{"record":{"id":"5533d4900e77b4bb","repo":"HeyPuter/puter","slug":"account-suspended","errorCode":"account_suspended","errorMessage":"This account is suspended.","messagePattern":"This account is suspended\\.","errorType":"http","errorClass":"HttpError","httpStatus":401,"severity":"error","filePath":"src/backend/controllers/auth/AuthController.ts","lineNumber":417,"sourceCode":"            throw new HttpError(\n                404,\n                username ? 'Username not found.' : 'Email not found.',\n                { legacyCode: 'not_found' },\n            );\n        }\n        if (\n            user.username === 'system' &&\n            !(this.config as { allow_system_login?: boolean })\n                .allow_system_login\n        ) {\n            throw new HttpError(\n                404,\n                username ? 'Username not found.' : 'Email not found.',\n                { legacyCode: 'not_found' },\n            );\n        }\n        if (user.suspended) {\n            throw new HttpError(401, 'This account is suspended.', {\n                legacyCode: 'account_suspended',\n            });\n        }\n        if (user.password === null) {\n            throw new HttpError(401, 'Incorrect password.', {\n                legacyCode: 'unauthorized',\n            });\n        }\n\n        // Verify password\n        const passwordMatch = await bcrypt.compare(\n            password,\n            user.password as string,\n        );\n        if (!passwordMatch) {\n            throw new HttpError(401, 'Incorrect password.', {\n                legacyCode: 'password_mismatch',\n            });","sourceCodeStart":399,"sourceCodeEnd":435,"githubUrl":"https://github.com/HeyPuter/puter/blob/908ec23eda38526170322c3edf71ba45ecb1ca95/src/backend/controllers/auth/AuthController.ts#L399-L435","documentation":"Returned by POST /login when the resolved user has user.suspended === true. The account exists and the password has not yet been checked — suspension is enforced first, so a suspended user cannot log in even with the correct password. The legacy code 'account_suspended' and HTTP 401 distinguish it from credential failures.","triggerScenarios":"A moderator/admin suspended the account; an automated anti-abuse system set the suspended flag; the user is trying to log in after being suspended.","commonSituations":"Terms-of-service violation; spam/abuse suspension; user unaware they were suspended; suspended account reused in a test fixture.","solutions":["Contact support/the instance admin to request reinstatement — the flag must be cleared server-side.","Do not keep retrying the password; suspension is independent of password correctness.","Switch to a non-suspended account for access in the meantime."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await login(username, password); }\ncatch (e) {\n  if (e.code === 'account_suspended') { /* show 'contact support' UI */ }\n  else throw e;\n}","preventionTips":["Surface a clear 'account suspended, contact support' message rather than a generic auth failure.","Do not retry the password on suspension — it is not a credential issue."],"tags":["auth","login","account","suspended","unauthorized"],"backgroundTag":null,"analyzedSha":"908ec23eda38526170322c3edf71ba45ecb1ca95","analyzedAt":"2026-08-12T20:53:15.911Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}