{"record":{"id":"826cfabdbd9d00c7","repo":"plandex-ai/plandex","slug":"not-found","errorCode":null,"errorMessage":"not found","messagePattern":"not found","errorType":"exception","errorClass":null,"httpStatus":404,"severity":"error","filePath":"app/server/handlers/auth_helpers.go","lineNumber":335,"sourceCode":"\t\tif user == nil {\n\t\t\tlog.Printf(\"User not found for id: %v\\n\", res.UserId)\n\t\t\treturn nil, fmt.Errorf(\"user not found\")\n\t\t}\n\n\t\tsignInCodeId = res.Id\n\t\tsignInCodeOrgId = res.OrgId\n\t} else {\n\t\treq.Email = strings.ToLower(req.Email)\n\t\tuser, err = db.GetUserByEmail(req.Email)\n\n\t\tif err != nil {\n\t\t\tlog.Printf(\"Error getting user: %v\\n\", err)\n\t\t\treturn nil, fmt.Errorf(\"error getting user: %v\", err)\n\t\t}\n\n\t\tif user == nil {\n\t\t\tlog.Printf(\"User not found for email: %v\\n\", req.Email)\n\t\t\treturn nil, fmt.Errorf(\"not found\")\n\t\t}\n\n\t\t// only validate email in non-local mode\n\t\tif !isLocalMode {\n\t\t\temailVerificationId, err = db.ValidateEmailVerification(req.Email, req.Pin)\n\n\t\t\tif err != nil {\n\t\t\t\tlog.Printf(\"Error validating email verification: %v\\n\", err)\n\t\t\t\treturn nil, fmt.Errorf(\"error validating email verification: %v\", err)\n\t\t\t}\n\n\t\t\tlog.Println(\"Email verification successful\")\n\t\t}\n\t}\n\n\tvar token string\n\tvar authTokenId string\n","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/plandex-ai/plandex/blob/e2d772072efadbe41d2946d97d79be55532dbab5/app/server/handlers/auth_helpers.go#L317-L353","documentation":"ValidateAndSignIn, email branch: db.GetUserByEmail returned nil for the submitted (lowercased) email. Deliberately vague 'not found' message to avoid leaking which emails are registered; credential checks never proceed.","triggerScenarios":"Client submits email+pin sign-in with an email that has no matching user row; the local-mode bypass is not active.","commonSituations":"Typo in email; user signed up with a different address; user account deleted; client hitting the wrong environment's database; case/format differences resolved by ToLower but still no match.","solutions":["Confirm the email is registered (check users table or have user re-register)","Ensure client points at the correct environment/database","Trim/normalize the email client-side before submitting","If the account should exist, investigate deletion jobs or signup failures"],"exampleFix":"// before\nreturn nil, fmt.Errorf(\"not found\")\n// after\nlog.Printf(\"no user for email=%s\", req.Email)\nreturn nil, fmt.Errorf(\"not found\") // keep generic to avoid enumeration","handlingStrategy":"validation","validationCode":"// client-side check before calling sign-in\nif !strings.Contains(strings.TrimSpace(email), \"@\") {\n\treturn errors.New(\"please enter a valid email\")\n}","typeGuard":null,"tryCatchPattern":"user, err := ValidateAndSignIn(w, r, req)\nif err != nil {\n\tif err.Error() == \"not found\" {\n\t\t// generic on purpose — do not confirm/deny email existence to callers\n\t\thttp.Error(w, \"invalid email or pin\", http.StatusUnauthorized)\n\t\treturn\n\t}\n\thttp.Error(w, err.Error(), http.StatusUnauthorized)\n}","preventionTips":["Keep the message generic to prevent account enumeration","Verify the correct environment/database when debugging 'missing' users","Normalize email casing consistently across signup and signin","Guide users to re-register if the account was genuinely deleted"],"tags":["auth","signin","user-not-found"],"backgroundTag":"user-not-found","analyzedSha":"e2d772072efadbe41d2946d97d79be55532dbab5","analyzedAt":"2026-09-05T20:56:53.631Z","contentChangedAt":"2026-09-05T20:56:53.631Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}