{"record":{"id":"b431e68472e435c3","repo":"FlowiseAI/Flowise","slug":"error-credentialscontroller-revealcredentialbyid-b431e6","errorCode":null,"errorMessage":"Error: credentialsController.revealCredentialById - workspace ${workspaceId} not found!","messagePattern":"Error: credentialsController\\.revealCredentialById - workspace (.+?) not found!","errorType":"exception","errorClass":"InternalFlowiseError","httpStatus":404,"severity":"error","filePath":"packages/server/src/controllers/credentials/index.ts","lineNumber":93,"sourceCode":"        }\n        const apiResponse = await credentialsService.getCredentialById(req.params.id, workspaceId)\n        return res.json(apiResponse)\n    } catch (error) {\n        next(error)\n    }\n}\n\nconst revealCredentialById = async (req: Request, res: Response, next: NextFunction) => {\n    try {\n        if (typeof req.params === 'undefined' || !req.params.id) {\n            throw new InternalFlowiseError(\n                StatusCodes.PRECONDITION_FAILED,\n                `Error: credentialsController.revealCredentialById - id not provided!`\n            )\n        }\n        const workspaceId = req.user?.activeWorkspaceId\n        if (!workspaceId) {\n            throw new InternalFlowiseError(\n                StatusCodes.NOT_FOUND,\n                `Error: credentialsController.revealCredentialById - workspace ${workspaceId} not found!`\n            )\n        }\n        const apiResponse = await credentialsService.revealCredentialById(req.params.id, workspaceId)\n        return res.json(apiResponse)\n    } catch (error) {\n        next(error)\n    }\n}\n\nconst updateCredential = async (req: Request, res: Response, next: NextFunction) => {\n    try {\n        if (typeof req.params === 'undefined' || !req.params.id) {\n            throw new InternalFlowiseError(\n                StatusCodes.PRECONDITION_FAILED,\n                `Error: credentialsController.updateCredential - id not provided!`\n            )","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/server/src/controllers/credentials/index.ts#L75-L111","documentation":"Thrown by revealCredentialById when req.user.activeWorkspaceId is falsy. Because this endpoint returns decrypted secrets, hitting it without a workspace claim is both a functionality failure and a signal that the auth claim is incomplete. Returns HTTP 404.","triggerScenarios":"GET /api/v1/credentials/:id/reveal with a valid id but a JWT/session lacking activeWorkspaceId. Common right after login if the credentials page auto-reveals on mount.","commonSituations":"User joined a workspace after their JWT was issued. SSO flow that doesn't propagate workspace. Cookie cleared mid-session. Token minted by a backdoor/test script with no workspace claim.","solutions":["Re-authenticate the user to mint a JWT that includes activeWorkspaceId.","Verify workspace membership and re-add the user if they were removed.","On the client, only enable the Reveal button after confirming loggedInUser.activeWorkspaceId is present.","For tests, set req.user.activeWorkspaceId explicitly."],"exampleFix":"// client gate\nconst canReveal = Boolean(loggedInUser?.activeWorkspaceId && selectedCredentialId)\n<Button disabled={!canReveal} onClick={reveal}>Reveal</Button>","handlingStrategy":"validation","validationCode":"// gate reveal on BOTH id and workspace\nconst canReveal =\n  typeof selectedId === 'string' && selectedId.length > 0\n  && typeof currentUser?.activeWorkspaceId === 'string'\n\nif (canReveal) {\n  await api.revealCredentialById(selectedId)\n}","typeGuard":"function hasActiveWorkspace(u: unknown): u is { activeWorkspaceId: string } {\n  return typeof u === 'object' && u !== null\n    && typeof (u as any).activeWorkspaceId === 'string'\n    && (u as any).activeWorkspaceId.length > 0\n}","tryCatchPattern":"try {\n  await api.revealCredentialById(id)\n} catch (e) {\n  if (e.status === 404 && /workspace .* not found/.test(e.message)) {\n    await auth.relogin()\n  } else throw e\n}","preventionTips":["Treat the reveal endpoint as privileged — re-check the workspace claim client-side before calling.","Auto-disable Reveal when the session is about to expire; refresh tokens first.","Audit logs for repeated 404s on reveal — it may indicate token-rotation bugs."],"tags":["auth","session","workspace","credentials","secrets","flowise"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}