{"record":{"id":"8903a8ae21b6baa5","repo":"bytedance/deer-flow","slug":"email-already-exists","errorCode":"email_already_exists","errorMessage":"Email already registered","messagePattern":"Email already registered","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"warning","filePath":"backend/app/gateway/routers/auth.py","lineNumber":361,"sourceCode":"@router.post(\"/register\", response_model=UserResponse, status_code=status.HTTP_201_CREATED)\nasync def register(request: Request, response: Response, body: RegisterRequest):\n    \"\"\"Register a new user account (always 'user' role).\n\n    The first admin is created explicitly through /initialize. This endpoint creates regular users.\n    Auto-login by setting the session cookie.\n\n    Returns 403 when ``auth.local.allow_registration`` is false.\n    \"\"\"\n    if not _local_registration_enabled():\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail=AuthErrorResponse(code=AuthErrorCode.REGISTRATION_DISABLED, message=\"Self-registration is disabled on this deployment\").model_dump(),\n        )\n\n    try:\n        user = await get_local_provider().create_user(email=body.email, password=body.password, system_role=\"user\")\n    except ValueError:\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail=AuthErrorResponse(code=AuthErrorCode.EMAIL_ALREADY_EXISTS, message=\"Email already registered\").model_dump(),\n        )\n\n    token = create_access_token(str(user.id), token_version=user.token_version)\n    _set_session_cookie(response, token, request, remember_me=body.remember_me)\n\n    return UserResponse(id=str(user.id), email=user.email, system_role=user.system_role, oauth_provider=user.oauth_provider)\n\n\n@router.post(\"/logout\", response_model=MessageResponse)\nasync def logout(request: Request, response: Response):\n    \"\"\"Logout current user by clearing the cookie.\"\"\"\n    is_https = is_secure_request(request)\n    response.delete_cookie(key=ACCESS_TOKEN_COOKIE_NAME, secure=is_https, samesite=\"lax\")\n    response.delete_cookie(key=CSRF_COOKIE_NAME, secure=is_https, samesite=\"strict\")\n    response.delete_cookie(key=SESSION_PERSISTENCE_COOKIE_NAME, secure=is_https, samesite=\"lax\")\n    setattr(request.state, SKIP_AUTH_CSRF_COOKIE_STATE_ATTR, True)","sourceCodeStart":343,"sourceCodeEnd":379,"githubUrl":"https://github.com/bytedance/deer-flow/blob/1dd6ba1acb03700589994b0366c5d1c7d05e2eff/backend/app/gateway/routers/auth.py#L343-L379","documentation":"400 from POST /api/auth/register: the local provider's create_user raised ValueError, which this route interprets as a unique-email constraint violation — the submitted email already has an account. The body carries code 'email_already_exists'. Auto-login never happens on this path.","triggerScenarios":"Registering with an email that already exists in the user store, including one created via OAuth/SSO with the same address.","commonSituations":"Double-submitting the signup form; re-registering after a previous attempt succeeded; SSO users trying to create a local password account with their IdP email.","solutions":["Log in with the existing account instead of registering again","Use password reset if ownership of the email is yours but the password is unknown","Administrators can delete or rename the pre-existing account if the collision is unintended","Guard the signup form with a duplicate-email check or clear messaging on this 400"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"const taken = await checkEmailAvailable(email); // if exposed\nif (taken) suggestLoginInstead();","typeGuard":null,"tryCatchPattern":"try { await register(email, pw); } catch (e) { if (e.status === 400 && e.body?.code === 'email_already_exists') { redirect('/login', {email}); return; } throw e; }","preventionTips":["Disable the submit button while the register request is in flight (prevents double-submit duplicates)","On this 400, route users to login or password reset rather than a generic failure"],"tags":["auth","http-400","registration","duplicate-email"],"backgroundTag":null,"analyzedSha":"1dd6ba1acb03700589994b0366c5d1c7d05e2eff","analyzedAt":"2026-08-14T21:20:34.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}