{"record":{"id":"f11240a2c7d109b6","repo":"Comfy-Org/ComfyUI","slug":"username-not-provided","errorCode":null,"errorMessage":"username not provided","messagePattern":"username not provided","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"app/user_manager.py","lineNumber":108,"sourceCode":"            if \"%\" in file:\n                file = parse.unquote(file)\n\n            # prevent leaving /{type}/{user}\n            path = os.path.abspath(os.path.join(user_root, file))\n            if os.path.commonpath((user_root, path)) != user_root:\n                return None\n\n        parent = os.path.split(path)[0]\n\n        if create_dir and not os.path.exists(parent):\n            os.makedirs(parent, exist_ok=True)\n\n        return path\n\n    def add_user(self, name):\n        name = name.strip()\n        if not name:\n            raise ValueError(\"username not provided\")\n        if name.startswith(folder_paths.SYSTEM_USER_PREFIX):\n            raise ValueError(\"System User prefix not allowed\")\n        user_id = re.sub(\"[^a-zA-Z0-9-_]+\", '-', name)\n        if user_id.startswith(folder_paths.SYSTEM_USER_PREFIX):\n            raise ValueError(\"System User prefix not allowed\")\n        user_id = user_id + \"_\" + str(uuid.uuid4())\n\n        self.users[user_id] = name\n\n        with open(self.get_users_file(), \"w\") as f:\n            json.dump(self.users, f)\n\n        return user_id\n\n    def add_routes(self, routes):\n        self.settings.add_routes(routes)\n\n        @routes.get(\"/users\")","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/Comfy-Org/ComfyUI/blob/1c6d8d45b3693bfbb32385b410d813a7fd6be216/app/user_manager.py#L90-L126","documentation":"UserManager.add_user strips the supplied name and requires a non-empty result; whitespace-only or empty names raise ValueError('username not provided') before any id is generated or users.json is written. This is pure input validation on the user-creation API.","triggerScenarios":"POSTing a new user with name \"\" or \"   \"; a UI form submitted without entering a username; programmatic user creation passing an unset variable.","commonSituations":"Frontend form validation missing/bypassed; automation scripts iterating over an empty name field; JSON payload using the wrong key so name arrives as null/blank.","solutions":["Provide a non-blank display name, e.g. name=\"Alice\".","Validate client-side before calling the API: if not name or not name.strip(): show an error.","Check the request payload key matches what the endpoint expects (name)."],"exampleFix":"# before\nuser_manager.add_user(\"   \")\n\n# after\nuser_manager.add_user(\"Alice\")","handlingStrategy":"validation","validationCode":"name = name.strip() if isinstance(name, str) else \"\"\nif not name:\n    raise ValueError(\"username required\")\nuser_manager.add_user(name)","typeGuard":"def is_valid_username(name) -> bool:\n    return isinstance(name, str) and len(name.strip()) > 0","tryCatchPattern":"try:\n    user_manager.add_user(name)\nexcept ValueError as e:\n    return web.Response(status=400, text=str(e))","preventionTips":["Validate non-blank input in the UI form before submit.","Check the payload key name matches the endpoint's expected field."],"tags":["validation","multi-user","api"],"backgroundTag":null,"analyzedSha":"1c6d8d45b3693bfbb32385b410d813a7fd6be216","analyzedAt":"2026-08-14T19:37:18.893Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}