{"record":{"id":"26a5312a7b485308","repo":"FlowiseAI/Flowise","slug":"error-chatmessagescontroller-removeallchatmessage-26a531","errorCode":null,"errorMessage":"Error: chatMessagesController.removeAllChatMessages - workspace ${workspaceId} not found!","messagePattern":"Error: chatMessagesController\\.removeAllChatMessages - workspace (.+?) not found!","errorType":"exception","errorClass":"InternalFlowiseError","httpStatus":404,"severity":"error","filePath":"packages/server/src/controllers/chat-messages/index.ts","lineNumber":163,"sourceCode":"const removeAllChatMessages = async (req: Request, res: Response, next: NextFunction) => {\n    try {\n        const appServer = getRunningExpressApp()\n        if (typeof req.params === 'undefined' || !req.params.id) {\n            throw new InternalFlowiseError(\n                StatusCodes.PRECONDITION_FAILED,\n                'Error: chatMessagesController.removeAllChatMessages - id not provided!'\n            )\n        }\n        const orgId = req.user?.activeOrganizationId\n        if (!orgId) {\n            throw new InternalFlowiseError(\n                StatusCodes.NOT_FOUND,\n                `Error: chatMessagesController.removeAllChatMessages - organization ${orgId} not found!`\n            )\n        }\n        const workspaceId = req.user?.activeWorkspaceId\n        if (!workspaceId) {\n            throw new InternalFlowiseError(\n                StatusCodes.NOT_FOUND,\n                `Error: chatMessagesController.removeAllChatMessages - workspace ${workspaceId} not found!`\n            )\n        }\n        const chatflowid = req.params.id\n        const chatflow = await chatflowsService.getChatflowByIdForWorkspace(req.params.id, workspaceId)\n        if (!chatflow) {\n            return res.status(404).send('Chatflow not found')\n        }\n        const flowData = chatflow.flowData\n        const parsedFlowData: IReactFlowObject = JSON.parse(flowData)\n        const nodes = parsedFlowData.nodes\n        const chatId = req.query?.chatId as string\n        const memoryType = req.query?.memoryType as string | undefined\n        const sessionId = req.query?.sessionId as string | undefined\n        const _chatTypes = req.query?.chatType as string | undefined\n        let chatTypes: ChatType[] | undefined\n        if (_chatTypes) {","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/server/src/controllers/chat-messages/index.ts#L145-L181","documentation":"Thrown by removeAllChatMessages when the authenticated user's JWT/session has no activeWorkspaceId. The guard reads req.user?.activeWorkspaceId and rejects with HTTP 404 (NOT_FOUND) when it is absent. It fires before any chatflow lookup, so no DB access has occurred yet. The 404 is somewhat misleading — the real cause is an incompletely populated user context, not a missing record.","triggerScenarios":"Calling DELETE /api/v1/chatmessages/:id after authentication middleware set req.user but did not attach activeWorkspaceId (e.g. user belongs to no workspace, workspace membership row missing, or a stale token minted before workspace assignment). Also reachable if the auth middleware was bypassed or partially applied on a custom route.","commonSituations":"Newly invited user whose workspace membership DB row hasn't propagated; JWT signed without workspace claim after an org/workspace migration; test harness that stubs req.user with only id and activeOrganizationId; multi-tenant rework where activeWorkspaceId resolution moved to a later middleware that didn't run.","solutions":["Confirm the caller's session/JWT actually contains a workspace claim — decode the token and check activeWorkspaceId is present.","Verify the user has a workspace_user row for the target workspace; if not, have an org admin add the membership.","Check auth middleware ordering: the middleware that resolves activeWorkspaceId must run before this controller on the route.","If integrating programmatically, ensure your login flow selects/switches into a workspace so the claim is populated.","Long-term: file an issue — this should be 401/403, not 404, since the resource isn't what's missing."],"exampleFix":"// before: caller has token with no workspace claim\n// after: log in and select a workspace so JWT includes activeWorkspaceId\nawait api.post('/auth/login', creds)\nawait api.post('/workspaces/select', { workspaceId })\nawait api.delete(`/api/v1/chatmessages/${chatflowId}`)","handlingStrategy":"validation","validationCode":"function hasWorkspaceClaim(user): boolean {\n  return Boolean(user && (user as any).activeWorkspaceId)\n}\n// before calling delete:\nif (!hasWorkspaceClaim(currentUser)) {\n  // re-auth / select workspace instead of calling the endpoint\n}","typeGuard":"function hasWorkspaceContext(u: unknown): u is { activeWorkspaceId: string; activeOrganizationId: string } {\n  return typeof u === 'object' && u !== null\n    && typeof (u as any).activeWorkspaceId === 'string' && (u as any).activeWorkspaceId.length > 0\n    && typeof (u as any).activeOrganizationId === 'string' && (u as any).activeOrganizationId.length > 0\n}","tryCatchPattern":null,"preventionTips":["Always run workspace selection after login so the JWT carries activeWorkspaceId.","In integration tests, populate req.user fully — including activeWorkspaceId and activeOrganizationId.","Build a central requireWorkspace() client guard and call it before any workspace-scoped endpoint.","Decode the JWT in a dev helper to confirm claims before debugging controller errors."],"tags":["flowise","express","auth","workspace","multitenant","controller","params-validation"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}