{"record":{"id":"bad4bc42eef5a1ac","repo":"payloadcms/payload","slug":"unauthorized-you-must-be-logged-in-to-make-this-r","errorCode":null,"errorMessage":"Unauthorized, you must be logged in to make this request.","messagePattern":"Unauthorized, you must be logged in to make this request\\.","errorType":"http","errorClass":"UnauthorizedError","httpStatus":401,"severity":"error","filePath":"packages/payload/src/preferences/operations/delete.ts","lineNumber":17,"sourceCode":"import type { Document, Where } from '../../types/index.js'\nimport type { PreferenceRequest } from '../types.js'\n\nimport { NotFound } from '../../errors/NotFound.js'\nimport { UnauthorizedError } from '../../errors/UnauthorizedError.js'\nimport { preferencesCollectionSlug } from '../config.js'\n\nexport async function deleteOperation(args: PreferenceRequest): Promise<Document> {\n  const {\n    key,\n    req: { payload },\n    req,\n    user,\n  } = args\n\n  if (!user) {\n    throw new UnauthorizedError(req.t)\n  }\n\n  const where: Where = {\n    and: [\n      { key: { equals: key } },\n      { 'user.value': { equals: user.id } },\n      { 'user.relationTo': { equals: user.collection } },\n    ],\n  }\n\n  const result = await payload.db.deleteOne({\n    collection: preferencesCollectionSlug,\n    req,\n    where,\n  })\n\n  if (result) {\n    return result","sourceCodeStart":1,"sourceCodeEnd":35,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/payload/src/preferences/operations/delete.ts#L1-L35","documentation":"Thrown by the preferences `deleteOperation` when `req.user` is falsy. Preferences are per-user records keyed by `user.value`/`user.relationTo`, so deleting one requires an authenticated user to scope the where clause. No user means the operation cannot be safely scoped.","triggerScenarios":"Calling the preferences delete endpoint (or `payload.delete({ collection: 'payload-preferences', ... })`) on a request with no authenticated user, or with `overrideAccess: false` and a req lacking `user`.","commonSituations":"Hitting `/api/payload-preferences/<key>` without a session cookie/token; a server-to-server call that forgot to attach `req.user`; calling the Local API delete without passing an authenticated `req`.","solutions":["Authenticate the request first so `req.user` is populated.","When using the Local API, pass a req with a user: `payload.delete({ collection: 'payload-preferences', id, req: authenticatedReq })`.","If this is intentional trusted code, use `overrideAccess: true` only where appropriate (preferences still require a user to scope)."],"exampleFix":"// before\nawait payload.delete({ collection: 'payload-preferences', id, req })\n\n// after\nif (!req.user) throw new Error('login required')\nawait payload.delete({ collection: 'payload-preferences', id, req })","handlingStrategy":"validation","validationCode":"if (!req.user) {\n  return res.status(401).json({ error: 'Authentication required' })\n}\n\nawait payload.delete({ collection: 'payload-preferences', id, req })","typeGuard":"import type { PayloadRequest, User } from 'payload'\n\nfunction isAuthenticated(req: PayloadRequest): req is PayloadRequest & { user: User } {\n  return Boolean(req.user)\n}\n\nif (!isAuthenticated(req)) throw new UnauthorizedError(req.t)","tryCatchPattern":"try {\n  await payload.delete({ collection: 'payload-preferences', id, req })\n} catch (err) {\n  if (err instanceof UnauthorizedError || err.statusCode === 401) {\n    // prompt login / return 401 to the client\n  } else throw err\n}","preventionTips":["Gate preference routes behind auth middleware at the API layer.","When using the Local API, always forward the authenticated `req`.","Add a UI guard so preference actions are only rendered for logged-in users."],"tags":["preferences","authentication","authorization"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}