{"record":{"id":"0770d568f8084b4c","repo":"plandex-ai/plandex","slug":"error-validating-sign-in-code-v","errorCode":null,"errorMessage":"error validating sign in code: %v","messagePattern":"error validating sign in code: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"app/server/handlers/auth_helpers.go","lineNumber":307,"sourceCode":"\n\treturn accounts, nil\n}\n\nfunc ValidateAndSignIn(w http.ResponseWriter, r *http.Request, req shared.SignInRequest) (*shared.SessionResponse, error) {\n\tvar user *db.User\n\tvar emailVerificationId string\n\tvar signInCodeId string\n\tvar signInCodeOrgId string\n\tvar err error\n\n\tisLocalMode := (os.Getenv(\"GOENV\") == \"development\" && os.Getenv(\"LOCAL_MODE\") == \"1\")\n\n\tif req.IsSignInCode {\n\t\tres, err := db.ValidateSignInCode(req.Pin)\n\n\t\tif err != nil {\n\t\t\tlog.Printf(\"Error validating sign in code: %v\\n\", err)\n\t\t\treturn nil, fmt.Errorf(\"error validating sign in code: %v\", err)\n\t\t}\n\n\t\tuser, err = db.GetUser(res.UserId)\n\n\t\tif err != nil {\n\t\t\tlog.Printf(\"Error getting user: %v\\n\", err)\n\t\t\treturn nil, fmt.Errorf(\"error getting user: %v\", err)\n\t\t}\n\n\t\tif user == nil {\n\t\t\tlog.Printf(\"User not found for id: %v\\n\", res.UserId)\n\t\t\treturn nil, fmt.Errorf(\"user not found\")\n\t\t}\n\n\t\tsignInCodeId = res.Id\n\t\tsignInCodeOrgId = res.OrgId\n\t} else {\n\t\treq.Email = strings.ToLower(req.Email)","sourceCodeStart":289,"sourceCodeEnd":325,"githubUrl":"https://github.com/plandex-ai/plandex/blob/e2d772072efadbe41d2946d97d79be55532dbab5/app/server/handlers/auth_helpers.go#L289-L325","documentation":"ValidateAndSignIn, when the request carries a sign-in code (IsSignInCode), validates the 6-digit PIN via db.ValidateSignInCode; any failure there (expired, wrong, or DB error) is logged and re-wrapped with this message for the SignInHandler.","triggerScenarios":"User submits a sign-in code via SignInHandler and db.ValidateSignInCode returns an error — the PIN is wrong/expired/already used, or the sign-in-codes lookup fails at the DB level.","commonSituations":"User mistypes the emailed one-time code, code expired past its TTL, code already consumed in a previous attempt, or database connectivity problems during validation.","solutions":["Ask the user to re-enter the code carefully or request a new sign-in code","Check code expiry/TTL and regenerate if elapsed","Confirm the code wasn't already consumed (single-use codes are invalidated after success)","Check DB health if the log line shows a query/connection error rather than invalid code","Return a retryable 401 to the client prompting a fresh code"],"exampleFix":"// before\nreturn nil, fmt.Errorf(\"error validating sign in code: %v\", err)\n// after\nreturn nil, fmt.Errorf(\"error validating sign in code: %w\", err) // %w lets callers classify invalid-code vs transient db errors","handlingStrategy":"try-catch","validationCode":"// before submitting\nif len(req.Pin) != 6 || !isAllDigits(req.Pin) {\n    return errors.New(\"sign-in code must be 6 digits\")\n}","typeGuard":null,"tryCatchPattern":"user, err := ValidateAndSignIn(r.Context(), req)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"error validating sign in code\") {\n        http.Error(w, \"invalid or expired code — request a new one\", http.StatusUnauthorized); return\n    }\n    http.Error(w, err.Error(), http.StatusInternalServerError)\n}","preventionTips":["Enforce PIN format client-side before submitting","Check code expiry and single-use semantics before validation","Auto-resend a fresh code after N failed attempts or on expiry","Rate-limit code attempts and show a clear 'request new code' path instead of generic 500s"],"tags":["go","auth","otp","sign-in-code"],"backgroundTag":"invalid-otp-code","analyzedSha":"e2d772072efadbe41d2946d97d79be55532dbab5","analyzedAt":"2026-09-05T20:56:53.631Z","contentChangedAt":"2026-09-05T20:56:53.631Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}