{"record":{"id":"daeb79a56e68c368","repo":"infiniflow/ragflow","slug":"invalid-email-address-username","errorCode":null,"errorMessage":"Invalid email address: {username}!","messagePattern":"Invalid email address: (.+?)!","errorType":"http","errorClass":"AdminException","httpStatus":400,"severity":"error","filePath":"admin/server/services.py","lineNumber":85,"sourceCode":"                    \"email\": user.email,\n                    \"language\": user.language,\n                    \"last_login_time\": user.last_login_time,\n                    \"is_active\": user.is_active,\n                    \"is_anonymous\": user.is_anonymous,\n                    \"login_channel\": user.login_channel,\n                    \"status\": user.status,\n                    \"is_superuser\": user.is_superuser,\n                    \"create_date\": user.create_date,\n                    \"update_date\": user.update_date,\n                }\n            )\n        return result\n\n    @staticmethod\n    def create_user(username, password, role=\"user\") -> dict:\n        # Validate the email address\n        if not re.match(r\"^[\\w\\._-]+@([\\w_-]+\\.)+[\\w-]{2,}$\", username):\n            raise AdminException(f\"Invalid email address: {username}!\")\n        # Check if the email address is already used\n        if UserService.query(email=username):\n            raise UserAlreadyExistsError(username)\n        # Construct user info data\n        user_info_dict = {\n            \"email\": username,\n            \"nickname\": \"\",  # ask user to edit it manually in settings.\n            \"password\": decrypt(password),\n            \"login_channel\": \"password\",\n            \"is_superuser\": role == \"admin\",\n        }\n        return create_new_user(user_info_dict)\n\n    @staticmethod\n    def delete_user(username):\n        # use email to delete\n        user_list = UserService.query_user_by_email(username)\n        if not user_list:","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/admin/server/services.py#L67-L103","documentation":"Raised by UserMgr.create_user (admin/server/services.py:85) as an AdminException (HTTP 400) when the supplied username fails the email regex ^[\\w\\._-]+@([\\w_-]+\\.)+[\\w-]{2,}$. The admin user-management API only accepts users identified by email address, so a malformed address is rejected before any database lookup. The message embeds the offending username verbatim.","triggerScenarios":"POST to the admin CLI/server 'create user' endpoint with a non-email username: missing '@', no dot in the domain, a single-label domain ('user@localhost'), or characters outside [A-Za-z0-9_.-] such as 'user+tag@example.com' (the '+' is rejected by this regex).","commonSituations":"Scripts that pass a nickname or phone-style id instead of an email; plus-addressed addresses; IDN/unicode emails; leading/trailing whitespace in shell arguments; typos in automation config files feeding the admin command.","solutions":["Pass a well-formed email address as username, e.g. 'user@example.com' (needs a dotted domain of 2+ letters).","Strip/trim whitespace from the username before calling create_user.","If you need '+' addressing, pre-validate and normalize the address (e.g. strip the +tag part) or relax the regex in services.py to accept it.","Add client-side email format validation before invoking the admin API so users get feedback early."],"exampleFix":"# before\nUserMgr.create_user('user+tag@example.com', encrypted_pw)  # raises Invalid email address\n\n# after\nimport re\nemail = 'user+tag@example.com'.strip()\nassert re.match(r\"^[\\w\\._-]+@([\\w_-]+\\.)+[\\w-]{2,}$\", email), 'address rejected by admin API'\nUserMgr.create_user(email.split('+')[0] + '@example.com', encrypted_pw)","handlingStrategy":"validation","validationCode":"import re\n\nEMAIL_RE = re.compile(r\"^[\\w\\._-]+@([\\w_-]+\\.)+[\\w-]{2,}$\")\n\ndef is_valid_admin_email(username: str) -> bool:\n    return bool(username and EMAIL_RE.match(username.strip()))","typeGuard":"def is_valid_admin_email(username: str) -> bool:\n    import re\n    return isinstance(username, str) and bool(re.match(r\"^[\\w\\._-]+@([\\w_-]+\\.)+[\\w-]{2,}$\", username.strip()))","tryCatchPattern":"from admin.server.exceptions import AdminException\ntry:\n    UserMgr.create_user(email, encrypted_pw, role)\nexcept AdminException as e:\n    if e.code == 400 and e.message.startswith('Invalid email address'):\n        raise ValueError(f'bad email input: {email!r}') from e\n    raise","preventionTips":["Validate the email against the same regex the server uses before calling create_user.","Strip whitespace and lowercase the address client-side.","Reject '+'-style addresses or normalize them before submission; this regex does not accept them.","Surface server 400 messages to the operator verbatim in provisioning scripts."],"tags":["validation","email","admin-api","user-management"],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}