PASSWORD_REQUIRED

PASSWORD_REQUIRED

Error message

currentPassword required for security-impacting setting changes

What it means

Error "currentPassword required for security-impacting setting changes" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/app/api/settings/route.ts:377

      });
      const storedPasswordHash = getStoredManagementPassword(passwordState.settings);
      // Cold-boot exception: same condition the existing newPassword path
      // honoured before T-011 — when no password is configured yet AND login
      // is currently disabled, allow the first write to set policy (incl.
      // the password itself). Once a hash exists the gate always fires.
      // #8950: also treat the request as cold boot when newPassword is present
      // without a stored hash, so the Security tab's two-step flow (enable
      // requireLogin first, then set password) does not deadlock.
      const isColdBoot =
        !storedPasswordHash &&
        (passwordState.settings.requireLogin === false || Boolean(body.newPassword));
      if (!isColdBoot) {
        if (!body.currentPassword) {
          emitSettingsFailureAudit(request, actor, "PASSWORD_REQUIRED", attemptedKeys);
          return NextResponse.json(
            {
              error: {
                code: "PASSWORD_REQUIRED",
                message: "currentPassword required for security-impacting setting changes",
                keys: touchedSecurityKeys,
              },
            },
            { status: 400 }
          );
        }
        const isValid = await verifyManagementPassword(body.currentPassword, storedPasswordHash);
        if (!isValid) {
          emitSettingsFailureAudit(request, actor, "PASSWORD_MISMATCH", attemptedKeys);
          return NextResponse.json(
            {
              error: {
                code: "PASSWORD_MISMATCH",
                message: "Invalid current password",
              },
            },
            { status: 401 }

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/app/api/settings/route.ts:377 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/640df2b79cd068e2. Report an issue: GitHub.