{"record":{"id":"5151d159ece18900","repo":"m1k1o/neko","slug":"session-login-disabled","errorCode":null,"errorMessage":"session login disabled","messagePattern":"session login disabled","errorType":"error_code","errorClass":"ErrSessionLoginDisabled","httpStatus":null,"severity":"warning","filePath":"server/pkg/types/session.go","lineNumber":13,"sourceCode":"package types\n\nimport (\n\t\"errors\"\n\t\"net/http\"\n\t\"time\"\n)\n\nvar (\n\tErrSessionNotFound         = errors.New(\"session not found\")\n\tErrSessionAlreadyExists    = errors.New(\"session already exists\")\n\tErrSessionAlreadyConnected = errors.New(\"session is already connected\")\n\tErrSessionLoginDisabled    = errors.New(\"session login disabled\")\n\tErrSessionLoginsLocked     = errors.New(\"session logins locked\")\n)\n\ntype Cursor struct {\n\tX int `json:\"x\"`\n\tY int `json:\"y\"`\n}\n\ntype SessionProfile struct {\n\tId      string\n\tToken   string\n\tProfile MemberProfile\n}\n\ntype SessionState struct {\n\tIsConnected bool `json:\"is_connected\"`\n\t// when the session was last connected\n\tConnectedSince *time.Time `json:\"connected_since,omitempty\"`","sourceCodeStart":1,"sourceCodeEnd":31,"githubUrl":"https://github.com/m1k1o/neko/blob/b0f01cedea68893e85a3fd852c0521238c285695/server/pkg/types/session.go#L1-L31","documentation":"ErrSessionLoginDisabled is a sentinel error in the neko types package returned by Authenticate when the member profile associated with the session has CanLogin=false. Authentication is refused because the account is not permitted to log in.","triggerScenarios":"Authenticate(r) resolving a session whose MemberProfile.CanLogin flag is false; an admin revoking login rights for a member while their session/token is still in use.","commonSituations":"Admins disabling login for a user but the user's old cookie/token still being presented; provisioning members with a default profile that leaves can_login false; config-driven member files missing the permission field.","solutions":["Set CanLogin=true on the member's profile (UpdateProfile) if the account should be allowed to log in.","Authenticate as an admin and update the member's permissions.","Delete the disabled member's sessions/tokens so they get a clear not-authorized result instead of this error.","Check the member provider data source for the can_login field value.","Document/handle disabled accounts on the client with a distinct 'account disabled' UX."],"exampleFix":"// before\nprofile := types.MemberProfile{Name: \"alice\"} // CanLogin defaults to false\n// after\nprofile := types.MemberProfile{Name: \"alice\", CanLogin: true}","handlingStrategy":"validation","validationCode":"// ensure the member profile permits login before authenticating\nprofile, err := provider.Select(id)\nif err == nil && !profile.CanLogin {\n    return errors.New(\"account login disabled\")\n}","typeGuard":"func CanLogin(p types.MemberProfile) bool { return p.CanLogin }","tryCatchPattern":"session, err := sessions.Authenticate(r)\nif errors.Is(err, types.ErrSessionLoginDisabled) {\n    http.Error(w, \"account disabled\", http.StatusForbidden)\n    return\n}\nreturn err","preventionTips":["Default new member profiles with can_login true where intended.","Revoke sessions when disabling a member.","Audit member provider files/db for permission fields.","Give admins a UI to re-enable accounts."],"tags":["auth","permissions","session","go"],"backgroundTag":"account-disabled","analyzedSha":"b0f01cedea68893e85a3fd852c0521238c285695","analyzedAt":"2026-09-01T10:35:56.638Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}