Billionmail/BillionMail · critical

Failed to get account roles

Error message

Failed to get account roles

What it means

This error is returned by the login endpoint after the username/password check succeeded, but fetching the account's assigned roles from the database failed. The underlying DB error is intentionally swallowed and replaced with a generic message, so the root cause (DB down, missing role tables, bad connection) is hidden. Login cannot proceed because roles are required to build the JWT claims.

Source

Thrown at core/internal/controller/rbac/rbac_v1_auth.go:91

		if !service.VerifyCaptcha(req.ValidateCodeId, req.ValidateCode) {
			err = fmt.Errorf("Invalid validation code")
			return
		}

		validateSuccess = true
	}

	// Verify username and password
	account, err := service.Account().Login(ctx, req.Username, req.Password)
	if err != nil {
		err = fmt.Errorf("Invalid username or password")
		return
	}

	// Get account roles
	roles, err := service.Account().GetAccountRoles(ctx, account.AccountId)
	if err != nil {
		err = fmt.Errorf("Failed to get account roles")
		return
	}

	// Convert roles to role names
	roleNames := make([]string, 0, len(roles))
	for _, role := range roles {
		roleNames = append(roleNames, role.RoleName)
	}

	// Generate JWT token
	token, _, err := service.JWT().GenerateToken(account.AccountId, account.Username, roleNames)
	if err != nil {
		res.SetError(gerror.New("Failed to generate token"))
		return
	}

	// Generate refresh token
	refreshToken, err := service.JWT().GenerateRefreshToken(account.AccountId, account.Username)

View on GitHub (pinned to fc36c76c05)

Solutions

1. Verify PostgreSQL is reachable and the database is initialized (docker compose ps, check core config db settings)
2. Run any migration/SQL setup scripts to recreate the role tables if schema is missing
3. Check app logs for the original DB error suppressed by this wrapper
4. Restart the service after restoring DB connectivity

Example fix

// before
roles, err := service.Account().GetAccountRoles(ctx, account.AccountId)
if err != nil {
    err = fmt.Errorf("Failed to get account roles")
    return
}
// after
roles, err := service.Account().GetAccountRoles(ctx, account.AccountId)
if err != nil {
    err = fmt.Errorf("Failed to get account roles: %w", err)
    return
}

try {
  const res = await api.login(username, password);
} catch (e) {
  if (e.message.includes('Failed to get account roles')) {
    // server-side DB issue; alert ops, do not retry credentials
    showMaintenanceNotice();
  }
}

When it happens

Trigger: POST /rbac login when service.Account().GetAccountRoles(ctx, accountId) returns an error: PostgreSQL unreachable/down, database schema missing or corrupted (account_role/role tables dropped), or the account was deleted between the Login check and the role query.

Common situations: Database container not started or crashed in a docker-compose deployment; running the app against an uninitialized DB without migrations; connection pool exhaustion under load; schema drift after an upgrade.

Related errors

• failed to get account: %w
• failed to get all domains: %w
• fail to check domain: %w
• failed to get all emails: %w
• failed to get all mailboxes: %w

AI-assisted analysis of Billionmail/BillionMail@fc36c76c05 (2026-09-05). Data as JSON: /api/errors/6a6a7eb9981894b0. Report an issue: GitHub.