{"record":{"id":"ab60d83fdeee0aee","repo":"FlowiseAI/Flowise","slug":"error-credentialscontroller-deletecredentials-w","errorCode":null,"errorMessage":"Error: credentialsController.deleteCredentials - workspace ${workspaceId} not found!","messagePattern":"Error: credentialsController\\.deleteCredentials - workspace (.+?) not found!","errorType":"exception","errorClass":"InternalFlowiseError","httpStatus":404,"severity":"error","filePath":"packages/server/src/controllers/credentials/index.ts","lineNumber":33,"sourceCode":"        body.workspaceId = req.user?.activeWorkspaceId\n        const apiResponse = await credentialsService.createCredential(body)\n        return res.json(apiResponse)\n    } catch (error) {\n        next(error)\n    }\n}\n\nconst deleteCredentials = async (req: Request, res: Response, next: NextFunction) => {\n    try {\n        if (typeof req.params === 'undefined' || !req.params.id) {\n            throw new InternalFlowiseError(\n                StatusCodes.PRECONDITION_FAILED,\n                `Error: credentialsController.deleteCredentials - id not provided!`\n            )\n        }\n        const workspaceId = req.user?.activeWorkspaceId\n        if (!workspaceId) {\n            throw new InternalFlowiseError(\n                StatusCodes.NOT_FOUND,\n                `Error: credentialsController.deleteCredentials - workspace ${workspaceId} not found!`\n            )\n        }\n        const apiResponse = await credentialsService.deleteCredentials(req.params.id, workspaceId)\n        return res.json(apiResponse)\n    } catch (error) {\n        next(error)\n    }\n}\n\nconst getAllCredentials = async (req: Request, res: Response, next: NextFunction) => {\n    try {\n        const workspaceId = req.user?.activeWorkspaceId\n        if (!workspaceId) {\n            throw new InternalFlowiseError(\n                StatusCodes.NOT_FOUND,\n                `Error: credentialsController.getAllCredentials - workspace ${workspaceId} not found!`","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/server/src/controllers/credentials/index.ts#L15-L51","documentation":"Thrown by deleteCredentials when req.user.activeWorkspaceId is falsy (undefined/null/''). Despite the message saying 'workspace not found', the workspace was never looked up — the authenticated user simply has no active workspace bound to their session. The literal ${workspaceId} in the message stays unresolved ('undefined') because the throw happens before any value exists. This is a session/auth-claim defect, not a missing DB row.","triggerScenarios":"DELETE /api/v1/credentials/:id reached with a valid JWT but the token's payload lacks activeWorkspaceId (e.g. token minted before workspace assignment, or login done in a non-enterprise OSS mode that never sets activeWorkspaceId). Also fires if the auth middleware populates req.user from a stale session where the user was removed from their workspace.","commonSituations":"User accepted a workspace invite after their current JWT was issued; the old token has no activeWorkspaceId. SSO login path (setTokenOrCookies) that doesn't propagate activeWorkspaceId. Tests hitting the route with a stubbed req.user that omits activeWorkspaceId. Mixing OSS and enterprise builds where the user object shape differs.","solutions":["Have the user sign out and back in so a fresh JWT is minted with activeWorkspaceId populated from their workspace assignment.","Confirm the user actually belongs to a workspace (check workspace_user table / workspace membership in admin UI); assign them to one if not.","If writing a client/integration, after login call the workspace-switch endpoint to set activeWorkspaceId before deleting credentials.","If reproducing in tests, set req.user = { activeWorkspaceId: '<uuid>' } in your stub.","If you control the token, verify your login flow sets activeWorkspaceId in generateJwtAuthToken's user payload (see _generateJwtToken's meta field)."],"exampleFix":"// before — token minted without activeWorkspaceId\nconst loggedInUser = { id, email, name } // missing activeWorkspaceId\n\n// after — ensure activeWorkspaceId is on the user before signing\nconst loggedInUser = {\n  id, email, name,\n  activeWorkspaceId: workspaceUser.workspaceId,\n  activeWorkspace: workspaceUser.workspace.name\n}","handlingStrategy":"validation","validationCode":"// Run before calling deleteCredentials — guard the workspace claim\nfunction assertActiveWorkspace(user: unknown): string {\n  const ws = (user as any)?.activeWorkspaceId\n  if (typeof ws !== 'string' || ws.length === 0) {\n    throw new Error('User session has no activeWorkspaceId — re-login required')\n  }\n  return ws\n}\n\n// usage\nconst wsId = assertActiveWorkspace(currentUser)\nawait api.deleteCredentials(id, wsId)","typeGuard":"function hasActiveWorkspace(u: unknown): u is { activeWorkspaceId: string } {\n  return typeof u === 'object' && u !== null\n    && typeof (u as any).activeWorkspaceId === 'string'\n    && (u as any).activeWorkspaceId.length > 0\n}","tryCatchPattern":"try {\n  await api.deleteCredentials(id)\n} catch (e) {\n  if (/workspace .* not found/.test(e.message)) {\n    // session lost workspace claim — force re-login, don't retry blindly\n    await auth.logout(); router.push('/signin')\n  } else { throw e }\n}","preventionTips":["Always populate activeWorkspaceId in the user payload before signing the JWT (see passport localStrategy).","After workspace-switch, persist the chosen workspace id in the client session and re-fetch user claims.","In tests, centralize an auth stub that always sets activeWorkspaceId rather than re-specifying it per test."],"tags":["auth","session","workspace","credentials","flowise"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}