{"record":{"id":"1dd8428aa3f03816","repo":"t8y2/dbx","slug":"user-is-required","errorCode":null,"errorMessage":"user is required","messagePattern":"user is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/etcd-go/auth.go","lineNumber":210,"sourceCode":"func (s *etcdSession) authUserGet(params map[string]json.RawMessage) (any, error) {\n\tuser := strings.TrimSpace(stringOrDefault(params, \"user\", \"\"))\n\tcurrentUserRequest := user == \"\"\n\ts.clientMu.Lock()\n\tauthUsername := s.username\n\tauthEnabled := s.authEnabled\n\ts.clientMu.Unlock()\n\tclient, clientErr := s.activeClient()\n\tif currentUserRequest && clientErr == nil {\n\t\tauthEnabled = s.refreshAuthEnabled(client)\n\t}\n\tif user == \"\" {\n\t\tuser = authUsername\n\t}\n\tif currentUserRequest && !authEnabled {\n\t\treturn map[string]any{\"user\": user, \"roles\": []string{}, \"authEnabled\": false}, nil\n\t}\n\tif user == \"\" {\n\t\treturn nil, errors.New(\"user is required\")\n\t}\n\tif clientErr != nil {\n\t\treturn nil, clientErr\n\t}\n\tctx, cancel := s.beginOperation()\n\tdefer s.endOperation(cancel)\n\tresponse, err := client.Auth.UserGet(ctx, user)\n\tif err != nil {\n\t\tif currentUserRequest && isAuthenticationNotEnabled(err) {\n\t\t\ts.disableAuth()\n\t\t\treturn map[string]any{\"user\": user, \"roles\": []string{}, \"authEnabled\": false}, nil\n\t\t}\n\t\treturn nil, err\n\t}\n\treturn map[string]any{\"user\": user, \"roles\": response.Roles, \"authEnabled\": true}, nil\n}\n\nfunc (s *etcdSession) authUserAdd(params map[string]json.RawMessage) (any, error) {","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/etcd-go/auth.go#L192-L228","documentation":"authUserGet returns this error when it is asked to look up an etcd user but no username could be resolved. After applying the current-user fallback (authUsername from the authenticated session) and the current-user/auth-disabled fast path, an empty user string means there is nothing to query. The library treats a missing user as an invalid request rather than querying etcd with an empty name.","triggerScenarios":"Calling the auth user get operation with neither a 'user' parameter nor a resolvable current-user identity (authUsername empty), while auth is enabled or the request is not a current-user request.","commonSituations":"Handlers that forget to pass the username parameter; scripts run against a session where the current-user context was never populated; calling the API with user=\"\" explicitly; testing auth paths without establishing an authenticated session.","solutions":["Pass an explicit non-empty 'user' parameter to the auth user get call.","Ensure the session carries an authenticated username (authUsername) if you rely on the current-user fallback.","Validate the username is non-empty in the caller before invoking the agent.","If listing users, use the user-list operation instead of user-get."],"exampleFix":"// before\nresult, err := agent.handle(ctx, map[string]any{\"op\": \"auth-user-get\"})\n// after\nresult, err := agent.handle(ctx, map[string]any{\"op\": \"auth-user-get\", \"user\": \"alice\"})","handlingStrategy":"validation","validationCode":"func validateUserGetParams(params map[string]json.RawMessage, currentUser string, authEnabled bool) error {\n\thasUser := false\n\tif raw, ok := params[\"user\"]; ok {\n\t\tvar u string\n\t\tif err := json.Unmarshal(raw, &u); err == nil && u != \"\" {\n\t\t\thasUser = true\n\t\t}\n\t}\n\tif !hasUser && currentUser == \"\" {\n\t\treturn errors.New(\"user is required: pass a 'user' param or authenticate the session\")\n\t}\n\treturn nil\n}","typeGuard":"func hasUser(params map[string]json.RawMessage) bool {\n\traw, ok := params[\"user\"]\n\tif !ok {\n\t\treturn false\n\t}\n\tvar u string\n\treturn json.Unmarshal(raw, &u) == nil && u != \"\"\n}","tryCatchPattern":"if raw, ok := params[\"user\"]; !ok || string(raw) == `\"\"` {\n\treturn nil, errors.New(\"user is required: pass a 'user' param or authenticate the session\")\n}\nresult, err := session.authUserGet(username)","preventionTips":["Always pass an explicit 'user' parameter for auth user lookups.","Validate the username is non-empty at the API boundary before calling the agent.","Establish an authenticated session so the current-user fallback is available.","Prefer the user-list operation when the intent is enumeration, not a specific user."],"tags":["etcd","validation","auth","missing-parameter"],"backgroundTag":"missing-required-parameter","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}