{"record":{"id":"059f17e5e3db973c","repo":"phacility/phabricator","slug":"this-account-s-can-not-establish-web-sessions","errorCode":null,"errorMessage":"This account (\"%s\") can not establish web sessions, so it is not possible to generate a functional recovery link. Special accounts like daemons and mailing lists can not log in via the web UI.","messagePattern":"This account \\(\"(.+?)\"\\) can not establish web sessions, so it is not possible to generate a functional recovery link\\. Special accounts like daemons and mailing lists can not log in via the web UI\\.","errorType":"console","errorClass":"PhutilArgumentUsageException","httpStatus":null,"severity":"warning","filePath":"src/applications/auth/management/PhabricatorAuthManagementRecoverWorkflow.php","lineNumber":53,"sourceCode":"        pht('You can only recover the username for one account.'));\n    }\n\n    $username = head($usernames);\n\n    $user = id(new PhabricatorPeopleQuery())\n      ->setViewer($this->getViewer())\n      ->withUsernames(array($username))\n      ->executeOne();\n\n    if (!$user) {\n      throw new PhutilArgumentUsageException(\n        pht(\n          'No such user \"%s\" to recover.',\n          $username));\n    }\n\n    if (!$user->canEstablishWebSessions()) {\n      throw new PhutilArgumentUsageException(\n        pht(\n          'This account (\"%s\") can not establish web sessions, so it is '.\n          'not possible to generate a functional recovery link. Special '.\n          'accounts like daemons and mailing lists can not log in via the '.\n          'web UI.',\n          $username));\n    }\n\n    $force_full_session = $args->getArg('force-full-session');\n\n    $engine = new PhabricatorAuthSessionEngine();\n    $onetime_uri = $engine->getOneTimeLoginURI(\n      $user,\n      null,\n      PhabricatorAuthSessionEngine::ONETIME_RECOVER,\n      $force_full_session);\n\n    $console = PhutilConsole::getConsole();","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/management/PhabricatorAuthManagementRecoverWorkflow.php#L35-L71","documentation":"The account exists but canEstablishWebSessions() is false: special accounts such as daemons, mailing lists, and system agents can never log in through the web UI, so a one-time login URI would not work. The workflow refuses to mint a useless recovery link rather than hand the admin a link that cannot be used.","triggerScenarios":"Running './bin/auth recover daemon' (or any system/bot/mailing-list account); recovering an account whose roles/type forbid web sessions.","commonSituations":"Trying to recover bot or service accounts out of habit; testing the recovery tool against an obvious account name that happens to be a system account.","solutions":["Recover a real human account — system accounts never need web recovery.","If this is a legitimate user who cannot log in, review the account's roles/type under People > Manage (e.g. system agent flag) and correct them.","For programmatic access by bots, use Conduit API tokens instead of web sessions."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify before invoking the workflow.\nif (!$user->canEstablishWebSessions()) {\n  // skip recovery with a clear message; system/bot accounts cannot use\n  // one-time login links\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Reserve web recovery for human accounts.","Check account roles/type under People > Manage before recovering.","Use Conduit API tokens for programmatic access, not web sessions."],"tags":["cli","account-recovery","system-account","phabricator"],"backgroundTag":"system-account-login-blocked","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}