{"record":{"id":"e586fb45f1f058a8","repo":"HeyPuter/puter","slug":"not-found-e586fb","errorCode":"not_found","errorMessage":"Username not found.","messagePattern":"Username not found\\.","errorType":"http","errorClass":"HttpError","httpStatus":404,"severity":"error","filePath":"src/backend/controllers/auth/AuthController.ts","lineNumber":399,"sourceCode":"            throw new HttpError(400, 'Invalid password.', {\n                legacyCode: 'bad_request',\n            });\n        }\n\n        // Look up user\n        let user;\n        if (username) {\n            if (typeof username !== 'string')\n                throw new HttpError(400, 'username must be a string.', {\n                    legacyCode: 'bad_request',\n                });\n            user = await this.stores.user.getByUsername(username);\n        } else {\n            user = await this.stores.user.getByEmail(email);\n        }\n\n        if (!user) {\n            throw new HttpError(\n                404,\n                username ? 'Username not found.' : 'Email not found.',\n                { legacyCode: 'not_found' },\n            );\n        }\n        if (\n            user.username === 'system' &&\n            !(this.config as { allow_system_login?: boolean })\n                .allow_system_login\n        ) {\n            throw new HttpError(\n                404,\n                username ? 'Username not found.' : 'Email not found.',\n                { legacyCode: 'not_found' },\n            );\n        }\n        if (user.suspended) {\n            throw new HttpError(401, 'This account is suspended.', {","sourceCodeStart":381,"sourceCodeEnd":417,"githubUrl":"https://github.com/HeyPuter/puter/blob/908ec23eda38526170322c3edf71ba45ecb1ca95/src/backend/controllers/auth/AuthController.ts#L381-L417","documentation":"Returned by POST /login when a username is supplied but getByUsername resolves to null — no account exists with that exact username. It is a genuine not-found result from the user store (as opposed to the disguised system-user block at line 410 which reuses the same message).","triggerScenarios":"Logging in with a username that was never registered, was renamed, or was deleted; case-mismatch (usernames are looked up exactly).","commonSituations":"Typo in the username; account renamed; user confusion between username and email; deleted account.","solutions":["Double-check the username spelling and case.","If unsure, try logging in with the account's email instead.","Register the account if it does not exist."],"exampleFix":"// before\nawait fetch('/login', { method:'POST', body:JSON.stringify({ username: 'jsmith', password }) }); // no such user\n\n// after: fall back to email lookup\nawait fetch('/login', { method:'POST', body:JSON.stringify({ email: 'jsmith@example.com', password }) });","handlingStrategy":"try-catch","validationCode":"// Pre-check existence only if enumeration is acceptable for your flow\n// Otherwise just handle the 404 in the UI.","typeGuard":null,"tryCatchPattern":"try { await login(username, password); }\ncatch (e) {\n  if (e.code === 'not_found') { /* prompt the user to register or use email */ }\n  else throw e;\n}","preventionTips":["Offer a 'forgot username' / email fallback in the login UI.","Trim and case-check the username before submit."],"tags":["auth","login","not-found","user"],"backgroundTag":null,"analyzedSha":"908ec23eda38526170322c3edf71ba45ecb1ca95","analyzedAt":"2026-08-12T20:53:15.911Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}