{"record":{"id":"f0ff08052afd4462","repo":"bytebase/bytebase","slug":"service-account-q-not-found","errorCode":null,"errorMessage":"service account %q not found","messagePattern":"service account %q not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/api/v1/auth_service.go","lineNumber":865,"sourceCode":"// For END_USER: resolution order:\n//  1. preferredWorkspaceID (from the login request's ?workspace= hint, e.g. invite links)\n//  2. Last login workspace (from user profile)\n//  3. First workspace from IAM membership\n//\n// Each candidate is validated for membership before use.\nfunc (s *AuthService) resolveWorkspaceForLogin(ctx context.Context, user *store.UserMessage, preferredWorkspaceID string) (string, error) {\n\t// Determine member name format based on user type.\n\tswitch user.Type {\n\tcase storepb.PrincipalType_SERVICE_ACCOUNT:\n\t\t// SA has workspace on its record — look it up directly.\n\t\tsa, err := s.store.GetServiceAccountByEmail(ctx, user.Email)\n\t\tif err != nil {\n\t\t\treturn \"\", errors.Wrap(err, \"failed to get service account\")\n\t\t}\n\t\tif sa != nil {\n\t\t\treturn sa.Workspace, nil\n\t\t}\n\t\treturn \"\", errors.Errorf(\"service account %q not found\", user.Email)\n\tcase storepb.PrincipalType_END_USER:\n\t\tincludeAllUser := !s.profile.SaaS\n\n\t\t// Prefer the workspace from the login request hint (e.g. invite link).\n\t\tif preferredWorkspaceID != \"\" {\n\t\t\tws, err := s.store.FindWorkspace(ctx, &store.FindWorkspaceMessage{\n\t\t\t\tWorkspaceID:    &preferredWorkspaceID,\n\t\t\t\tEmail:          user.Email,\n\t\t\t\tIncludeAllUser: includeAllUser,\n\t\t\t})\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", errors.Wrap(err, \"failed to find workspace\")\n\t\t\t}\n\t\t\tif ws != nil {\n\t\t\t\treturn ws.ResourceID, nil\n\t\t\t}\n\t\t\t// Not a member of preferred workspace — fall through.\n\t\t}","sourceCodeStart":847,"sourceCodeEnd":883,"githubUrl":"https://github.com/bytebase/bytebase/blob/1870550677fe08f0d2a78c07acd27541464eb945/backend/api/v1/auth_service.go#L847-L883","documentation":"resolveWorkspaceForLogin could not locate a SERVICE account row for the given email. Service accounts carry their own workspace field, so when none exists for the email the resolver cannot continue and returns this error, which callers surface as a login failure.","triggerScenarios":"A Login, ResetPassword, or IDP sign-in call supplies credentials for a user whose principal type is SERVICE_ACCOUNT but no matching service account row exists in the store (e.g. the account was deleted or the email is wrong).","commonSituations":"Machine-to-machine logins using a stale or deleted service-account email; typo'd client credential emails; environments where service accounts were purged during migration or cleanup.","solutions":["Verify the email used for the service-account login matches an existing service account","Recreate the service account if it was deleted, then re-issue credentials","If this should be a human login, authenticate as an END_USER principal instead"],"exampleFix":"// before\nlogin(ctx, \"deploy-bot@old-corp.com\", token) // service account deleted\n// after\n// recreate the service account or use the replacement email\nlogin(ctx, \"deploy-bot@new-corp.com\", token)","handlingStrategy":"validation","validationCode":"// verify the service account exists before login\nsa, _ := store.GetServiceAccount(ctx, email)\nif sa == nil { return fmt.Errorf(\"service account %q not provisioned\", email) }","typeGuard":null,"tryCatchPattern":"on connect error code == CodeNotFound / message contains \"service account\": alert ops to (re)provision the service account","preventionTips":["Keep service-account emails in config synced with the workspace","Audit service-account deletion before rotating client credentials","Use the ID returned at account creation, not hand-typed emails"],"tags":["auth","service-account","login"],"backgroundTag":"user-not-found","analyzedSha":"1870550677fe08f0d2a78c07acd27541464eb945","analyzedAt":"2026-09-06T21:16:13.665Z","contentChangedAt":"2026-09-06T21:16:13.665Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}