{"record":{"id":"2526b43b78d76326","repo":"toeverything/AFFiNE","slug":"action-forbidden-2526b4","errorCode":"action_forbidden","errorMessage":"You are not allowed to perform this action.","messagePattern":"You are not allowed to perform this action\\.","errorType":"exception","errorClass":"ActionForbidden","httpStatus":403,"severity":"warning","filePath":"packages/backend/server/src/core/auth/controller.ts","lineNumber":123,"sourceCode":"  @Get('/methods')\n  async boundMethods(@CurrentUser() user: CurrentUser) {\n    return this.authMethods.boundMethods(user.id);\n  }\n\n  @Public()\n  @UseNamedGuard('version', 'captcha')\n  @Post('/sign-in')\n  @Header('content-type', 'application/json')\n  async signIn(\n    @Req() req: Request,\n    @Res() res: Response,\n    @Body() body?: unknown\n  ) {\n    const credential = SignInBodySchema.parse(body);\n    validators.assertValidEmail(credential.email);\n    const canSignIn = await this.auth.canSignIn(credential.email);\n    if (!canSignIn) {\n      throw new ActionForbidden();\n    }\n\n    if (credential.password) {\n      await this.passwordSignIn(\n        req,\n        res,\n        credential.email,\n        credential.password\n      );\n    } else {\n      await this.sendMagicLink(\n        req,\n        res,\n        credential.email,\n        credential.callbackUrl,\n        credential.client_nonce\n      );\n    }","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/toeverything/AFFiNE/blob/26c515e050211269e911f7d9cfe162a26c83ed98/packages/backend/server/src/core/auth/controller.ts#L105-L141","documentation":"Thrown by `POST /api/auth/sign-in` when `AuthService.canSignIn(email)` returns false. In the stock implementation `canSignIn` always returns true, so this fires only when a subclass/override adds a gate (e.g. signup disabled, email allow-list, account disabled). HTTP 403.","triggerScenarios":"A customized `AuthService.canSignIn` rejects the email — for example self-hosted deployment with sign-up disabled, an email-domain allow-list, or an abuse/feature flag that blocks the address.","commonSituations":"Self-hosted instance configured to forbid new account creation, an enterprise deployment restricting sign-in to corporate domains, or a temporary abuse-mitigation rule.","solutions":["Check the server's sign-in/sign-up policy config (e.g. `affine.specifications` / feature flags) for the email in question.","If you override `AuthService`, inspect why `canSignIn` returned false for that user.","Sign in with an already-registered account, or ask the administrator to allow-list the email/domain."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await signIn(email, password);\n} catch (e) {\n  if (e.code === 'action_forbidden') {\n    showNotice('Sign-in is not allowed for this account. Contact your administrator.');\n  } else throw e;\n}","preventionTips":["Surface a clear 'not allowed' message rather than a generic error.","Document server-side sign-in policy overrides for operators.","If overriding `AuthService.canSignIn`, log the rejection reason server-side."],"tags":["authentication","sign-in","policy","forbidden"],"backgroundTag":null,"analyzedSha":"26c515e050211269e911f7d9cfe162a26c83ed98","analyzedAt":"2026-08-12T13:15:16.447Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}