{"record":{"id":"978d43fae7a96f54","repo":"AlistGo/alist","slug":"user-is-disabled","errorCode":null,"errorMessage":"user is disabled","messagePattern":"user is disabled","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/mcp/auth.go","lineNumber":82,"sourceCode":"\t\treturn guest, nil\n\t}\n\n\t// JWT token\n\tclaims, err := common.ParseToken(token)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid token: %w\", err)\n\t}\n\n\tuser, err := op.GetUserByName(claims.Username)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"user not found: %w\", err)\n\t}\n\n\tif claims.PwdTS != user.PwdTS {\n\t\treturn nil, fmt.Errorf(\"password has been changed\")\n\t}\n\tif user.Disabled {\n\t\treturn nil, fmt.Errorf(\"user is disabled\")\n\t}\n\n\tif err := loadRoles(user); err != nil {\n\t\treturn nil, err\n\t}\n\treturn user, nil\n}\n\nfunc loadRoles(user *model.User) error {\n\tif len(user.Role) > 0 {\n\t\troles, err := op.GetRolesByUserID(user.ID)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to load roles: %w\", err)\n\t\t}\n\t\tuser.RolesDetail = roles\n\t}\n\treturn nil\n}","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/AlistGo/alist/blob/843d9dc8149126976b2625911e45a4d3ffd6f2f5/server/mcp/auth.go#L64-L100","documentation":"Returned by authenticateToken (server/mcp/auth.go:82) when the JWT is valid, the user exists, the password has not changed, but the account's Disabled flag is set. The credentials authenticated correctly; the account is administratively blocked from using MCP.","triggerScenarios":"Admin disables a user in the users panel; the disabled user's MCP client keeps sending its (still cryptographically valid) token.","commonSituations":"Suspension of an account during an incident; test accounts disabled at the end of a sprint while CI still holds their tokens.","solutions":["Re-enable the account in the admin panel if access should continue","Replace the MCP configuration with a token for an active account","Treat this as terminal for the token — retrying will not help"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"user is disabled\") { stopAndReport(\"account suspended\") } // do not retry","preventionTips":["Migrate disabled accounts' automation to a new account before suspension","Treat this error as terminal, not transient"],"tags":["mcp","auth","user-management","disabled-account"],"backgroundTag":null,"analyzedSha":"843d9dc8149126976b2625911e45a4d3ffd6f2f5","analyzedAt":"2026-08-15T12:14:11.722Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}