{"record":{"id":"3e0ff7a5c2b21f79","repo":"HeyPuter/puter","slug":"username-already-in-use","errorCode":"username_already_in_use","errorMessage":"This username is not available.","messagePattern":"This username is not available\\.","errorType":"http","errorClass":"HttpError","httpStatus":400,"severity":"error","filePath":"src/backend/controllers/auth/AuthController.ts","lineNumber":733,"sourceCode":"            throw new HttpError(400, 'username must be a string.', {\n                legacyCode: 'bad_request',\n            });\n        if (!USERNAME_REGEX.test(body.username)) {\n            throw new HttpError(\n                400,\n                'Username can only contain letters, numbers and underscore (_).',\n                { legacyCode: 'bad_request' },\n            );\n        }\n        if (body.username.length > USERNAME_MAX_LENGTH) {\n            throw new HttpError(\n                400,\n                `Username cannot be longer than ${USERNAME_MAX_LENGTH} characters.`,\n                { legacyCode: 'bad_request' },\n            );\n        }\n        if (RESERVED_USERNAMES.has(body.username.toLowerCase())) {\n            throw new HttpError(400, 'This username is not available.', {\n                legacyCode: 'username_already_in_use',\n            });\n        }\n        if (!is_temp) {\n            if (!body.email)\n                throw new HttpError(400, 'Email is required', {\n                    legacyCode: 'bad_request',\n                });\n            if (typeof body.email !== 'string')\n                throw new HttpError(400, 'email must be a string.', {\n                    legacyCode: 'bad_request',\n                });\n            if (!validator.isEmail(body.email))\n                throw new HttpError(\n                    400,\n                    'Please enter a valid email address.',\n                    { legacyCode: 'bad_request' },\n                );","sourceCodeStart":715,"sourceCodeEnd":751,"githubUrl":"https://github.com/HeyPuter/puter/blob/908ec23eda38526170322c3edf71ba45ecb1ca95/src/backend/controllers/auth/AuthController.ts#L715-L751","documentation":"Thrown by POST /signup when body.username (case-insensitively) is in the RESERVED_USERNAMES set: admin, administrator, root, system, puter, www, api, support, help, info, contact, mail, email, null, undefined, test, guest, anonymous, user, users. Despite the misleading legacyCode 'username_already_in_use', this is a reservation guard, not a duplicate-DB check (that is a separate, later error). HTTP 400.","triggerScenarios":"POST /signup where body.username.toLowerCase() is one of the reserved entries — including case variants ('Admin', 'ROOT', 'Guest'), since the check lowercases the submitted value before lookup.","commonSituations":"A user picking 'admin' or 'support'; an integration test that always signs up a user named 'test' or 'guest'; a seeding/import script that maps imported roles ('root','user') directly to usernames.","solutions":["Pick a different, non-reserved username.","If this is a test fixture, change the fixture username to something outside the reserved list (e.g. 'tester_a').","Surface the reserved list to the client so the UI can pre-validate availability."],"exampleFix":"// before\nawait signup({ username: 'admin', email, password }); // -> 400 username_already_in_use\n\n// after\nconst RESERVED = ['admin','administrator','root','system','puter','www','api','support','help','info','contact','mail','email','null','undefined','test','guest','anonymous','user','users'];\nif (RESERVED.includes(username.toLowerCase())) {\n  return showFieldError('username', 'That username is reserved');\n}\nawait signup({ username, email, password });","handlingStrategy":"validation","validationCode":"const RESERVED = new Set(['admin','administrator','root','system','puter','www','api','support','help','info','contact','mail','email','null','undefined','test','guest','anonymous','user','users']);\nif (RESERVED.has(String(username).toLowerCase())) {\n  return showFieldError('username', 'That username is reserved');\n}","typeGuard":"const isReservedUsername = (v) => typeof v === 'string' && RESERVED.has(v.toLowerCase());","tryCatchPattern":null,"preventionTips":["Keep the client-side reserved list in sync with the server's RESERVED_USERNAMES set.","Compare case-insensitively (.toLowerCase()) just like the server does.","Use non-reserved names in test fixtures (avoid 'admin', 'test', 'guest')."],"tags":["auth","signup","validation","username","reserved"],"backgroundTag":null,"analyzedSha":"908ec23eda38526170322c3edf71ba45ecb1ca95","analyzedAt":"2026-08-12T20:53:15.911Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}