{"record":{"id":"9df6ee870934b018","repo":"bytedance/deer-flow","slug":"user-not-found","errorCode":"USER_NOT_FOUND","errorMessage":"User not found","messagePattern":"User not found","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"backend/app/gateway/deps.py","lineNumber":770,"sourceCode":"\n    access_token = request.cookies.get(\"access_token\")\n    if not access_token:\n        raise HTTPException(\n            status_code=401,\n            detail=AuthErrorResponse(code=AuthErrorCode.NOT_AUTHENTICATED, message=\"Not authenticated\").model_dump(),\n        )\n\n    payload = decode_token(access_token)\n    if isinstance(payload, TokenError):\n        raise HTTPException(\n            status_code=401,\n            detail=AuthErrorResponse(code=token_error_to_code(payload), message=f\"Token error: {payload.value}\").model_dump(),\n        )\n\n    provider = get_local_provider()\n    user = await provider.get_user(payload.sub)\n    if user is None:\n        raise HTTPException(\n            status_code=401,\n            detail=AuthErrorResponse(code=AuthErrorCode.USER_NOT_FOUND, message=\"User not found\").model_dump(),\n        )\n\n    # Token version mismatch → password was changed, token is stale\n    if user.token_version != payload.ver:\n        raise HTTPException(\n            status_code=401,\n            detail=AuthErrorResponse(code=AuthErrorCode.TOKEN_INVALID, message=\"Token revoked (password changed)\").model_dump(),\n        )\n\n    return user\n\n\nasync def require_admin_user(request: Request, *, detail: str) -> None:\n    \"\"\"Require the authenticated caller to be an admin user.\n\n    ``AuthMiddleware`` normally stamps ``request.state.user`` before the request","sourceCodeStart":752,"sourceCodeEnd":788,"githubUrl":"https://github.com/bytedance/deer-flow/blob/1dd6ba1acb03700589994b0366c5d1c7d05e2eff/backend/app/gateway/deps.py#L752-L788","documentation":"HTTP 401 with code USER_NOT_FOUND: the JWT decoded successfully (payload.sub is a valid claim) but the local auth provider's get_user(sub) returned None — the user referenced by the token no longer exists in the user store.","triggerScenarios":"Authenticated call with a valid, unexpired token whose subject id was deleted from the users table (account removed, DB reset, switch from persistent to in-memory user store).","commonSituations":"Database wiped or re-provisioned while browsers keep old cookies; user account deleted by an admin; dev environment restarted against a fresh in-memory store but the browser still holds last week's token; test fixtures issuing tokens for non-existent user ids.","solutions":["Clear the access_token cookie (and session) in the client, then log in again — login recreates/looks up the user and issues a matching token","If accounts were deleted intentionally, communicate that affected users must re-authenticate","If using a persistent DB, verify the users table still contains the expected rows (`sqlite3`/psql query on the users table)","In tests, create the user before minting a token that references it"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"null","typeGuard":"null","tryCatchPattern":"if (e.status === 401 && e.detail?.code === 'USER_NOT_FOUND') {\n  // account gone: cookie is dead weight\n  document.cookie = 'access_token=; Max-Age=0; path=/';\n  goToLogin();\n}","preventionTips":["Map USER_NOT_FOUND to a hard logout, distinct from a transient auth failure","In test fixtures, create the user before issuing tokens referencing it","Back the user store with a persistent volume in production"],"tags":["auth","http-401","user-store","jwt","gateway"],"backgroundTag":null,"analyzedSha":"1dd6ba1acb03700589994b0366c5d1c7d05e2eff","analyzedAt":"2026-08-14T21:20:34.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}