OIDC_ALLOWED_SUBJECTS_REQUIRED

OIDC_ALLOWED_SUBJECTS_REQUIRED

Error message

oidcAllowedSubjects must contain at least one subject or email when oidcEnabled is true

What it means

Error "oidcAllowedSubjects must contain at least one subject or email when oidcEnabled is true" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/app/api/settings/route.ts:337

    // Sanitize model lockout settings: clamp values to valid bounds.
    if (body.modelLockout) {
      body.modelLockout = resolveModelLockoutSettings({
        modelLockout: body.modelLockout as Record<string, unknown>,
      }) as typeof body.modelLockout;
    }

    if (body.oidcEnabled === true) {
      const current = await getSettings();
      const subjects = Array.isArray(body.oidcAllowedSubjects)
        ? (body.oidcAllowedSubjects as unknown[])
        : ((current.oidcAllowedSubjects as unknown[] | undefined) ?? []);
      const hasAtLeastOne = subjects.some((s) => typeof s === "string" && s.trim().length > 0);
      if (!hasAtLeastOne) {
        emitSettingsFailureAudit(request, actor, "OIDC_ALLOWED_SUBJECTS_REQUIRED", attemptedKeys);
        return NextResponse.json(
          {
            error: {
              code: "OIDC_ALLOWED_SUBJECTS_REQUIRED",
              message:
                "oidcAllowedSubjects must contain at least one subject or email when oidcEnabled is true",
            },
          },
          { status: 400 }
        );
      }
    }

    // VALIDATED body so we never trip on stray unknown keys. If any security
    // key is present, require currentPassword + verify against the stored
    // bcrypt hash. Dedupes with the previous inline newPassword reauth — the
    // password is verified at most once per PATCH.
    const touchedSecurityKeys = SECURITY_IMPACTING_KEYS.filter((k) => k in validation.data);
    if (touchedSecurityKeys.length > 0) {
      const settings = await getSettings();
      // Lazy-hash any plaintext INITIAL_PASSWORD migration BEFORE we read the
      // stored hash, so the gate works on fresh deploys too.

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/app/api/settings/route.ts:337 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/ab0c74c19b1c33d9. Report an issue: GitHub.