{"record":{"id":"ca14eb254c263611","repo":"payloadcms/payload","slug":"unauthorized-you-must-be-logged-in-to-make-this-r-ca14eb","errorCode":null,"errorMessage":"Unauthorized, you must be logged in to make this request.","messagePattern":"Unauthorized, you must be logged in to make this request\\.","errorType":"http","errorClass":"UnauthorizedError","httpStatus":401,"severity":"error","filePath":"packages/payload/src/preferences/operations/update.ts","lineNumber":17,"sourceCode":"import type { Where } from '../../types/index.js'\nimport type { PreferenceUpdateRequest } from '../types.js'\n\nimport { UnauthorizedError } from '../../errors/UnauthorizedError.js'\nimport { preferencesCollectionSlug } from '../config.js'\n\nexport async function update(args: PreferenceUpdateRequest) {\n  const {\n    key,\n    req: { payload },\n    req,\n    user,\n    value,\n  } = args\n\n  if (!user) {\n    throw new UnauthorizedError(req.t)\n  }\n\n  const where: Where = {\n    and: [\n      { key: { equals: key } },\n      { 'user.value': { equals: user.id } },\n      { 'user.relationTo': { equals: user.collection } },\n    ],\n  }\n\n  const preference = {\n    key,\n    user: {\n      relationTo: user.collection,\n      value: user.id,\n    },\n    value,\n  }","sourceCodeStart":1,"sourceCodeEnd":35,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/payload/src/preferences/operations/update.ts#L1-L35","documentation":"Thrown by the preferences `update` operation when `req.user` is falsy. Like delete, preferences updates are scoped to the authenticated user (the where clause uses `user.value`/`user.relationTo`), so an anonymous request cannot target a preference row.","triggerScenarios":"Calling the preferences update endpoint or `payload.update({ collection: 'payload-preferences', ... })` on a request with no authenticated user.","commonSituations":"Frontend preference save fired before login completed; server-side update without forwarding the user/session; middleware stripping auth before the preferences route.","solutions":["Ensure the request is authenticated (`req.user` set) before calling update.","Forward an authenticated `req` when using the Local API.","Guard the UI action behind a logged-in check so the call is never made anonymously."],"exampleFix":"// before\nawait payload.update({ collection: 'payload-preferences', id, data: { value }, req })\n\n// after\nif (!req.user) throw new Error('login required')\nawait payload.update({ collection: 'payload-preferences', id, data: { value }, req })","handlingStrategy":"validation","validationCode":"if (!req.user) {\n  return res.status(401).json({ error: 'Authentication required' })\n}\n\nawait payload.update({\n  collection: 'payload-preferences',\n  id,\n  data: { value },\n  req,\n})","typeGuard":"import type { PayloadRequest, User } from 'payload'\n\nfunction isAuthenticated(req: PayloadRequest): req is PayloadRequest & { user: User } {\n  return Boolean(req.user)\n}\n\nif (!isAuthenticated(req)) throw new UnauthorizedError(req.t)","tryCatchPattern":"try {\n  await payload.update({ collection: 'payload-preferences', id, data: { value }, req })\n} catch (err) {\n  if (err.statusCode === 401) {\n    // redirect to login / return 401\n  } else throw err\n}","preventionTips":["Ensure the session is established before issuing preference save calls.","Forward the authenticated `req` in Local API calls.","UI: disable preference controls until the user is logged in."],"tags":["preferences","authentication","authorization"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}