{"record":{"id":"804c052feefe1d3d","repo":"SigNoz/signoz","slug":"root-user-operation-unsupported","errorCode":"root_user_operation_unsupported","errorMessage":"this operation is not supported for the root user","messagePattern":"this operation is not supported for the root user","errorType":"error_code","errorClass":null,"httpStatus":405,"severity":"error","filePath":"pkg/types/user.go","lineNumber":158,"sourceCode":"}\n\n// PromoteToRoot promotes the user to a root user with admin role.\nfunc (u *User) PromoteToRoot() {\n\tu.IsRoot = true\n\tu.UpdatedAt = time.Now()\n}\n\n// UpdateEmail updates the email of the user.\nfunc (u *User) UpdateEmail(email valuer.Email) {\n\tu.Email = email\n\tu.UpdatedAt = time.Now()\n}\n\n// ErrIfRoot returns an error if the user is a root user. The caller should\n// enrich the error with the specific operation using errors.WithAdditionalf.\nfunc (u *User) ErrIfRoot() error {\n\tif u.IsRoot {\n\t\treturn errors.New(errors.TypeUnsupported, ErrCodeRootUserOperationUnsupported, \"this operation is not supported for the root user\")\n\t}\n\treturn nil\n}\n\n// ErrIfDeleted returns an error if the user is in deleted state.\n// This error can be enriched with specific operation by the called using errors.WithAdditionalf.\nfunc (u *User) ErrIfDeleted() error {\n\tif u.Status == UserStatusDeleted {\n\t\treturn errors.New(errors.TypeUnsupported, ErrCodeUserStatusDeleted, \"unsupported operation for deleted user\")\n\t}\n\treturn nil\n}\n\n// ErrIfPending returns an error if the user is in pending invite state.\n// This error can be enriched with specific operation by the called using errors.WithAdditionalf.\nfunc (u *User) ErrIfPending() error {\n\tif u.Status == UserStatusPendingInvite {\n\t\treturn errors.New(errors.TypeUnsupported, ErrCodeUserStatusPendingInvite, \"unsupported operation for pending user\")","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/SigNoz/signoz/blob/5069bf80b08f1f00d7e014eccc09902f9871004f/pkg/types/user.go#L140-L176","documentation":"Returned by User.ErrIfRoot() when the target user has IsRoot==true. The root (system) user is a special built-in account whose attributes cannot be modified, deleted, or used for auth flows like password reset. Callers are expected to enrich the error with errors.WithAdditionalf to describe the specific operation.","triggerScenarios":"Calling CreateCallbackAuthNSession, UpdateUser, DeleteUser, GetOrCreateResetPasswordToken, ForgotPassword, or UpdatePasswordByResetPasswordToken with the root user (typically identified by the fixed root user UUID/email configured at startup).","commonSituations":"Scripts or seed data that iterate over all users including the root account; API clients that hardcode an admin email which is configured as the SigNoz root user; attempting SSO callback login as root.","solutions":["Exclude the root user from any update/delete/password-reset flows (check user.IsRoot before calling)","Use a regular admin account instead of the root user for day-to-day operations","If hit during login, verify the login email is not the configured root user email"],"exampleFix":"// before\nif err := user.ErrIfRoot(); err != nil { ... }\n\n// after\nif user.IsRoot {\n    return errors.New(errors.TypeUnsupported, errors.CodeUnsupported, \"cannot modify the root user\")\n}\nif err := user.ErrIfRoot(); err != nil { ... }","handlingStrategy":"validation","validationCode":"if user.IsRoot {\n    return errors.New(errors.TypeUnsupported, \"operation\", \"cannot operate on root user\")\n}","typeGuard":"func isRootUser(u *types.User) bool { return u != nil && u.IsRoot }","tryCatchPattern":null,"preventionTips":["Filter root users out of bulk user operations","Never use the root account for routine admin tasks"],"tags":["user-management","root-user","unsupported-operation","signoz"],"backgroundTag":"protected-account-operation","analyzedSha":"5069bf80b08f1f00d7e014eccc09902f9871004f","analyzedAt":"2026-08-28T06:22:12.824Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}