HeyPuter/puter · error · HttpError

account_suspended

account_suspended

Error message

This account is suspended.

What it means

Returned by POST /login when the resolved user has user.suspended === true. The account exists and the password has not yet been checked — suspension is enforced first, so a suspended user cannot log in even with the correct password. The legacy code 'account_suspended' and HTTP 401 distinguish it from credential failures.

Source

Thrown at src/backend/controllers/auth/AuthController.ts:417

            throw new HttpError(
                404,
                username ? 'Username not found.' : 'Email not found.',
                { legacyCode: 'not_found' },
            );
        }
        if (
            user.username === 'system' &&
            !(this.config as { allow_system_login?: boolean })
                .allow_system_login
        ) {
            throw new HttpError(
                404,
                username ? 'Username not found.' : 'Email not found.',
                { legacyCode: 'not_found' },
            );
        }
        if (user.suspended) {
            throw new HttpError(401, 'This account is suspended.', {
                legacyCode: 'account_suspended',
            });
        }
        if (user.password === null) {
            throw new HttpError(401, 'Incorrect password.', {
                legacyCode: 'unauthorized',
            });
        }

        // Verify password
        const passwordMatch = await bcrypt.compare(
            password,
            user.password as string,
        );
        if (!passwordMatch) {
            throw new HttpError(401, 'Incorrect password.', {
                legacyCode: 'password_mismatch',
            });

View on GitHub (pinned to 908ec23eda)

Solutions

  1. Contact support/the instance admin to request reinstatement — the flag must be cleared server-side.
  2. Do not keep retrying the password; suspension is independent of password correctness.
  3. Switch to a non-suspended account for access in the meantime.
Defensive patterns

Strategy: try-catch

Try / catch

try { await login(username, password); }
catch (e) {
  if (e.code === 'account_suspended') { /* show 'contact support' UI */ }
  else throw e;
}

Prevention

When it happens

Trigger: A moderator/admin suspended the account; an automated anti-abuse system set the suspended flag; the user is trying to log in after being suspended.

Common situations: Terms-of-service violation; spam/abuse suspension; user unaware they were suspended; suspended account reused in a test fixture.

Related errors

AI-assisted analysis of HeyPuter/puter@908ec23eda (2026-08-12). Data as JSON: /api/errors/5533d4900e77b4bb. Report an issue: GitHub.