{"record":{"id":"f28aab5442ce4a45","repo":"paperclipai/paperclip","slug":"auth-baseurlmode-explicit-requires-auth-publicbase","errorCode":null,"errorMessage":"auth.baseUrlMode=explicit requires auth.publicBaseUrl","messagePattern":"auth\\.baseUrlMode=explicit requires auth\\.publicBaseUrl","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/src/index.ts","lineNumber":650,"sourceCode":"  // by the fail-loud startup path, so no exit leaves pooled backends behind.\n  const closeDatabaseClients = async () => {\n    const clients = pluginMigrationDb === db ? [db] : [db, pluginMigrationDb];\n    await Promise.all(clients.map((client) => endDatabaseClient(client, 5)));\n  };\n  startupDatabase.close = closeDatabaseClients;\n  \n  // A claimed warm-pool stack may restart while its provider environment still\n  // names the pool host. Restore the signed, durable identity before Better\n  // Auth, routes, or child-runtime configuration capture any public URL.\n  const restoredCloudRuntimeIdentity = await initializeCloudRuntimeIdentity(db as any);\n  if (restoredCloudRuntimeIdentity) config = loadConfig();\n\n  if (config.deploymentMode === \"local_trusted\" && !isLoopbackHost(config.host)) {\n    throw new Error(\n      `local_trusted mode requires loopback host binding (received: ${config.host}). ` +\n        \"Use authenticated mode for non-loopback deployments.\",\n    );\n  }\n  \n  if (config.deploymentMode === \"local_trusted\" && config.deploymentExposure !== \"private\") {\n    throw new Error(\"local_trusted mode only supports private exposure\");\n  }\n  \n  if (config.deploymentMode === \"authenticated\") {\n    if (config.authBaseUrlMode === \"explicit\" && !config.authPublicBaseUrl) {\n      throw new Error(\"auth.baseUrlMode=explicit requires auth.publicBaseUrl\");\n    }\n    if (config.deploymentExposure === \"public\") {\n      if (config.authBaseUrlMode !== \"explicit\") {\n        throw new Error(\"authenticated public exposure requires auth.baseUrlMode=explicit\");\n      }\n      if (!config.authPublicBaseUrl) {\n        throw new Error(\"authenticated public exposure requires auth.publicBaseUrl\");\n      }\n    }\n  }","sourceCodeStart":632,"sourceCodeEnd":668,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/index.ts#L632-L668","documentation":"Config consistency check in startServer (authenticated mode branch): auth.baseUrlMode is 'explicit' but auth.publicBaseUrl is unset. Explicit base-URL mode requires a concrete public base URL to build auth links/redirects, so the contradictory configuration is rejected at startup.","triggerScenarios":"Thrown at server/src/index.ts:531 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set auth.publicBaseUrl in the config when auth.baseUrlMode=explicit.","Use a different auth.baseUrlMode if the public base URL should be derived automatically."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}