ruvnet/RuView · error · TypeError

prompt must be a non-empty string

Error message

prompt must be a non-empty string

What it means

The require_role FastAPI dependency (auth.py:450) raises HTTPException 403 "Role '{role}' required" when the authenticated user lacks the role. Identical logic to the decorator variant (error 15) but delivered as a proper 403 response object with the role name interpolated.

Source

Thrown at harness/homecore/src/hosts/codex.js:38

    '--json',
    '--strict-config',
    '--ignore-user-config',
    '-',
  ];
}

export async function runCodex({
  prompt,
  repoRoot,
  trustedRoot = repoRoot,
  allowWrite = false,
  confirm = false,
  command = 'codex',
  commandArgs = [],
  ...runOptions
}) {
  if (typeof prompt !== 'string' || !prompt.trim()) {
    throw new TypeError('prompt must be a non-empty string');
  }
  const root = assertTrustedHomecoreRepo(repoRoot, { trustedRoot });
  const write = allowWrite === true && confirm === true;
  const input = `${SAFETY_PREFIX}\n\nUser task:\n${prompt.trim()}`;
  return runProcess(
    command,
    [...commandArgs, ...buildCodexArgs(root, { write })],
    { ...runOptions, cwd: root, input },
  );
}

export default Object.freeze({ name: 'codex', run: runCodex, buildArgs: buildCodexArgs });

View on GitHub (pinned to 4685618388)

Solutions

1. Add the required role to the user's roles and obtain a new token via login
2. Verify the exact role string matches between check_permission input and provisioned roles
3. For ops break-glass, use an account with the 'admin' super-role which check_permission always passes

Example fix

# before
router.get('/api/admin/users', dependencies=[Depends(require_role('admin'))])
# called with token whose roles=['user'] -> 403
# after
user_manager._users['alice']['roles'] = ['admin']
# then re-login so the JWT roles claim updates

def role_dependency_will_pass(auth_middleware, user_info: dict, role: str) -> bool:
    """Same predicate the dependency applies before raising 403."""
    return bool(user_info) and auth_middleware.check_permission(user_info, role)

def role_satisfied(user_info, role: str) -> bool:
    roles = (user_info or {}).get("roles") or []
    return isinstance(roles, list) and ("admin" in roles or role in roles)

from fastapi import HTTPException

try:
    user = require_role("admin")(request)
except HTTPException as e:
    if e.status_code == 403:
        log_denied_access(path=request.url.path, required=extract_role(e.detail))
    raise

When it happens

Trigger: Depends(require_role('admin')) on an endpoint called by a user whose roles are ['user']; role claim stale in an unexpired token; role string mismatch (case/whitespace) between user provisioning and the dependency argument.

Common situations: Default-role users hitting privileged endpoints; forgetting to re-login after an admin grants a role; renaming roles in one place but not in route dependencies.

Related errors

• guidance limit must be between 1 and 20
• guidance query must contain 2..500 characters
• Inactive user
• Admin privileges required
• Permission '{permission}' required

AI-assisted analysis of ruvnet/RuView@4685618388 (2026-08-16). Data as JSON: /api/errors/792279d7fa3b2b9d. Report an issue: GitHub.