{"record":{"id":"137d56536661b3ad","repo":"bytedance/deer-flow","slug":"authentication-required","errorCode":null,"errorMessage":"Authentication required","messagePattern":"Authentication required","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"backend/app/gateway/authz.py","lineNumber":111,"sourceCode":"\n        Args:\n            resource: Resource name (e.g., \"threads\")\n            action: Action name (e.g., \"read\")\n\n        Returns:\n            True if user has permission\n        \"\"\"\n        permission = f\"{resource}:{action}\"\n        return permission in self.permissions\n\n    def require_user(self) -> User:\n        \"\"\"Get user or raise 401.\n\n        Raises:\n            HTTPException 401 if not authenticated\n        \"\"\"\n        if not self.user:\n            raise HTTPException(status_code=401, detail=\"Authentication required\")\n        return self.user\n\n\ndef get_auth_context(request: Request) -> AuthContext | None:\n    \"\"\"Get AuthContext from request state.\"\"\"\n    return getattr(request.state, \"auth\", None)\n\n\n_ALL_PERMISSIONS: list[str] = [\n    Permissions.THREADS_READ,\n    Permissions.THREADS_WRITE,\n    Permissions.THREADS_DELETE,\n    Permissions.RUNS_CREATE,\n    Permissions.RUNS_READ,\n    Permissions.RUNS_CANCEL,\n]\n\n","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/bytedance/deer-flow/blob/1dd6ba1acb03700589994b0366c5d1c7d05e2eff/backend/app/gateway/authz.py#L93-L129","documentation":"HTTP 401 from AuthContext.require_user() when the context exists but holds no authenticated User. require_user is the imperative 'get user or die' accessor used inside handlers that already have an AuthContext; a None user means the request was anonymous or authentication failed upstream.","triggerScenarios":"Calling auth_context.require_user() on an AuthContext whose user attribute is None — e.g. anonymous request where middleware attached an unauthenticated context, or an API-key/service identity that authenticates without a User record.","commonSituations":"Adding new endpoints that assume a user is always present; auth middleware misconfiguration letting anonymous contexts reach the handler; service-to-service calls that authenticate as the internal identity rather than a User.","solutions":["Ensure the route is wrapped in require_auth/require_permission so the request is authenticated before require_user is reachable","Check auth_context.user or auth_context.is_authenticated before calling require_user when anonymous access is possible","Send a valid Authorization header / session cookie in the client request"],"exampleFix":"# before\nuser = auth_context.require_user()\n# after\nif not auth_context.is_authenticated:\n    raise HTTPException(status_code=401, detail=\"Authentication required\")\nuser = auth_context.require_user()","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"def has_user(ctx: AuthContext) -> bool:\n    \"\"\"True when require_user() will succeed.\"\"\"\n    return ctx.user is not None","tryCatchPattern":"from fastapi import HTTPException\ntry:\n    user = auth_context.require_user()\nexcept HTTPException as e:\n    if e.status_code == 401:\n        raise NotAuthenticated()  # convert to a 302 to /login for browser routes\n    raise","preventionTips":["Wrap routes in require_auth so anonymous contexts never reach require_user","Standardize on `if not auth_context.is_authenticated:` guards before user access","Unit-test new endpoints with and without credentials"],"tags":["auth","http-401","authorization","gateway"],"backgroundTag":null,"analyzedSha":"1dd6ba1acb03700589994b0366c5d1c7d05e2eff","analyzedAt":"2026-08-14T21:20:34.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}