{"record":{"id":"e6645e068dc6a2e4","repo":"theonedev/onedev","slug":"account-is-disabled-e6645e","errorCode":null,"errorMessage":"Account is disabled","messagePattern":"Account is disabled","errorType":"exception","errorClass":"DisabledAccountException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/service/impl/DefaultAccessTokenService.java","lineNumber":72,"sourceCode":"    }\n\n\t@Sessional\n\t@Override\n\tpublic AccessToken findByOwnerAndName(User owner, String name) {\n\t\tif (cache != null) {\n\t\t\tvar facade = cache.findByOwnerAndName(owner.getId(), name);\n\t\t\tif (facade != null) \n\t\t\t\treturn load(facade.getId());\n\t\t\telse \n\t\t\t\treturn null;\n\t\t} else {\n\t\t\tthrow new ServerNotReadyException();\n\t\t}\n\t}\n\n\tprivate AccessToken checkDisabled(AccessToken accessToken) {\n\t\tif (accessToken.getOwner().isDisabled())\n\t\t\tthrow new DisabledAccountException(\"Account is disabled\");\n\t\treturn accessToken;\n\t}\n\n    @Override\n    public final AccessToken findByValue(String value) {\n\t\treturn sessionService.call(new Callable<AccessToken>() {\n\n\t\t\t@Override\n\t\t\tpublic AccessToken call() throws Exception {\n\t\t\t\tif (cache != null) {\n\t\t\t\t\tvar facade = cache.findByValue(value);\n\t\t\t\t\tif (facade != null) {\n\t\t\t\t\t\treturn checkDisabled(load(facade.getId()));\n\t\t\t\t\t} else {\n\t\t\t\t\t\tLong userId = temporalAccessTokens.get(value);\n\t\t\t\t\t\tif (userId != null) {\n\t\t\t\t\t\t\tvar accessToken = new AccessToken();\n\t\t\t\t\t\t\taccessToken.setOwner(userService.load(userId));","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/service/impl/DefaultAccessTokenService.java#L54-L90","documentation":"DefaultAccessTokenService wraps every access-token lookup with checkDisabled: after finding the token by value it checks whether the owning user is disabled and rejects the token with DisabledAccountException('Account is disabled'). Disabled users' access tokens are therefore non-functional, even if the token value itself is valid.","triggerScenarios":"Any REST/SSH/git API call authenticated with an access token whose owner (user) is disabled; thrown via checkDisabled from findByValue-based token authentication.","commonSituations":"CI pipelines using a personal access token of an employee who was disabled during offboarding; service scripts using a token from a suspended account; integrations breaking after an admin deactivates a user.","solutions":["Re-enable the owning user in Administration -> Users if the token should keep working.","Issue a new access token from an enabled account and update the CI/script credentials.","If disabling was intentional, migrate automation to a dedicated enabled service account's token.","Verify which user owns the token (token page shows owner) to avoid confusion with similarly named accounts."],"exampleFix":"// before: pipeline uses token of disabled user 'jdoe'\ngit clone http://jdoe-token@git.onedev/project.git  # Account is disabled\n// after: create token under enabled service account and update CI secret\ngit clone http://svc-token@git.onedev/project.git","handlingStrategy":"try-catch","validationCode":"// Before using a token, confirm its owner is enabled (admin API):\nUser owner = accessTokenService.findOwnerByValue(token);\nif (owner != null && owner.isDisabled()) { rotateToken(); }","typeGuard":"function tokenUsable(token, owner) { return token != null && owner != null && !owner.isDisabled(); }","tryCatchPattern":"try {\n  callApiWithToken(token);\n} catch (DisabledAccountException e) {\n  if (e.getMessage().equals(\"Account is disabled\")) {\n    rotateToServiceAccountToken();\n  }\n}","preventionTips":["Use dedicated service accounts for automation instead of personal tokens.","During offboarding, inventory and rotate tokens owned by the departing user.","Set token expiry so stale tokens fail fast and are rotated regularly."],"tags":["access-token","authentication","user-management"],"backgroundTag":"account-disabled","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}