{"record":{"id":"6e9ec2b540a9eb74","repo":"ruvnet/RuView","slug":"authentication-required","errorCode":null,"errorMessage":"Authentication required","messagePattern":"Authentication required","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"archive/v1/src/api/dependencies.py","lineNumber":117,"sourceCode":"\n    # In production, implement proper JWT validation\n    raise HTTPException(\n        status_code=status.HTTP_401_UNAUTHORIZED,\n        detail=(\n            \"JWT authentication is not configured. Configure JWT_SECRET and \"\n            \"JWT_ALGORITHM environment variables, or integrate an external \"\n            \"identity provider. See docs/authentication.md for setup instructions.\"\n        ),\n        headers={\"WWW-Authenticate\": \"Bearer\"},\n    )\n\n\nasync def get_current_active_user(\n    current_user: Optional[Dict[str, Any]] = Depends(get_current_user)\n) -> Dict[str, Any]:\n    \"\"\"Get current active user (required authentication).\"\"\"\n    if not current_user:\n        raise HTTPException(\n            status_code=status.HTTP_401_UNAUTHORIZED,\n            detail=\"Authentication required\",\n            headers={\"WWW-Authenticate\": \"Bearer\"},\n        )\n    \n    # Check if user is active\n    if not current_user.get(\"is_active\", True):\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail=\"Inactive user\"\n        )\n    \n    return current_user\n\n\nasync def get_admin_user(\n    current_user: Dict[str, Any] = Depends(get_current_active_user)\n) -> Dict[str, Any]:","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/ruvnet/RuView/blob/4685618388a5e49fad5b3005806f3bdd6a7c25c3/archive/v1/src/api/dependencies.py#L99-L135","documentation":"get_current_active_user raises 401 'Authentication required' when its dependency get_current_user resolved to None, which happens when authentication is enabled but the request carried no credentials at all. Endpoints depending on get_current_active_user require a bearer token.","triggerScenarios":"Calling a protected route without an Authorization header; a proxy stripping the Authorization header before it reaches FastAPI; a frontend fetch that has not attached the token yet; curl/httpx calls that omit credentials.","commonSituations":"Session expired and the client silently stopped sending the token; gateway configured to drop auth headers; API exploration with curl without -H 'Authorization: Bearer ...'.","solutions":["Send Authorization: Bearer <token> on the request","Obtain a token through the login flow first, then call the protected endpoint","If the endpoint should permit anonymous access, depend on get_current_user (Optional) instead of get_current_active_user","Verify proxies/gateways forward the Authorization header"],"exampleFix":"# before\ncurl http://api/zones/alpha/pose\n# -> 401 Authentication required\n\n# after\ncurl -H 'Authorization: Bearer <token>' http://api/zones/alpha/pose","handlingStrategy":"validation","validationCode":"# Client-side: never call a protected route without a token\ndef call_protected(client, token, url):\n    if not token:\n        raise ValueError('No bearer token available; authenticate before calling protected endpoints')\n    return client.get(url, headers={'Authorization': f'Bearer {token}'})","typeGuard":null,"tryCatchPattern":"try:\n    r = client.get('/api/protected', headers=auth_headers())\n    r.raise_for_status()\nexcept httpx.HTTPStatusError as e:\n    if e.response.status_code == 401:\n        # refresh token / redirect to login, then retry once\n        token = refresh_login()\n        r = client.get('/api/protected', headers={'Authorization': f'Bearer {token}'})\n    else:\n        raise","preventionTips":["Attach the Authorization header centrally (httpx event hook / fetch wrapper) rather than per call","Handle 401 globally as 'session expired' with a single re-login path","Verify proxies forward Authorization headers in integration tests"],"tags":["authentication","fastapi","http-401","python"],"backgroundTag":null,"analyzedSha":"4685618388a5e49fad5b3005806f3bdd6a7c25c3","analyzedAt":"2026-08-16T06:09:40.886Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}