{"record":{"id":"765766d51a8ebe10","repo":"Billionmail/BillionMail","slug":"invalid-username-or-password","errorCode":null,"errorMessage":"Invalid username or password","messagePattern":"Invalid username or password","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"core/internal/controller/rbac/rbac_v1_auth.go","lineNumber":84,"sourceCode":"\t\tvalidateSuccess = false\n\n\t\tif req.ValidateCodeId == \"\" || req.ValidateCode == \"\" {\n\t\t\terr = fmt.Errorf(\"Validation code ID and code cannot be empty\")\n\t\t\treturn\n\t\t}\n\n\t\tif !service.VerifyCaptcha(req.ValidateCodeId, req.ValidateCode) {\n\t\t\terr = fmt.Errorf(\"Invalid validation code\")\n\t\t\treturn\n\t\t}\n\n\t\tvalidateSuccess = true\n\t}\n\n\t// Verify username and password\n\taccount, err := service.Account().Login(ctx, req.Username, req.Password)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"Invalid username or password\")\n\t\treturn\n\t}\n\n\t// Get account roles\n\troles, err := service.Account().GetAccountRoles(ctx, account.AccountId)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"Failed to get account roles\")\n\t\treturn\n\t}\n\n\t// Convert roles to role names\n\troleNames := make([]string, 0, len(roles))\n\tfor _, role := range roles {\n\t\troleNames = append(roleNames, role.RoleName)\n\t}\n\n\t// Generate JWT token\n\ttoken, _, err := service.JWT().GenerateToken(account.AccountId, account.Username, roleNames)","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/Billionmail/BillionMail/blob/fc36c76c050c3775c5e899faf7403cf0262d2744/core/internal/controller/rbac/rbac_v1_auth.go#L66-L102","documentation":"Login delegates credential checking to service.Account().Login. Any failure from that call — unknown username, wrong password, disabled account, underlying DB error — is collapsed into this generic message to avoid leaking which part failed.","triggerScenarios":"Submitting credentials for a non-existent account; wrong password; account locked/disabled; the account service erroring (DB down, migration missing) which is indistinguishable from bad credentials from the client's view.","commonSituations":"User mistypes username or password; caps-lock/keyboard layout issues; stale credentials after a password change; freshly deployed environment with an empty accounts table; DB connectivity problems making all logins fail.","solutions":["Verify the username exists and the password is correct (try password reset)","Check the accounts table was seeded/migrated in the target environment","Inspect server logs to distinguish auth failure from infrastructure errors","Confirm DB connectivity and that service.Account().Login is healthy"],"exampleFix":"// before\nawait api.login({ username: 'admin ', password: pw }) // stray space\n// after\nawait api.login({ username: username.trim(), password: pw })","handlingStrategy":"try-catch","validationCode":"if (!username?.trim() || !password) throw new Error('username and password required');","typeGuard":null,"tryCatchPattern":"try {\n  await api.login({ username: username.trim(), password });\n} catch (err) {\n  if (String(err.message).includes('Invalid username or password')) {\n    // do not retry blindly; offer password reset / check server logs for infra errors\n  }\n}","preventionTips":["Trim whitespace from username input","Verify credentials after any known password change","Check DB connectivity/seed data if all logins suddenly fail","Never retry rapidly — distinguish auth failure from rate-limit responses"],"tags":["authentication","credentials","login"],"backgroundTag":"invalid-credentials","analyzedSha":"fc36c76c050c3775c5e899faf7403cf0262d2744","analyzedAt":"2026-09-05T21:28:54.019Z","contentChangedAt":"2026-09-05T21:28:54.019Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}