{"record":{"id":"ddd60d374e387cc9","repo":"hcengineering/platform","slug":"addsession-rejected-by-account-service","errorCode":null,"errorMessage":"addSession: rejected by account service","messagePattern":"addSession: rejected by account service","errorType":"error_code","errorClass":"PlatformError","httpStatus":null,"severity":"warning","filePath":"foundations/server/packages/server/src/sessionManager.ts","lineNumber":829,"sourceCode":"            ])\n          }\n\n          // Mark workspace as init completed and we had at least one client.\n          if (!workspace.workspaceInitCompleted) {\n            workspace.workspaceInitCompleted = true\n          }\n\n          if (this.timeMinutes > 0) {\n            void ws\n              .send(ctx, { result: this.createMaintenanceWarning() }, session.binaryMode, session.useCompression)\n              .catch((err) => {\n                ctx.error('failed to send maintenance warning', err)\n              })\n          }\n          return { session, context: workspace.context, workspaceId: workspace.wsId.uuid }\n        } catch (err: unknown) {\n          if (err instanceof PlatformError) {\n            ctx.warn('addSession: rejected by account service', {\n              workspaceUuid: token.workspace,\n              code: err.status.code,\n              source: token.extra?.service ?? '🤦‍♂️user'\n            })\n            return { error: err.status, terminate: true }\n          }\n          throw err\n        }\n      })\n    )\n  }\n\n  private async switchToUpgradeSession (\n    token: Token,\n    ctx: MeasureContext,\n    workspace: Workspace,\n    ws: ConnectionSocket\n  ): Promise<void> {","sourceCodeStart":811,"sourceCodeEnd":847,"githubUrl":"https://github.com/hcengineering/platform/blob/63e28dc96483967b2fc21c881b3f1023c1de7718/foundations/server/packages/server/src/sessionManager.ts#L811-L847","documentation":"Later in addSession, after workspace resolution, attaching the session can still be rejected by the account service with a PlatformError. The message is logged with the workspace UUID and status code, and the client receives the error status with terminate:true — the account service refused the session (authorization, quota, or workspace state).","triggerScenarios":"Workspace is full (seat/limit exceeded), account is disabled, token lacks required privileges, or the account service rejects session creation for policy reasons during WebSocket connect.","commonSituations":"Exceeded concurrent-session or user limits; account deactivated/banned between token issuance and connect; rate limiting by the account service.","solutions":["Read err.status.code from the returned error to identify the rejection reason","Free up seats / upgrade the workspace limit if quota-related","Re-enable the account or obtain a new token with correct privileges","Check account service logs for the matching rejection"],"exampleFix":"// before\nsocket.connect({ token }) // rejected: workspace seats exhausted\n// after\ntry {\n  socket.connect({ token })\n} catch (e) {\n  if (e.status?.code === LIMIT_REACHED) {\n    await upgradeWorkspaceSeats(workspace)\n    socket.connect({ token })\n  }\n}","handlingStrategy":"try-catch","validationCode":"const seats = await accountClient.getSessionUsage(workspaceUuid)\nif (seats.used >= seats.limit) throw new Error('session limit reached')","typeGuard":"function isPlatformError(e: unknown): e is PlatformError {\n  return e instanceof PlatformError\n}","tryCatchPattern":"try {\n  await connect(token)\n} catch (err) {\n  if (isPlatformError(err)) {\n    if (err.status.code === LIMIT_REACHED) await upgradePlan()\n    else await reauthenticate()\n  } else throw err\n}","preventionTips":["Handle quota/limit codes from the account service proactively in the client","Re-authenticate on rejection instead of retrying with the same token","Alert on spikes of 'rejected by account service' warnings","Keep account data (disabled accounts, bans) synced before session attach"],"tags":["typescript","session","authorization","account-service"],"backgroundTag":"session-rejected-by-account-service","analyzedSha":"63e28dc96483967b2fc21c881b3f1023c1de7718","analyzedAt":"2026-08-29T15:21:27.377Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}