{"record":{"id":"4422ff58b16ce830","repo":"infiniflow/ragflow","slug":"user-email-inactive","errorCode":null,"errorMessage":"User {email} inactive","messagePattern":"User (.+?) inactive","errorType":"http","errorClass":"AdminException","httpStatus":403,"severity":"error","filePath":"admin/server/auth.py","lineNumber":167,"sourceCode":"    return wrapper\n\n\ndef login_admin(email: str, password: str):\n    \"\"\"\n    :param email: admin email\n    :param password: string before decrypt (RSA encrypted + base64 encoded)\n    \"\"\"\n    users = UserService.query(email=email)\n    if not users:\n        raise UserNotFoundError(email)\n    decrypted = decrypt(password)\n    user = UserService.query_user(email, decrypted)\n    if not user:\n        raise AdminException(\"Email and password do not match!\")\n    if not user.is_superuser:\n        raise AdminException(\"Not admin\", 403)\n    if user.is_active == ActiveEnum.INACTIVE.value:\n        raise AdminException(f\"User {email} inactive\", 403)\n\n    resp = user.to_json()\n    user.access_token = get_uuid()\n    login_user(user)\n    user.update_time = (current_timestamp(),)\n    user.update_date = (datetime_format(datetime.now()),)\n    user.last_login_time = get_format_time()\n    user.save()\n    msg = \"Welcome back!\"\n    return sync_construct_response(data=resp, auth=user.get_id(), message=msg)\n\n\ndef check_admin(username: str, password: str):\n    users = UserService.query(email=username)\n    if not users:\n        logging.info(f\"Username: {username} is not registered!\")\n        user_info = {\n            \"id\": uuid.uuid1().hex,","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/admin/server/auth.py#L149-L185","documentation":"AdminException(403) from login_admin (admin/server/auth.py:167): credentials are valid and the user is a superuser, but is_active == ActiveEnum.INACTIVE.value, so the account is disabled and cannot open an admin session. Raised before login_user()/token minting, so no session is created.","triggerScenarios":"POST /admin/login with a deactivated superuser's email/password (e.g. disabled via admin UI or direct DB edit). Everything up to and including password verification succeeds, then the active check fails.","commonSituations":"Disabled built-in admin account after a security review; is_active flipped by a bulk user-management script; restoring backups where the flag wasn't carried over.","solutions":["Reactivate the account: UPDATE user SET is_active='1' WHERE email='<email>'; then retry login.","If every superuser is inactive, fix it in the DB before restarting the server (otherwise error 62 blocks startup).","Keep at least one active superuser at all times when running deactivation workflows."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"rows = UserService.query(email=email) or []\nfrom common.constants import ActiveEnum\nif rows and rows[0].is_active == ActiveEnum.INACTIVE.value:\n    raise PermissionError(f\"{email} is deactivated; login_admin will return 403 inactive\")","typeGuard":"def login_will_pass(user) -> bool:\n    return bool(user) and bool(user.is_superuser) and user.is_active != ActiveEnum.INACTIVE.value","tryCatchPattern":"from api.common.exceptions import AdminException\ntry:\n    login_admin(email, password)\nexcept AdminException as e:\n    if \"inactive\" in str(e):\n        # reactivate the account in the DB, then retry\n        raise","preventionTips":["Pre-flight check is_active for accounts used by automation.","Never deactivate the only active superuser (server restart then fails with error 62)."],"tags":["authentication","login","inactive-user","admin"],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}