{"record":{"id":"ee7c2753f169db12","repo":"Significant-Gravitas/AutoGPT","slug":"execution-execution-id-not-found-for-user-user","errorCode":null,"errorMessage":"Execution {execution_id} not found for user {user_id}","messagePattern":"Execution (.+?) not found for user (.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":404,"severity":"error","filePath":"autogpt_platform/backend/backend/api/features/v1.py","lineNumber":2291,"sourceCode":"\n    # Remove stale allowlist records before updating the token — prevents a\n    # window where old records + new token could coexist.\n    await execution_db.delete_shared_execution_files(execution_id=graph_exec_id)\n\n    # Update the execution with share info — the underlying update_many\n    # also enforces (id, user_id) at the DB layer, so a TOCTOU delete\n    # between the pre-check above and this write surfaces as 404 rather\n    # than a silent no-op.\n    try:\n        await execution_db.update_graph_execution_share_status(\n            execution_id=graph_exec_id,\n            user_id=user_id,\n            is_shared=True,\n            share_token=share_token,\n            shared_at=datetime.now(timezone.utc),\n        )\n    except NotFoundError as exc:\n        raise HTTPException(status_code=404, detail=str(exc))\n\n    # Create allowlist of workspace files referenced in outputs\n    await execution_db.create_shared_execution_files(\n        execution_id=graph_exec_id,\n        share_token=share_token,\n        user_id=user_id,\n        outputs=execution.outputs,\n    )\n\n    # Return the share URL\n    frontend_url = settings.config.frontend_base_url or \"http://localhost:3000\"\n    share_url = f\"{frontend_url}/share/{share_token}\"\n\n    return ShareResponse(share_url=share_url, share_token=share_token)\n\n\n@v1_router.delete(\n    \"/graphs/{graph_id}/executions/{graph_exec_id}/share\",","sourceCodeStart":2273,"sourceCodeEnd":2309,"githubUrl":"https://github.com/Significant-Gravitas/AutoGPT/blob/9c8bb5550f446ba5d3046b78896578742495b3cf/autogpt_platform/backend/backend/api/features/v1.py#L2273-L2309","documentation":"Raised by the enable-sharing endpoint (POST on a graph execution's share resource) when the DB-layer owner-gated update `update_graph_execution_share_status(execution_id, user_id, ...)` raises NotFoundError. The (id, user_id) tuple is enforced in the database itself, so this fires when no AgentGraphExecution row matches both the execution ID in the path and the authenticated user, including a TOCTOU delete between the endpoint's earlier pre-check and this write. It is deliberately a 404 rather than a silent no-op.","triggerScenarios":"POST /v1/graphs/{graph_id}/executions/{graph_exec_id}/share where graph_exec_id does not exist, belongs to another user, or was deleted by a concurrent request/retention job between the pre-check and the share-status write.","commonSituations":"Stale frontend holding an execution ID after the user switched accounts or the execution was purged; test setups that create executions under a different user ID; concurrent deletion while the user clicks 'Share'.","solutions":["Verify the execution ID exists and is owned by the same authenticated user (GET the execution first) and re-check the UI state.","If the error appears immediately after a valid fetch, check whether another process (cleanup job, other tab) deleted the execution and refresh the executions list.","In integration tests, ensure the execution is created with the same user_id that the share request authenticates as.","Treat 404 as terminal for this execution — do not retry the share request with the same IDs."],"exampleFix":"// before\nconst res = await fetch(`/api/graphs/${gid}/executions/${eid}/share`, {method:'POST'});\n// after — refresh the execution list and drop stale references on 404\nconst res = await fetch(`/api/graphs/${gid}/executions/${eid}/share`, {method:'POST'});\nif (res.status === 404) {\n  await queryClient.invalidateQueries({queryKey: ['executions', gid]});\n  toast.error('This execution no longer exists.');\n}","handlingStrategy":"try-catch","validationCode":"const exec = await api.getExecution(gid, eid);\nif (!exec || exec.userId !== currentUserId) {\n  throw new Error('Execution not available for sharing');\n}","typeGuard":null,"tryCatchPattern":"try {\n  const share = await api.enableSharing(gid, eid);\n} catch (e) {\n  if (e.status === 404) {\n    // execution gone or not owned — drop from UI, do not retry\n    await refreshExecutions(gid);\n    return;\n  }\n  throw e;\n}","preventionTips":["Build share actions from a freshly fetched execution list, not cached IDs.","Handle 404 on share-mutation as 'execution deleted' and reconcile state instead of retrying.","In tests, create the execution and share it under the same authenticated user."],"tags":["http-404","ownership","toctou","execution-sharing","fastapi"],"backgroundTag":null,"analyzedSha":"9c8bb5550f446ba5d3046b78896578742495b3cf","analyzedAt":"2026-08-14T17:17:21.957Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}