{"record":{"id":"9b14cc4ee1ab5787","repo":"hoppscotch/hoppscotch","slug":"user-not-found-9b14cc","errorCode":"user/not_found","errorMessage":"user/not_found","messagePattern":"user/not_found","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"packages/hoppscotch-backend/src/auth/strategies/jwt.strategy.ts","lineNumber":119,"sourceCode":"              (error) => {\n                throw error;\n              },\n              (token) => {\n                return token;\n              },\n            ),\n          ),\n      ]),\n      secretOrKey: configService.get('INFRA.JWT_SECRET'),\n    });\n  }\n\n  async validate(payload: AccessTokenPayload) {\n    if (!payload) throw new ForbiddenException(INVALID_ACCESS_TOKEN);\n\n    const user = await this.usersService.findUserById(payload.sub);\n    if (O.isNone(user)) {\n      throw new UnauthorizedException(USER_NOT_FOUND);\n    }\n\n    return user.value;\n  }\n}\n","sourceCodeStart":101,"sourceCodeEnd":125,"githubUrl":"https://github.com/hoppscotch/hoppscotch/blob/1acb8a3a7581e4db32ba0d529170c4669a2e1053/packages/hoppscotch-backend/src/auth/strategies/jwt.strategy.ts#L101-L125","documentation":"Thrown by JwtStrategy.validate when the access-token JWT decoded correctly (and carried a `sub`) but UserService.findUserById(payload.sub) returned None — no user row exists for that id. UnauthorizedException 401 'user/not_found'. The token was structurally valid but refers to a user the backend no longer knows.","triggerScenarios":"The user was deleted after the access token was issued; the token's `sub` was tampered with to a non-existent id that happened to pass signature (only possible if JWT_SECRET leaked); DB rebuild/restore that dropped users but left tokens in client cookies; multi-region replication lag.","commonSituations":"Admin deleted the user; user self-deleted; tenant purge; test DB reset without clearing browser cookies; lookalike id collision from a copy-paste.","solutions":["Clear the access_token and refresh_token cookies and re-authenticate.","If the user should exist, check findUserById in the DB directly and the soft-delete/hard-delete audit log.","Audit JWT_SECRET rotation — a leaked secret lets an attacker mint a `sub` for any id.","For test environments, reset cookies after re-seeding users."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"async function userExists(usersService, uid: string): Promise<boolean> {\n  const u = await usersService.findUserById(uid);\n  return O.isSome(u);\n}","typeGuard":"const isUserNotFound = (e: { status?: number; message?: string }): boolean =>\n  e?.status === 401 && e?.message === 'user/not_found';","tryCatchPattern":"try {\n  return await guardedRoute();\n} catch (e) {\n  if (isUserNotFound(e)) {\n    // clear cookies and redirect to login; token refers to a deleted user\n  }\n  throw e;\n}","preventionTips":["On 401 user/not_found, clear both auth cookies and force re-login.","Audit JWT_SECRET rotation if unexplained user/not_found spikes occur.","Keep user-deletion and cookie invalidation coupled."],"tags":["auth","jwt","user-management","nestjs"],"backgroundTag":null,"analyzedSha":"1acb8a3a7581e4db32ba0d529170c4669a2e1053","analyzedAt":"2026-08-12T11:34:52.648Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}