{"record":{"id":"4792a70c96397a4f","repo":"langgenius/dify","slug":"invalid-email-or-password","errorCode":null,"errorMessage":"Invalid email or password","messagePattern":"Invalid email or password","errorType":"exception","errorClass":"AccountRegisterError","httpStatus":null,"severity":"error","filePath":"api/controllers/console/auth/oauth.py","lineNumber":314,"sourceCode":"            if not FeatureService.is_workspace_creation_allowed():\n                raise WorkSpaceNotAllowedCreateError()\n            else:\n                TenantService.create_owner_tenant(account, session=db.session())\n\n    if not account:\n        normalized_email = user_info.email.lower()\n        oauth_new_user = True\n        if not FeatureService.get_system_features().is_allow_register:\n            if dify_config.DEPLOYMENT_EDITION == DeploymentEdition.CLOUD and BillingService.is_email_in_freeze(\n                normalized_email\n            ):\n                raise AccountRegisterError(\n                    description=(\n                        \"This email account has been deleted within the past \"\n                        \"30 days and is temporarily unavailable for new account registration\"\n                    )\n                )\n            raise AccountRegisterError(description=(\"Invalid email or password\"))\n        account_name = user_info.name or \"Dify\"\n        interface_language = _preferred_interface_language(language)\n        account = RegisterService.register(\n            email=normalized_email,\n            name=account_name,\n            password=None,\n            open_id=user_info.id,\n            provider=provider,\n            language=interface_language,\n            timezone=timezone,\n            session=db.session(),\n        )\n\n    # Link account\n    AccountService.link_account_integrate(provider, user_info.id, account, session=db.session())\n\n    return account, oauth_new_user\n","sourceCodeStart":296,"sourceCodeEnd":332,"githubUrl":"https://github.com/langgenius/dify/blob/ef8544b173fd6cd7a8e71df2cab576e52bebbfbc/api/controllers/console/auth/oauth.py#L296-L332","documentation":"Raised as AccountRegisterError at oauth.py:314 — the fallback branch for a new OAuth identity when registration is disabled and the email is NOT in freeze. The description 'Invalid email or password' is deliberately generic (it does NOT reflect a real credential check; OAuth users have password=None). The OAuth callback redirects the browser to /signin?message=Invalid email or password. This is a registration-gate error disguised as a credential error.","triggerScenarios":"OAuth callback for a new identity on a deployment where FeatureService.get_system_features().is_allow_register is False, and the email is either not Cloud-frozen or the edition is not CLOUD. Falls through to oauth.py:314.","commonSituations":"Self-hosted or Cloud deployment with registration locked down; an external SSO user not yet provisioned tries to sign in and gets a misleading 'Invalid email or password' message. Admins misread this as a credential problem when it is really a missing-account + registration-disabled condition.","solutions":["Have an admin pre-create the account or send an invite so the OAuth identity links to an existing account instead of hitting the register path.","Enable FeatureService.get_system_features().is_allow_register if self-service registration is intended.","Recognize that for OAuth flows this message means 'registration disabled + no existing account', not a bad password — do not waste cycles resetting credentials.","Improve the description string at oauth.py:314 to something like 'Registration is disabled; ask your admin to invite you.' for clarity."],"exampleFix":"// before (oauth.py:314)\nraise AccountRegisterError(description=(\"Invalid email or password\"))\n// after\nraise AccountRegisterError(\n    description=\"Registration is disabled. Contact your workspace admin to invite you.\"\n)","handlingStrategy":"validation","validationCode":"// Recognize that for OAuth, 'Invalid email or password' actually means\n// 'no account + registration disabled'. Do NOT attempt password reset.\nconst msg = new URL(window.location.href).searchParams.get('message') || '';\nif (msg === 'Invalid email or password' && isOAuthFlow) {\n  promptAdminInvite();\n}","typeGuard":null,"tryCatchPattern":"try {\n  await completeOAuthCallback();\n} catch (e) {\n  if (/Invalid email or password/i.test(String(e.message||e)) && oauthFlow) {\n    showRegistrationDisabledNotice();\n  } else { throw e; }\n}","preventionTips":["Document that OAuth + registration-disabled surfaces a misleading credential error.","Pre-provision SSO users via invites when registration is off.","Improve the description string server-side to remove the ambiguity."],"tags":["oauth","registration","misleading-message","policy"],"backgroundTag":null,"analyzedSha":"ef8544b173fd6cd7a8e71df2cab576e52bebbfbc","analyzedAt":"2026-08-12T05:15:17.394Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}