{"record":{"id":"877279e5fd8cc08f","repo":"langflow-ai/langflow","slug":"invalid-user","errorCode":null,"errorMessage":"Invalid user","messagePattern":"Invalid user","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"src/backend/base/langflow/api/v1/mcp_projects.py","lineNumber":208,"sourceCode":"    # Legacy AUTO_LOGIN projects without explicit auth settings retain the\n    # existing single-user fallback. Explicit public projects returned their\n    # owner above and can never reach this system-superuser path.\n    return await _superuser_fallback(db, settings_service)\n\n\nasync def _superuser_fallback(db: AsyncSession, settings_service) -> User:\n    \"\"\"Resolve the configured superuser for unauthenticated MCP paths that allow fallback.\"\"\"\n    if not settings_service.auth_settings.SUPERUSER:\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail=\"Missing superuser username in auth settings\",\n        )\n    result = await get_user_by_username(db, settings_service.auth_settings.SUPERUSER)\n    if result:\n        logger.warning(AUTO_LOGIN_WARNING)\n        set_current_auth_context(AuthCredentialContext(method=AUTH_METHOD_AUTO_LOGIN))\n        return result\n    raise HTTPException(\n        status_code=status.HTTP_403_FORBIDDEN,\n        detail=\"Invalid user\",\n    )\n\n\n# Smart authentication dependency that chooses method based on project settings\nasync def verify_project_auth_conditional(\n    project_id: UUID,\n    request: Request,\n) -> User:\n    \"\"\"Choose authentication method based on project settings.\n\n    - MCP Composer enabled + API key auth: Only allow API keys\n    - All other cases: Use standard MCP auth (JWT + API keys)\n    \"\"\"\n    async with session_scope() as session:\n        # Get project to check auth settings\n        project = (await session.exec(select(Folder).where(Folder.id == project_id))).first()","sourceCodeStart":190,"sourceCodeEnd":226,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/mcp_projects.py#L190-L226","documentation":"403 from _superuser_fallback: SUPERUSER IS configured, but get_user_by_username found no User row with that username. The configuration names a principal that does not exist in the database, so the unauthenticated MCP fallback has no one to impersonate and denies the request.","triggerScenarios":"LANGFLOW_SUPERUSER=admin while no user named 'admin' exists (never created, renamed, or deleted); pointing at a fresh database after configuring settings; username case/typo mismatch.","commonSituations":"Env var copied from another instance with a different admin username; superuser deleted during user cleanup; DB reset without re-running superuser creation.","solutions":["Create the superuser: `langflow superuser` (or create the user with that exact username).","Verify the exact username matches: SELECT username FROM \"user\"; vs $LANGFLOW_SUPERUSER.","Restart Langflow after user creation if auth caches are involved.","Long term, set explicit per-project auth so the fallback is unused."],"exampleFix":"# before: env names a missing user\nLANGFLOW_SUPERUSER=owner  # no user 'owner' in DB\n\n# after: align the two\nuv run langflow superuser  # create user 'owner' with password\n# or set LANGFLOW_SUPERUSER=admin where 'admin' exists","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"except 403 'Invalid user' from the fallback: verify the superuser account exists (langflow superuser), then retry.","preventionTips":["Run `langflow superuser` as part of deployment init before exposing MCP.","Keep LANGFLOW_SUPERUSER value in sync with the actual admin username."],"tags":["mcp","http-403","superuser","configuration","user-management"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}