{"record":{"id":"a2ca93048c0432ba","repo":"t8y2/dbx","slug":"cannot-s-user-s-while-connected-as-that-user","errorCode":null,"errorMessage":"Cannot %s user '%s' while connected as that user","messagePattern":"Cannot (.+?) user '(.+?)' while connected as that user","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/rabbitmq/operations.go","lineNumber":853,"sourceCode":"\tif err != nil {\n\t\treturn nil, err\n\t}\n\tconnection, err := s.requireConnectionConfig(params)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif err := assertNotConnectedUser(\"delete\", name, stringOrDefault(connection, \"username\", \"guest\")); err != nil {\n\t\treturn nil, err\n\t}\n\tif _, err := managementSend(connection, http.MethodDelete, \"/api/users/\"+urlEncodePathSegment(name), nil); err != nil {\n\t\treturn nil, err\n\t}\n\treturn okResult(), nil\n}\n\nfunc assertNotConnectedUser(action, name, connectedUser string) error {\n\tif name == connectedUser {\n\t\treturn fmt.Errorf(\"Cannot %s user '%s' while connected as that user\", action, name)\n\t}\n\treturn nil\n}\n\nfunc (s *server) listPermissions(params jsonObject) (any, error) {\n\tconnection, err := s.requireConnectionConfig(params)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tpermissions, err := managementGet(connection, \"/api/permissions\")\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tarray, ok := permissions.([]any)\n\tif !ok {\n\t\treturn nil, errors.New(\"Unexpected management API response for permission listing\")\n\t}\n\tvhostFilter := stringOrEmpty(params, \"virtual_host\")","sourceCodeStart":835,"sourceCodeEnd":871,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/rabbitmq/operations.go#L835-L871","documentation":"Deleting (or otherwise acting on) the very user the driver's connection authenticates as would cut off the connection and can lock out management access. The driver guards against createUser/deleteUser self-targeting.","triggerScenarios":"Calling createUser or deleteUser with a name equal to the connection config's username (connectedUser), e.g. deleting 'admin' while connected as 'admin'.","commonSituations":"Idempotent provisioning scripts that always run a delete-then-create for the user they connect with, test resets using the same admin user, wrong parameter ordering passing the connection user instead of the target user.","solutions":["Perform user management with a different administrative user than the target","Reorder operations: create the new user first, switch the connection to it, then delete the old one","Skip the operation when the target equals the connection username in your orchestration logic"],"exampleFix":"// before\nawait client.deleteUser({\"name\": \"admin\"}) // connected as admin\n// after\nawait client.connectUser({\"username\": \"provisioner\", \"password\": \"...\"})\nawait client.deleteUser({\"name\": \"admin\"})","handlingStrategy":"try-catch","validationCode":"if (targetUser === currentConnection.username) {\n  throw new Error(`connect as a different user before acting on '${targetUser}'`)\n}","typeGuard":null,"tryCatchPattern":"try {\n  await client.deleteUser({ name })\n} catch (e) {\n  if (String(e.message).includes(\"while connected as that user\")) {\n    await client.connectUser({ username: \"provisioner\", password: provisionerPw })\n    await client.deleteUser({ name })\n  } else { throw e }\n}","preventionTips":["Always administer users via a dedicated provisioner account distinct from app users","Compare target username against the connection username before create/delete","In provisioning scripts, create the replacement user before deleting the current one"],"tags":["rabbitmq","user","lifecycle","guard"],"backgroundTag":"resource-in-use","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}