{"record":{"id":"ae6ef4f275fbaa00","repo":"AlistGo/alist","slug":"failed-to-get-guest-w","errorCode":null,"errorMessage":"failed to get guest: %w","messagePattern":"failed to get guest: %w","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"server/mcp/auth.go","lineNumber":56,"sourceCode":"\nfunc authenticateToken(token string) (*model.User, error) {\n\t// Check admin static token\n\tif token != \"\" && subtle.ConstantTimeCompare([]byte(token), []byte(setting.GetStr(conf.Token))) == 1 {\n\t\tadmin, err := op.GetAdmin()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to get admin: %w\", err)\n\t\t}\n\t\tif err := loadRoles(admin); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\treturn admin, nil\n\t}\n\n\t// No token: guest\n\tif token == \"\" {\n\t\tguest, err := op.GetGuest()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to get guest: %w\", err)\n\t\t}\n\t\tif guest.Disabled {\n\t\t\treturn nil, fmt.Errorf(\"guest user is disabled\")\n\t\t}\n\t\tif err := loadRoles(guest); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\treturn guest, nil\n\t}\n\n\t// JWT token\n\tclaims, err := common.ParseToken(token)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid token: %w\", err)\n\t}\n\n\tuser, err := op.GetUserByName(claims.Username)\n\tif err != nil {","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/AlistGo/alist/blob/843d9dc8149126976b2625911e45a4d3ffd6f2f5/server/mcp/auth.go#L38-L74","documentation":"Returned by authenticateToken (server/mcp/auth.go:56) when an MCP request arrives with no token (guest path) and op.GetGuest() fails. Like 1187 this is a server-side lookup failure, not an auth decision — the guest user record could not be loaded from the database, and the wrapped error explains why.","triggerScenarios":"MCP client connects with an empty Authorization header while the database is down, the guest user row is missing, or migrations have not run.","commonSituations":"Fresh deployments where setup did not seed the guest account; DB outages surfacing here first because unauthenticated MCP calls hit this path before any other.","solutions":["Check server logs for the wrapped database error","Ensure initialization and migration ran so the guest user exists","Restore DB connectivity, then retry the tokenless request","If guest access was never intended, send a real token so this path is not used"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"failed to get guest\") { backoff.Retry(mcpCall, 3) }","preventionTips":["Always send a token to MCP unless anonymous access is a deliberate choice","Keep guest-account seeding in deployment checks","Watch server logs for the wrapped DB cause"],"tags":["mcp","auth","database","server-side"],"backgroundTag":null,"analyzedSha":"843d9dc8149126976b2625911e45a4d3ffd6f2f5","analyzedAt":"2026-08-15T12:14:11.722Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}