{"record":{"id":"7bf3d147bcb34809","repo":"BookStackApp/BookStack","slug":"login-not-allowed-for-guest-user","errorCode":null,"errorMessage":"Login not allowed for guest user","messagePattern":"Login not allowed for guest user","errorType":"exception","errorClass":"LoginAttemptInvalidUserException","httpStatus":null,"severity":"error","filePath":"app/Access/LoginService.php","lineNumber":41,"sourceCode":"    public function __construct(\n        protected MfaSession $mfaSession,\n        protected EmailConfirmationService $emailConfirmationService,\n        protected SocialDriverManager $socialDriverManager,\n    ) {\n    }\n\n    /**\n     * Log the given user into the system.\n     * Will start a login of the given user but will prevent if there's\n     * a reason to (MFA or Unconfirmed Email).\n     * Returns a boolean to indicate the current login result.\n     *\n     * @throws StoppedAuthenticationException|LoginAttemptInvalidUserException\n     */\n    public function login(User $user, string $method, bool $remember = false): void\n    {\n        if ($user->isGuest()) {\n            throw new LoginAttemptInvalidUserException('Login not allowed for guest user');\n        }\n\n        if ($this->awaitingEmailConfirmation($user) || $this->needsMfaVerification($user)) {\n            $this->setLastLoginAttemptedForUser($user, $method, $remember);\n\n            throw new StoppedAuthenticationException($user, $this);\n        }\n\n        $this->clearLastLoginAttempted();\n        auth()->login($user, $remember);\n        Activity::add(ActivityType::AUTH_LOGIN, \"{$method}; {$user->logDescriptor()}\");\n        Theme::dispatch(ThemeEvents::AUTH_LOGIN, $method, $user);\n\n        // Authenticate on all session guards if a likely admin\n        if ($user->can(Permission::UsersManage) && $user->can(Permission::UserRolesManage)) {\n            $guards = ['standard', 'ldap', 'saml2', 'oidc'];\n            foreach ($guards as $guard) {\n                auth($guard)->login($user);","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/BookStackApp/BookStack/blob/18f8469a1c72f8cc8497e9372635e6dea5028071/app/Access/LoginService.php#L23-L59","documentation":"LoginService::login explicitly rejects guest users from initiating a login session. The guest user is BookStack's synthetic unauthenticated identity, so authenticating it would break the auth model; LoginAttemptInvalidUserException is thrown with this message.","triggerScenarios":"login($user, $method) called (directly or via attempt()/reattemptLoginFor()) with a User whose isGuest() returns true — e.g. passing the guest user model (id 0 / system guest) into the login flow, or a lookup that wrongly resolves to the guest account.","commonSituations":"Custom auth driver or plugin code that resolves a user by id/email and accidentally matches the guest record; importing or seeding users that collide with the guest user; automation scripts calling the login service with a default-constructed user.","solutions":["Check the caller to see why the User object being passed is the guest user (isGuest() true)","Fix the user lookup so real credentials map to a real user, not the guest record","Guard calling code: skip or reject login attempts when $user->isGuest() before invoking login()","Ensure no seeded/imported user shares the guest user's identity (system guest id/email)"],"exampleFix":"// before\n$user = User::query()->find($request->get('user_id', 0));\n$loginService->login($user, 'standard');\n// after\n$user = User::query()->findOrFail($request->get('user_id'));\nif ($user->isGuest()) {\n    return redirect('/login')->with('error', 'Invalid account');\n}\n$loginService->login($user, 'standard');","handlingStrategy":"type-guard","validationCode":"if ($user->isGuest()) {\n    return redirect('/login')->withErrors(['email' => 'Invalid account']);\n}\n$loginService->login($user, 'standard');","typeGuard":"function isRealUser(?User $user): bool {\n    return $user !== null && !$user->isGuest() && $user->exists;\n}","tryCatchPattern":"try {\n    $loginService->login($user, $method);\n} catch (LoginAttemptInvalidUserException $e) {\n    Log::warning('Login attempted for guest/invalid user', ['user_id' => $user->id ?? null]);\n    abort(401, $e->getMessage());\n}","preventionTips":["Never hardcode user id 0 or default-construct users for login calls","Check isGuest() before any login flow invocation","Audit custom auth drivers for lookups that can match the guest record","Prevent imports/seeding from colliding with the guest user's identity"],"tags":["auth","login","guest-user"],"backgroundTag":"invalid-login-user","analyzedSha":"18f8469a1c72f8cc8497e9372635e6dea5028071","analyzedAt":"2026-09-02T19:49:33.068Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}