{"record":{"id":"5eab2cbb90d444b8","repo":"SigNoz/signoz","slug":"codeunsupported","errorCode":"CodeUnsupported","errorMessage":"Users are not allowed to reset their password themselves, please contact an admin to reset your password.","messagePattern":"Users are not allowed to reset their password themselves, please contact an admin to reset your password\\.","errorType":"error_code","errorClass":"errors.Error","httpStatus":400,"severity":"error","filePath":"pkg/modules/user/impluser/setter.go","lineNumber":340,"sourceCode":"\t\ttokenLifetime = module.config.Password.Invite.MaxTokenLifetime\n\t}\n\tresetPasswordToken, err := types.NewResetPasswordToken(password.ID, time.Now().Add(tokenLifetime))\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// create a new token\n\terr = module.store.CreateResetPasswordToken(ctx, resetPasswordToken)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn resetPasswordToken, nil\n}\n\nfunc (module *setter) ForgotPassword(ctx context.Context, orgID valuer.UUID, email valuer.Email, frontendBaseURL string) error {\n\tif !module.config.Password.Reset.AllowSelf {\n\t\treturn errors.New(errors.TypeUnsupported, errors.CodeUnsupported, \"Users are not allowed to reset their password themselves, please contact an admin to reset your password.\")\n\t}\n\n\tuser, err := module.getter.GetNonDeletedUserByEmailAndOrgID(ctx, email, orgID)\n\tif err != nil {\n\t\tif errors.Ast(err, errors.TypeNotFound) {\n\t\t\treturn nil // for security reasons\n\t\t}\n\t\treturn err\n\t}\n\n\tif err := user.ErrIfRoot(); err != nil {\n\t\treturn errors.WithAdditionalf(err, \"cannot reset password for root user\")\n\t}\n\n\ttoken, err := module.GetOrCreateResetPasswordToken(ctx, user.ID)\n\tif err != nil {\n\t\tmodule.settings.Logger().ErrorContext(ctx, \"failed to create reset password token\", errors.Attr(err))\n\t\treturn err","sourceCodeStart":322,"sourceCodeEnd":358,"githubUrl":"https://github.com/SigNoz/signoz/blob/5069bf80b08f1f00d7e014eccc09902f9871004f/pkg/modules/user/impluser/setter.go#L322-L358","documentation":"ForgotPassword immediately returns TypeUnsupported when config password.reset.allow_self is false — self-service password reset is administratively disabled, so users must ask an admin.","triggerScenarios":"POST to the forgot-password endpoint while user module config has password.reset.allow=false. Note: this check runs before user lookup, so it fires even for nonexistent emails (unlike the not-found case which returns nil for security).","commonSituations":"Orgs with centralized IT-managed credentials; SSO-first deployments where local passwords are secondary; default config shipped with self-reset off.","solutions":["Set user::password::reset::allow=true in config if self-service reset is desired","Have an admin perform the password reset via the admin reset API instead","Communicate the contact-admin process to users if self-reset is intentionally disabled"],"exampleFix":"// before\npassword:\n  reset:\n    allow: false\n// after\npassword:\n  reset:\n    allow: true","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := forgotPassword(ctx, orgID, email, baseURL)\nif err != nil && errors.Ast(err, errors.TypeUnsupported) {\n    // show 'contact admin' UX instead of an error page\n}","preventionTips":["Check the allow_self config before exposing the forgot-password UI","Decide the reset policy at onboarding and configure it then"],"tags":["password-reset","config","user-module"],"backgroundTag":"feature-disabled-by-config","analyzedSha":"5069bf80b08f1f00d7e014eccc09902f9871004f","analyzedAt":"2026-08-28T06:22:12.824Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}