{"record":{"id":"ef542c8ece892ba3","repo":"langgenius/dify","slug":"invalid-app-id-in-webapp-auth","errorCode":null,"errorMessage":"Invalid app id in webapp auth","messagePattern":"Invalid app id in webapp auth","errorType":"http","errorClass":"BadRequest","httpStatus":400,"severity":"error","filePath":"api/controllers/console/app/app.py","lineNumber":523,"sourceCode":"\n\nclass AppImportResponse(ResponseModel):\n    id: str\n    status: ImportStatus\n    app_id: str | None = None\n    app_mode: str | None = None\n    current_dsl_version: str\n    imported_dsl_version: str = \"\"\n    error: str = \"\"\n    warnings: list[DslImportWarning] = Field(default_factory=list)\n\n\ndef _enrich_app_list_items(session: Session, *, apps: Sequence[App], tenant_id: str) -> None:\n    if FeatureService.get_system_features().webapp_auth.enabled:\n        app_ids = [str(app.id) for app in apps]\n        res = EnterpriseService.WebAppAuth.batch_get_app_access_mode_by_id(app_ids=app_ids)\n        if len(res) != len(app_ids):\n            raise BadRequest(\"Invalid app id in webapp auth\")\n\n        for app in apps:\n            if str(app.id) in res:\n                app.access_mode = res[str(app.id)].access_mode\n\n    workflow_capable_app_ids = [str(app.id) for app in apps if app.mode in {\"workflow\", \"advanced-chat\"}]\n    draft_trigger_app_ids: set[str] = set()\n    if workflow_capable_app_ids:\n        draft_workflows = (\n            session.execute(\n                select(Workflow).where(\n                    Workflow.version == Workflow.VERSION_DRAFT,\n                    Workflow.app_id.in_(workflow_capable_app_ids),\n                    Workflow.tenant_id == tenant_id,\n                )\n            )\n            .scalars()\n            .all()","sourceCodeStart":505,"sourceCodeEnd":541,"githubUrl":"https://github.com/langgenius/dify/blob/ef8544b173fd6cd7a8e71df2cab576e52bebbfbc/api/controllers/console/app/app.py#L505-L541","documentation":"Raised by _enrich_app_list_items when the system webapp_auth feature is enabled and EnterpriseService.WebAppAuth.batch_get_app_access_mode_by_id returns a result whose length differs from the number of app_ids requested. This is a consistency guard between the App table and the enterprise webapp-auth access-mode store. Surfaces as BadRequest (400).","triggerScenarios":"Listing apps (GET /console/apps) on an instance with webapp_auth enabled, where one or more apps have no corresponding access-mode record in the enterprise store (or stale extras). Also possible if an app is deleted between the App query and the batch_get call.","commonSituations":"Enterprise webapp_auth feature recently enabled but legacy apps lack access-mode rows; a partial migration of access modes; concurrent app deletion during list; out-of-sync enterprise service after a failed deploy.","solutions":["Ensure every App row has a corresponding webapp_auth access-mode record (run the enterprise sync/migration).","Verify the EnterpriseService.WebAppAuth backend is reachable and consistent with the App table.","Retry the list after the enterprise service finishes backfilling access modes.","If the issue persists, contact the platform owner to repair the webapp_auth store for the tenant."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await axios.get('/apps'); }\ncatch (e) { if (/Invalid app id in webapp auth/.test(e.message)) { /* surface to admin; retry after sync */ } }","preventionTips":["Keep the enterprise webapp_auth store backfilled for every App row.","Run the access-mode migration when enabling webapp_auth.","Avoid deleting apps during a list request."],"tags":["apps","webapp-auth","enterprise","console-api","consistency"],"backgroundTag":null,"analyzedSha":"ef8544b173fd6cd7a8e71df2cab576e52bebbfbc","analyzedAt":"2026-08-12T05:15:17.394Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}