can1357/oh-my-pi · error · AuthBrokerError

Auth broker response failed schema validation

Error message

Auth broker response failed schema validation

What it means

The auth broker client fetched a credential snapshot and parses the body as JSON, then validates it against snapshotResponseSchema (ArkType). When the payload does not match the schema, it throws AuthBrokerError with the HTTP status and a schema-error summary in the body, indicating the broker returned an unexpected or incompatible response shape.

Source

Thrown at packages/ai/src/auth-broker/client.ts:179

		};
		if (opts.ifGenerationGt !== undefined) headers["If-None-Match"] = `"${opts.ifGenerationGt}"`;
		const timeoutMs =
			opts.waitMs !== undefined && opts.waitMs > 0 ? Math.max(this.#timeoutMs, opts.waitMs + 1000) : undefined;
		const response = await this.#fetchRaw("GET", path, {
			auth: true,
			headers,
			signal: opts.signal,
			timeoutMs,
		});
		const etagGeneration = parseGenerationTag(response.headers.get("etag"));
		if (response.status === 304) {
			return { status: 304, generation: etagGeneration ?? opts.ifGenerationGt ?? 0 };
		}
		const text = await response.text();
		const raw = this.#parseJson(text, response.status);
		const validated = snapshotResponseSchema(raw);
		if (validated instanceof type.errors) {
			throw new AuthBrokerError("Auth broker response failed schema validation", {
				status: response.status,
				body: validated.summary,
			});
		}
		const snapshot = validated as SnapshotResponse;
		return { status: 200, snapshot, generation: etagGeneration ?? snapshot.generation };
	}

	/**
	 * Subscribe to the broker's SSE snapshot stream. The first frame is always
	 * a full `snapshot`; subsequent frames are `entry` upserts / refreshes or
	 * `removed` deletes. Caller controls lifecycle via `opts.signal`.
	 *
	 * Throws {@link AuthBrokerStreamUnsupportedError} when the broker responds
	 * 404 — older brokers predate this endpoint and the caller should fall back
	 * to long-polling for the remainder of its lifetime.
	 */
	async *openSnapshotStream(opts: { signal?: AbortSignal } = {}): AsyncGenerator<SnapshotStreamEvent> {

View on GitHub (pinned to 9690622007)

Solutions

1. Verify AUTH_BROKER_URL points at a compatible auth broker version and redeploy/upgrade whichever side is stale
2. Inspect the error's body summary to see exactly which fields failed validation
3. Check for proxies or gateways rewriting the response body
4. Retry after transient broker deploy completes; if persistent, report/fix the broker's response contract

Example fix

// before: pointing client at wrong service
AUTH_BROKER_URL=https://old-broker.internal
// after: matching broker version
AUTH_BROKER_URL=https://broker.internal/v2

const parsed = JSON.parse(text);
const checked = snapshotResponseSchema(parsed);
if (checked instanceof type.errors) {
  logger.warn("Snapshot shape mismatch — broker version drift?", { summary: checked.summary });
}

function isValidSnapshot(raw: unknown): raw is SnapshotResponse {
  return !(snapshotResponseSchema(raw) instanceof type.errors);
}

try {
  const snap = await client.fetchSnapshot();
} catch (err) {
  if (err instanceof AuthBrokerError && err.message.includes("schema validation")) {
    logger.error("Auth broker returned incompatible snapshot", { status: err.status, body: err.body });
    // fail soft: keep cached credentials, alert on version drift
  } else throw err;
}

When it happens

Trigger: GET snapshot returned 200 with a body that fails snapshotResponseSchema: missing required fields, wrong types, extra restructuring from an incompatible broker version, or an intermediary (proxy/CAPTCHA page) returning non-broker JSON.

Common situations: Auth broker server deployed at a different (older/newer) API version than the client expects; corporate proxy or error page injecting HTML/JSON; misconfigured AUTH_BROKER_URL pointing at the wrong service.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• AuthBrokerStreamUnsupportedError
• Auth broker returned malformed JSON
• OMP_AUTH_BROKER_ACCOUNT_POOL_FILE must contain a JSON object
• OMP_AUTH_BROKER_ACCOUNT_POOL_FILE entry for ${provider} must
• Auth broker returned no snapshot

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/1234de94f4e0f142. Report an issue: GitHub.