{"record":{"id":"d348ec9a24cad36f","repo":"odysseus-dev/odysseus","slug":"authentication-required-d348ec","errorCode":null,"errorMessage":"Authentication required","messagePattern":"Authentication required","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"routes/session_routes.py","lineNumber":108,"sourceCode":"\ndef _reject_compact_during_active_run(session_id: str) -> None:\n    from src import agent_runs\n    if agent_runs.is_active(session_id):\n        raise HTTPException(409, \"Session has an active run; try compacting after it finishes\")\n\n\ndef _verify_session_owner(request: Request, session_id: str, session_manager=None):\n    \"\"\"Verify the current user owns the session, honoring single-user modes.\n\n    Authenticated requests must match the stored DB or in-memory owner. When\n    auth is disabled and no user is present, treat the app as single-user mode:\n    verify that the session exists, but do not compare its stored owner. This\n    keeps QA/dev instances with AUTH_ENABLED=false from rejecting owner-stamped\n    rows created while auth was previously enabled.\n    \"\"\"\n    user = effective_user(request)\n    if not user and not _auth_disabled():\n        raise HTTPException(401, \"Authentication required\")\n    db = SessionLocal()\n    try:\n        row = db.query(DbSession.owner).filter(DbSession.id == session_id).first()\n    finally:\n        db.close()\n    if row is not None:\n        if user and row.owner != user:\n            raise HTTPException(404, f\"Session {session_id} not found\")\n        return\n    # No DB row — allow the caller to act on an in-memory ghost they own.\n    if session_manager is not None:\n        ghost = getattr(session_manager, \"sessions\", {}).get(session_id)\n        if ghost is not None and (not user or getattr(ghost, \"owner\", None) == user):\n            return\n    raise HTTPException(404, f\"Session {session_id} not found\")\n\nlogger = logging.getLogger(__name__)\n","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/odysseus-dev/odysseus/blob/f9235ebbf13f693a6fd29ce70b097f6ec83705bf/routes/session_routes.py#L90-L126","documentation":"Error \"Authentication required\" thrown in odysseus-dev/odysseus.","triggerScenarios":"Triggered when the corresponding server-side validation or runtime check at the recorded location rejects the request or operation and returns this error message to the caller.","commonSituations":"See trigger scenarios.","solutions":["Log in and retry the request.","Provide valid credentials or an API token."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"f9235ebbf13f693a6fd29ce70b097f6ec83705bf","analyzedAt":"2026-08-14T21:47:48.359Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}