{"record":{"id":"7a82f732eddd844d","repo":"apache/superset","slug":"could-not-validate-the-user-in-the-current-session","errorCode":null,"errorMessage":"Could not validate the user in the current session.","messagePattern":"Could not validate the user in the current session\\.","errorType":"exception","errorClass":"UserNotFoundInSessionError","httpStatus":500,"severity":"error","filePath":"superset/commands/database/sync_permissions.py","lineNumber":110,"sourceCode":"        )\n\n    def validate(self) -> None:\n        self._db_connection = (\n            self._db_connection\n            if self._db_connection\n            else DatabaseDAO.find_by_id(self.db_connection_id)\n        )\n        if not self._db_connection:\n            raise DatabaseNotFoundError()\n\n        # Need user info to impersonate for OAuth2 connections. The id is\n        # captured here, at validation/enqueue time, so that an async run of\n        # this command binds to whoever held the username right now, rather\n        # than re-resolving the (mutable) username at execution time.\n        if not self.username or not (\n            user := security_manager.get_user_by_username(self.username)\n        ):\n            raise UserNotFoundInSessionError()\n        self._user_id = user.id\n\n        with self.db_connection.get_sqla_engine() as engine:\n            try:\n                alive = ping(engine)\n            except Exception as err:\n                if (\n                    self.db_connection.is_oauth2_enabled()\n                    and self.db_connection.db_engine_spec.needs_oauth2(err)\n                ):\n                    raise MissingOAuth2TokenError() from err\n                raise DatabaseConnectionFailedError() from err\n\n        if not alive:\n            raise DatabaseConnectionFailedError()\n\n    def run(self) -> None:\n        \"\"\"","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/apache/superset/blob/f4587218dd19d046c3e4d00063e7d27f8a2ed354/superset/commands/database/sync_permissions.py#L92-L128","documentation":"UserNotFoundInSessionError is raised in validate() when the username argument is empty or security_manager.get_user_by_username() cannot resolve it. The sync command needs a concrete user to impersonate (notably for OAuth2 connections), so an unresolvable username aborts validation.","triggerScenarios":"Calling SyncPermissionsCommand with an empty/None username; passing a username of a user that was deleted or renamed; invoking from a background context where the session user is absent.","commonSituations":"User account deleted or username changed between the API request and command execution; scripts running outside a request context passing a hardcoded username that no longer exists.","solutions":["Pass the current authenticated user's username: flask.g.user.username or current_user.username","Verify the user exists: security_manager.get_user_by_username(name) is not None","If the user was renamed/deleted, use a valid admin username"],"exampleFix":"// before\n SyncPermissionsCommand(db_id, username=old_username).run()\n\n// after\n user = security_manager.get_user_by_username(old_username)\n if user is None:\n     raise ValueError(f\"unknown user {old_username}\")\n SyncPermissionsCommand(db_id, username=user.username).run()","handlingStrategy":"validation","validationCode":"from flask import g\n\nusername = getattr(g, \"user\", None) and g.user.username\nif not username or not security_manager.get_user_by_username(username):\n    raise PermissionError(\"no valid session user for permission sync\")","typeGuard":null,"tryCatchPattern":"try:\n    cmd.run()\nexcept UserNotFoundInSessionError:\n    # re-run from a live authenticated request\n    ...","preventionTips":["Derive username from current_user, never hardcode it","Offboard users only after their queued work drains"],"tags":["auth","user","session","permissions"],"backgroundTag":null,"analyzedSha":"f4587218dd19d046c3e4d00063e7d27f8a2ed354","analyzedAt":"2026-08-14T22:39:27.425Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}