{"record":{"id":"defa758b51e7e728","repo":"vxcontrol/pentagi","slug":"user-has-been-deleted","errorCode":null,"errorMessage":"user has been deleted","messagePattern":"user has been deleted","errorType":"http","errorClass":null,"httpStatus":401,"severity":"warning","filePath":"backend/pkg/server/auth/auth_middleware.go","lineNumber":161,"sourceCode":"\t\treturn authResultFail, errors.New(\"no permissions granted\")\n\t}\n\n\texpVal, ok := exp.(int64)\n\tif !ok {\n\t\treturn authResultFail, errors.New(\"token claim invalid\")\n\t}\n\tif time.Now().Unix() > expVal {\n\t\treturn authResultFail, errSessionExpired\n\t}\n\n\t// Verify user hash matches database\n\tuserID := uid.(uint64)\n\tsessionHash := uhash.(string)\n\n\tdbHash, userStatus, err := p.userCache.GetUserHash(userID)\n\tif err != nil {\n\t\tif errors.Is(err, gorm.ErrRecordNotFound) {\n\t\t\treturn authResultFail, errors.New(\"user has been deleted\")\n\t\t}\n\t\treturn authResultFail, fmt.Errorf(\"error checking user status: %w\", err)\n\t}\n\n\tswitch userStatus {\n\tcase models.UserStatusBlocked:\n\t\treturn authResultFail, errors.New(\"user has been blocked\")\n\tcase models.UserStatusCreated:\n\t\treturn authResultFail, errors.New(\"user is not ready\")\n\tcase models.UserStatusActive:\n\t}\n\n\tif dbHash != sessionHash {\n\t\treturn authResultFail, fmt.Errorf(\"%w - session invalid for this installation\", errUserHashMismatch)\n\t}\n\n\tc.Set(\"prm\", prms)\n\tc.Set(\"uid\", userID)","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/backend/pkg/server/auth/auth_middleware.go#L143-L179","documentation":"During cookie authentication the middleware looks up the user's hash/status via userCache.GetUserHash; if the user record no longer exists (gorm.ErrRecordNotFound) the session cannot belong to a valid account and the request fails with 'user has been deleted'. This is an authResultFail, typically yielding a 401.","triggerScenarios":"A request presents a valid-looking session cookie for a userID that no longer exists in the users table — the account was deleted while the browser still held the cookie, or the DB was reset/reseeded under a running session.","commonSituations":"Admin deletes a user who still has an open browser session; local dev database dropped/recreated; test environments reseed users with different IDs.","solutions":["Log in again with an existing account","If the user should still exist, verify the database the server is connected to actually contains that user row","Re-seed scenarios: clear the browser cookie so the stale session is not sent"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await api.call();\n} catch (e) {\n  if (e.response?.status === 401) {\n    // account may no longer exist — clear local state and re-login\n    localStorage.clear();\n    window.location.href = '/login';\n  }\n}","preventionTips":["Invalidate/delete the user's sessions server-side when deleting an account","Clear local client state after any account-management action","Avoid reseeding databases without also clearing browser sessions in dev"],"tags":["authentication","session","user-management"],"backgroundTag":"user-not-found","analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}