{"record":{"id":"b490d3ea0b796cfc","repo":"toeverything/AFFiNE","slug":"wrong-sign-in-method","errorCode":"wrong_sign_in_method","errorMessage":"You are trying to sign in by a different method than you signed up with.","messagePattern":"You are trying to sign in by a different method than you signed up with\\.","errorType":"error_code","errorClass":"WrongSignInMethod","httpStatus":400,"severity":"error","filePath":"packages/backend/server/src/models/user.ts","lineNumber":150,"sourceCode":"    const rows = await this.db.$queryRaw<User[]>`\n      SELECT id, name, email, password, registered, email_verified as \"emailVerifiedAt\", avatar_url as \"avatarUrl\", registered, created_at as \"createdAt\", disabled\n      FROM \"users\"\n      WHERE lower(\"email\") = lower(${email})\n      ${Prisma.raw(filter.withDisabled ? '' : 'AND disabled = false')}\n    `;\n\n    return rows[0] ?? null;\n  }\n\n  async signIn(email: string, password: string): Promise<User> {\n    const user = await this.getUserByEmail(email);\n\n    if (!user) {\n      throw new WrongSignInCredentials({ email });\n    }\n\n    if (!user.password) {\n      throw new WrongSignInMethod();\n    }\n\n    const passwordMatches = await this.crypto.verifyPassword(\n      password,\n      user.password\n    );\n\n    if (!passwordMatches) {\n      throw new WrongSignInCredentials({ email });\n    }\n\n    return user;\n  }\n\n  async getPublicUserByEmail(email: string): Promise<PublicUser | null> {\n    const rows = await this.db.$queryRaw<PublicUser[]>`\n      SELECT id, name, avatar_url as \"avatarUrl\"\n      FROM \"users\"","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/toeverything/AFFiNE/blob/26c515e050211269e911f7d9cfe162a26c83ed98/packages/backend/server/src/models/user.ts#L132-L168","documentation":"Thrown by UserModel.signIn (user.ts:150) when the user exists but has no password set (user.password is null/empty) — meaning they registered via OAuth or magic link, not email/password. Prevents invoking crypto.verifyPassword against a null hash. UserFriendlyError, code wrong_sign_in_method, type invalid_input, HTTP 400.","triggerScenarios":"A user who signed up with Google/GitHub/magic-link then submits the email+password sign-in form.","commonSituations":"SSO-only users hitting the legacy password form; mixed auth providers where some users never set a password; user expects a password exists but none was ever created.","solutions":["Sign in via the OAuth provider / magic link used at sign-up.","If password login is required, set a password through the password-reset flow first.","When this error appears, guide the user: 'You registered with <provider>; use that to sign in.'"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"import { WrongSignInMethod } from '../base/error/errors.gen';\n\ntry {\n  await models.user.signIn(email, password);\n} catch (e) {\n  if (e instanceof WrongSignInMethod) {\n    // prompt: 'You registered via OAuth/magic link — use that method.'\n  } else throw e;\n}","preventionTips":["On the sign-in form, detect OAuth-only accounts and offer the provider button.","Let users set a password via the reset flow if they want password login.","Don't attempt crypto.verifyPassword when no password hash is present."],"tags":["auth","signin","oauth"],"backgroundTag":null,"analyzedSha":"26c515e050211269e911f7d9cfe162a26c83ed98","analyzedAt":"2026-08-12T13:15:16.447Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}