{"record":{"id":"681a7f619502aca9","repo":"plandex-ai/plandex","slug":"error-signing-in","errorCode":null,"errorMessage":"Error signing in: ","messagePattern":"Error signing in: ","errorType":"http","errorClass":"http","httpStatus":500,"severity":"error","filePath":"app/server/handlers/sessions.go","lineNumber":235,"sourceCode":"\t\tlog.Printf(\"Error reading request body: %v\\n\", err)\n\t\thttp.Error(w, \"Error reading request body: \"+err.Error(), http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tvar req shared.SignInRequest\n\terr = json.Unmarshal(body, &req)\n\tif err != nil {\n\t\tlog.Printf(\"Error unmarshalling request: %v\\n\", err)\n\t\thttp.Error(w, \"Error unmarshalling request: \"+err.Error(), http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tlog.Println(\"Validating and signing in\")\n\tresp, err := ValidateAndSignIn(w, r, req)\n\n\tif err != nil {\n\t\tlog.Printf(\"Error signing in: %v\\n\", err)\n\t\thttp.Error(w, \"Error signing in: \"+err.Error(), http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tbytes, err := json.Marshal(resp)\n\n\tif err != nil {\n\t\tlog.Printf(\"Error marshalling response: %v\\n\", err)\n\t\thttp.Error(w, \"Error marshalling response: \"+err.Error(), http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tlog.Println(\"Successfully signed in\")\n\n\tw.Write(bytes)\n}\n\nfunc SignOutHandler(w http.ResponseWriter, r *http.Request) {\n\tlog.Println(\"Received request for SignOutHandler\")","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/plandex-ai/plandex/blob/e2d772072efadbe41d2946d97d79be55532dbab5/app/server/handlers/sessions.go#L217-L253","documentation":"SignInHandler reports HTTP 500 when ValidateAndSignIn (app/server/handlers/sessions.go:231-236) returns an error. This wraps any failure of the sign-in pipeline itself: credential checks, user lookup, or token/cookie issuance inside that function. Unlike the unmarshal errors, this is a server-side authentication/business-logic failure.","triggerScenarios":"Calling the sign-in endpoint with credentials that fail validation in ValidateAndSignIn: unknown email, wrong password/hash mismatch, disabled or deleted account, or a database error while fetching the user or creating the auth token/session cookie.","commonSituations":"Users mistyping passwords, accounts deleted or passwords reset out-of-band, database connectivity problems, or bcrypt/argon2 verification configured with different parameters than were used at signup.","solutions":["Inspect the server log line 'Error signing in: ...' to see the wrapped error from ValidateAndSignIn and identify which stage failed","If it is a credential failure, return 401 instead of 500 so clients can distinguish bad credentials from server faults","Verify the database is reachable and the users/auth_tokens tables exist and are migrated","Confirm password hashing parameters match those used when the hash was stored"],"exampleFix":"// before\nhttp.Error(w, \"Error signing in: \"+err.Error(), http.StatusInternalServerError)\n// after\nif errors.Is(err, ErrInvalidCredentials) {\n\thttp.Error(w, \"Invalid email or password\", http.StatusUnauthorized)\n\treturn\n}\nhttp.Error(w, \"Error signing in: \"+err.Error(), http.StatusInternalServerError)","handlingStrategy":"try-catch","validationCode":"// client-side pre-check: require non-empty credentials before calling\nif email == \"\" || password == \"\" {\n\treturn errors.New(\"email and password are required\")\n}","typeGuard":"func isAuthError(resp *http.Response) bool {\n\treturn resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusInternalServerError\n}","tryCatchPattern":"resp, err := client.Do(req)\nbody, _ := io.ReadAll(resp.Body)\nif resp.StatusCode != http.StatusOK {\n\tif strings.HasPrefix(string(body), \"Error signing in\") {\n\t\treturn fmt.Errorf(\"sign-in failed server-side: %s\", string(body))\n\t}\n\treturn fmt.Errorf(\"unexpected status %d\", resp.StatusCode)\n}","preventionTips":["Verify credentials are correct before assuming a server fault","Confirm account is active and not deleted/reset","Monitor DB connectivity; most 500s here are database failures, not bad passwords","Retry with exponential backoff only for transport errors, never for credential errors"],"tags":["go","http","authentication","sign-in"],"backgroundTag":"authentication-failed","analyzedSha":"e2d772072efadbe41d2946d97d79be55532dbab5","analyzedAt":"2026-09-05T20:56:53.631Z","contentChangedAt":"2026-09-05T20:56:53.631Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}