{"record":{"id":"bc4d13bded1a2a4b","repo":"vxcontrol/pentagi","slug":"user-has-been-blocked","errorCode":null,"errorMessage":"user has been blocked","messagePattern":"user has been blocked","errorType":"http","errorClass":null,"httpStatus":401,"severity":"warning","filePath":"backend/pkg/server/auth/auth_middleware.go","lineNumber":168,"sourceCode":"\tif time.Now().Unix() > expVal {\n\t\treturn authResultFail, errSessionExpired\n\t}\n\n\t// Verify user hash matches database\n\tuserID := uid.(uint64)\n\tsessionHash := uhash.(string)\n\n\tdbHash, userStatus, err := p.userCache.GetUserHash(userID)\n\tif err != nil {\n\t\tif errors.Is(err, gorm.ErrRecordNotFound) {\n\t\t\treturn authResultFail, errors.New(\"user has been deleted\")\n\t\t}\n\t\treturn authResultFail, fmt.Errorf(\"error checking user status: %w\", err)\n\t}\n\n\tswitch userStatus {\n\tcase models.UserStatusBlocked:\n\t\treturn authResultFail, errors.New(\"user has been blocked\")\n\tcase models.UserStatusCreated:\n\t\treturn authResultFail, errors.New(\"user is not ready\")\n\tcase models.UserStatusActive:\n\t}\n\n\tif dbHash != sessionHash {\n\t\treturn authResultFail, fmt.Errorf(\"%w - session invalid for this installation\", errUserHashMismatch)\n\t}\n\n\tc.Set(\"prm\", prms)\n\tc.Set(\"uid\", userID)\n\tc.Set(\"uhash\", sessionHash)\n\tc.Set(\"rid\", rid.(uint64))\n\tc.Set(\"exp\", exp.(int64))\n\tc.Set(\"gtm\", gtm.(int64))\n\tc.Set(\"tid\", tid.(string))\n\tc.Set(\"uname\", uname.(string))\n","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/backend/pkg/server/auth/auth_middleware.go#L150-L186","documentation":"After loading the user record, the middleware switches on user status; a user in UserStatusBlocked is rejected with 'user has been blocked'. The session may be otherwise valid, but blocked accounts are denied all authenticated requests until an admin changes the status.","triggerScenarios":"Any authenticated request from an account whose status is blocked — an admin blocked the user, automated abuse-prevention blocked the account, or the user was blocked in one environment while the client keeps retrying against it.","commonSituations":"Security team blocks an account with active browser sessions; user believes their credentials are wrong but the account is actually blocked; automated scripts retry endlessly against a blocked account.","solutions":["Contact an administrator to unblock the account if the block is unexpected","Stop automated retries — retrying will not succeed while the status is blocked","Log in with a different, active account"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await api.call();\n} catch (e) {\n  if (e.response?.status === 401 || e.response?.status === 403) {\n    // surface a clear 'account blocked' message; do not retry automatically\n    showError('Your account has been blocked. Contact an administrator.');\n  }\n}","preventionTips":["Do not build automatic retry loops that hammer a blocked account","Notify blocked users with a clear UI message instead of generic auth failure","Check account status in the admin panel before debugging credentials"],"tags":["authentication","authorization","user-status"],"backgroundTag":"account-blocked","analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}