseClients;\n  \n  // A claimed warm-pool stack may restart while its provider environment still\n  // names the pool host. Restore the signed, durable identity before Better\n  // Auth, routes, or child-runtime configuration capture any public URL.\n  const restoredCloudRuntimeIdentity = await initializeCloudRuntimeIdentity(db as any);\n  if (restoredCloudRuntimeIdentity) config = loadConfig();\n\n  if (config.deploymentMode === \"local_trusted\" && !isLoopbackHost(config.host)) {\n    throw new Error(\n      `local_trusted mode requires loopback host binding (received: ${config.host}). ` +\n        \"Use authenticated mode for non-loopback deployments.\",\n    );\n  }\n  \n  if (config.deploymentMode === \"local_trusted\" && config.deploymentExposure !== \"private\") {\n    throw new Error(\"local_trusted mode only supports private exposure\");\n  }\n  \n  if (config.deploymentMode === \"authenticated\") {\n    if (config.authBaseUrlMode === \"explicit\" && !config.authPublicBaseUrl) {\n      throw new Error(\"auth.baseUrlMode=explicit requires auth.publicBaseUrl\");\n    }\n    if (config.deploymentExposure === \"public\") {\n      if (config.authBaseUrlMode !== \"explicit\") {\n        throw new Error(\"authenticated public exposure requires auth.baseUrlMode=explicit\");\n      }\n      if (!config.authPublicBaseUrl) {\n        throw new Error(\"authenticated public exposure requires auth.publicBaseUrl\");\n      }\n    }\n  }\n\n  const requestedListenPort = config.port;\n  const listenPort = await detectPort({\n    port: requestedListenPort,","sourceCodeStart":636,"sourceCodeEnd":672,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/index.ts#L636-L672","documentation":"Config consistency check in startServer (authenticated mode branch): deploymentExposure is 'public' but auth.baseUrlMode is not 'explicit'. Public authenticated deployments must pin an explicit auth base URL (see the companion check requiring auth.publicBaseUrl), so any other baseUrlMode is rejected at boot.","triggerScenarios":"Thrown at server/src/index.ts:535 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set auth.baseUrlMode=explicit for authenticated public exposure.","Use private exposure or local_trusted mode instead."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}