{"record":{"id":"c13e39e25d27b180","repo":"different-ai/openwork","slug":"invalid-session-payload","errorCode":"invalid_session_payload","errorMessage":"Session response did not include a user.","messagePattern":"Session response did not include a user\\.","errorType":"error_code","errorClass":"DenApiError","httpStatus":500,"severity":"error","filePath":"apps/app/src/app/lib/den.ts","lineNumber":2963,"sourceCode":"      );\n    },\n\n    async signOut() {\n      await requestJson<unknown>(baseUrls, \"/api/auth/sign-out\", {\n        method: \"POST\",\n        token,\n        body: {},\n      });\n    },\n\n    async getSession(): Promise<DenUser> {\n      const payload = await requestJson<unknown>(baseUrls, \"/v1/me\", {\n        method: \"GET\",\n        token,\n      });\n      const user = getUser(payload);\n      if (!user) {\n        throw new DenApiError(500, \"invalid_session_payload\", \"Session response did not include a user.\");\n      }\n      return user;\n    },\n\n    async getAppVersionMetadata(): Promise<DenAppVersionMetadata> {\n      const payload = await requestJson<unknown>(baseUrls, \"/v1/app-version\", {\n        method: \"GET\",\n      });\n      const appVersionMetadata = getDenAppVersionMetadata(payload);\n      if (!appVersionMetadata) {\n        throw new DenApiError(500, \"invalid_app_version_payload\", \"App version response was missing version details.\");\n      }\n      return appVersionMetadata;\n    },\n\n    async getDesktopConfig(orgId?: string | null): Promise<DenDesktopConfig> {\n      const payload = await requestJson<unknown>(baseUrls, \"/v1/me/desktop-config\", {\n        method: \"GET\",","sourceCodeStart":2945,"sourceCodeEnd":2981,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/apps/app/src/app/lib/den.ts#L2945-L2981","documentation":"After fetching /v1/me, the client validates that the payload contains a recognizable user object via getUser. If the session response has no user, it throws a 500 DenApiError with code \"invalid_session_payload\". This protects callers from using a malformed or unexpected session payload.","triggerScenarios":"GET /v1/me returns 2xx but the body lacks a user object — e.g. a proxy/gateway returning HTML, a wrong server on the configured baseUrl, or a server version returning a different schema.","commonSituations":"Pointing the app at a non-Den server or outdated server, a reverse proxy auth page intercepting the request, or a valid token against an incompatible API version.","solutions":["Verify baseUrl/apiBaseUrl points at a compatible Den server and re-authenticate","Log the raw /v1/me payload to see what was actually returned","Check for proxy/VPN interference returning non-JSON bodies","Upgrade the server or client so both agree on the session schema"],"exampleFix":"// before\nconst user = await client.getMe();\n// after\nlet user;\ntry { user = await client.getMe(); }\ncatch (err) {\n  if (err instanceof DenApiError && err.code === \"invalid_session_payload\") await reauthenticate();\n  else throw err;\n}","handlingStrategy":"type-guard","validationCode":"const res = await fetch(`${baseUrl}/v1/me`, { headers: { authorization: `Bearer ${token}` } });\nconst contentType = res.headers.get(\"content-type\") ?? \"\";\nif (!contentType.includes(\"application/json\")) throw new Error(\"Den /v1/me did not return JSON\");","typeGuard":"const isDenUser = (u: unknown): u is DenUser =>\n  typeof u === \"object\" && u !== null && \"id\" in u && typeof (u as { id: unknown }).id === \"string\";","tryCatchPattern":"try {\n  user = await client.getMe();\n} catch (err) {\n  if (err instanceof DenApiError && err.code === \"invalid_session_payload\") {\n    await reauthenticate();\n    user = await client.getMe();\n  } else throw err;\n}","preventionTips":["Confirm the configured baseUrl points at a genuine, up-to-date Den server","Check content-type is JSON before parsing authenticated responses","Re-authenticate when session payloads look wrong — the token may be stale","Watch for proxies/VPNs substituting HTML for API responses"],"tags":["schema-validation","session","den-cloud","api"],"backgroundTag":"schema-validation-failed","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}