diegosouzapw/OmniRoute · error · ManagementPasswordAsCredentialError

MANAGEMENT_PASSWORD_AS_CREDENTIAL

MANAGEMENT_PASSWORD_AS_CREDENTIAL

Error message

That value is the dashboard login password, not a provider API key. Storing it would send it upstream on every request routed through this connection.

What it means

Error "That value is the dashboard login password, not a provider API key. Storing it would send it upstream on every request routed through this connection." thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/lib/db/providers.ts:139

    // bootstrapped a password has nothing to collide with.
    if (!isBcryptHash(stored)) return;
    // Both forms of the value, because neither the login route nor the
    // set-password route trims: a paste carries whitespace the password does
    // not have, and a password is allowed to carry whitespace of its own. The
    // second comparison only runs when the first fails on a different string.
    const matches =
      (await verifyManagementPassword(trimmed, stored)) ||
      (trimmed !== apiKey && (await verifyManagementPassword(apiKey, stored)));
    if (!matches) return;
  } catch (err) {
    console.warn(
      "[Providers] could not check the credential against the dashboard password:",
      err instanceof Error ? err.message : String(err)
    );
    return;
  }

  throw new ManagementPasswordAsCredentialError();
}

interface StatementLike<TRow = unknown> {
  all: (...params: unknown[]) => TRow[];
  get: (...params: unknown[]) => TRow | undefined;
  run: (...params: unknown[]) => { changes?: number };
}

interface DbLike {
  prepare: <TRow = unknown>(sql: string) => StatementLike<TRow>;
  transaction: <T>(fn: () => T) => () => T;
}

// Real column set for provider_connections (must match the CREATE TABLE in
// core.ts's SCHEMA_SQL). getProviderConnections()'s optional `columns`
// projection is interpolated directly into the SELECT clause, so every
// requested name must be validated against this allowlist before use —
// there is no current caller that passes untrusted input, but the

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/lib/db/providers.ts:139 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/9be4078de2a3ed4d. Report an issue: GitHub.