{"record":{"id":"9ad0c46968ec842d","repo":"RocketChat/Rocket.Chat","slug":"error-user-not-found-9ad0c4","errorCode":"error-user-not-found","errorMessage":"user not found","messagePattern":"user not found","errorType":"exception","errorClass":"Meteor.Error","httpStatus":400,"severity":"error","filePath":"apps/meteor/server/api/v1/twoFactorChallenges.ts","lineNumber":42,"sourceCode":"\n\t\t\tif (!challenge) {\n\t\t\t\tthrow new Meteor.Error('error-challenge-not-found', 'challenge not found');\n\t\t\t}\n\n\t\t\tif (challenge.expireAt && challenge.expireAt < new Date()) {\n\t\t\t\tthrow new Meteor.Error('error-challenge-expired', 'challenge expired');\n\t\t\t}\n\n\t\t\tif (challenge.method !== 'email') {\n\t\t\t\tthrow new Meteor.Error('error-invalid-challenge-method', 'invalid challenge method');\n\t\t\t}\n\n\t\t\tconst { userId } = challenge;\n\n\t\t\tconst user = await getUserForCheck(userId);\n\n\t\t\tif (!user) {\n\t\t\t\tthrow new Meteor.Error('error-user-not-found', 'user not found');\n\t\t\t}\n\n\t\t\tawait emailCheckForOAuth.sendEmailCode(user);\n\n\t\t\treturn API.v1.success();\n\t\t},\n\t},\n);\n\nAPI.v1.addRoute(\n\t'twoFactorChallenges.verifyChallenge',\n\t{\n\t\tvalidateParams: isTwoFactorChallengesVerifyChallengeParamsPOST,\n\t\trateLimiterOptions: { intervalTimeInMS: 60000, numRequestsAllowed: 5 },\n\t},\n\t{\n\t\tasync post() {\n\t\t\tconst { challengeId, code } = this.bodyParams;","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/api/v1/twoFactorChallenges.ts#L24-L60","documentation":"Thrown by POST twoFactorChallenges.sendEmailCode when the user attached to the pending challenge no longer exists (getUserForCheck returns null). The challenge holds a userId; if that account was deleted or suspended mid-flow, the code cannot be emailed.","triggerScenarios":"OAuth login starts, an admin deletes or deactivates the account before the user finishes the email 2FA step; test accounts wiped between login and code entry; user merged/deactivated by a directory sync during the flow.","commonSituations":"Test suites with teardown running between calls; LDAP/SCIM sync deactivating users while they log in; staging environments with aggressive user cleanup.","solutions":["Verify the account still exists and is active (users.info) when debugging","Treat as terminal: abort the flow and ask the user to authenticate again — a recreated account needs a new login","In test suites, create the user, run the whole 2FA flow, then tear down — never between calls"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"catch (e) { if (e?.error === 'error-user-not-found') abortWithAccountUnavailable(); else throw e; }","preventionTips":["Treat user-not-found mid-2FA as terminal, not retryable","In tests, tear down users only after the full 2FA flow completes"],"tags":["rest-api","two-factor","oauth","user-management","not-found"],"backgroundTag":"user-not-found","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}