FlowiseAI/Flowise · error · InternalFlowiseError

Error: credentialsController.deleteCredentials - workspace $

Error message

Error: credentialsController.deleteCredentials - workspace ${workspaceId} not found!

What it means

Thrown by deleteCredentials when req.user.activeWorkspaceId is falsy (undefined/null/''). Despite the message saying 'workspace not found', the workspace was never looked up — the authenticated user simply has no active workspace bound to their session. The literal ${workspaceId} in the message stays unresolved ('undefined') because the throw happens before any value exists. This is a session/auth-claim defect, not a missing DB row.

Source

Thrown at packages/server/src/controllers/credentials/index.ts:33

        body.workspaceId = req.user?.activeWorkspaceId
        const apiResponse = await credentialsService.createCredential(body)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

const deleteCredentials = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (typeof req.params === 'undefined' || !req.params.id) {
            throw new InternalFlowiseError(
                StatusCodes.PRECONDITION_FAILED,
                `Error: credentialsController.deleteCredentials - id not provided!`
            )
        }
        const workspaceId = req.user?.activeWorkspaceId
        if (!workspaceId) {
            throw new InternalFlowiseError(
                StatusCodes.NOT_FOUND,
                `Error: credentialsController.deleteCredentials - workspace ${workspaceId} not found!`
            )
        }
        const apiResponse = await credentialsService.deleteCredentials(req.params.id, workspaceId)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

const getAllCredentials = async (req: Request, res: Response, next: NextFunction) => {
    try {
        const workspaceId = req.user?.activeWorkspaceId
        if (!workspaceId) {
            throw new InternalFlowiseError(
                StatusCodes.NOT_FOUND,
                `Error: credentialsController.getAllCredentials - workspace ${workspaceId} not found!`

View on GitHub (pinned to abe4a8601a)

Solutions

Have the user sign out and back in so a fresh JWT is minted with activeWorkspaceId populated from their workspace assignment.
Confirm the user actually belongs to a workspace (check workspace_user table / workspace membership in admin UI); assign them to one if not.
If writing a client/integration, after login call the workspace-switch endpoint to set activeWorkspaceId before deleting credentials.
If reproducing in tests, set req.user = { activeWorkspaceId: '<uuid>' } in your stub.
If you control the token, verify your login flow sets activeWorkspaceId in generateJwtAuthToken's user payload (see _generateJwtToken's meta field).

Example fix

// before — token minted without activeWorkspaceId
const loggedInUser = { id, email, name } // missing activeWorkspaceId

// after — ensure activeWorkspaceId is on the user before signing
const loggedInUser = {
  id, email, name,
  activeWorkspaceId: workspaceUser.workspaceId,
  activeWorkspace: workspaceUser.workspace.name
}

Defensive patterns

Strategy: validation

Validate before calling

// Run before calling deleteCredentials — guard the workspace claim
function assertActiveWorkspace(user: unknown): string {
  const ws = (user as any)?.activeWorkspaceId
  if (typeof ws !== 'string' || ws.length === 0) {
    throw new Error('User session has no activeWorkspaceId — re-login required')
  }
  return ws
}

// usage
const wsId = assertActiveWorkspace(currentUser)
await api.deleteCredentials(id, wsId)

Type guard

function hasActiveWorkspace(u: unknown): u is { activeWorkspaceId: string } {
  return typeof u === 'object' && u !== null
    && typeof (u as any).activeWorkspaceId === 'string'
    && (u as any).activeWorkspaceId.length > 0
}

Try / catch

try {
  await api.deleteCredentials(id)
} catch (e) {
  if (/workspace .* not found/.test(e.message)) {
    // session lost workspace claim — force re-login, don't retry blindly
    await auth.logout(); router.push('/signin')
  } else { throw e }
}

Prevention

Always populate activeWorkspaceId in the user payload before signing the JWT (see passport localStrategy).
After workspace-switch, persist the chosen workspace id in the client session and re-fetch user claims.
In tests, centralize an auth stub that always sets activeWorkspaceId rather than re-specifying it per test.

When it happens

Trigger: DELETE /api/v1/credentials/:id reached with a valid JWT but the token's payload lacks activeWorkspaceId (e.g. token minted before workspace assignment, or login done in a non-enterprise OSS mode that never sets activeWorkspaceId). Also fires if the auth middleware populates req.user from a stale session where the user was removed from their workspace.

Common situations: User accepted a workspace invite after their current JWT was issued; the old token has no activeWorkspaceId. SSO login path (setTokenOrCookies) that doesn't propagate activeWorkspaceId. Tests hitting the route with a stubbed req.user that omits activeWorkspaceId. Mixing OSS and enterprise builds where the user object shape differs.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/ab60d83fdeee0aee. Report an issue: GitHub.