{"record":{"id":"f5dd3924879a1846","repo":"BookStackApp/BookStack","slug":"errors-login-user-not-found","errorCode":null,"errorMessage":"errors.login_user_not_found","messagePattern":"errors\\.login_user_not_found","errorType":"exception","errorClass":"NotFoundException","httpStatus":404,"severity":"error","filePath":"app/Access/Controllers/HandlesPartialLogins.php","lineNumber":20,"sourceCode":"\nnamespace BookStack\\Access\\Controllers;\n\nuse BookStack\\Access\\LoginService;\nuse BookStack\\Exceptions\\NotFoundException;\nuse BookStack\\Users\\Models\\User;\n\ntrait HandlesPartialLogins\n{\n    /**\n     * @throws NotFoundException\n     */\n    protected function currentOrLastAttemptedUser(): User\n    {\n        $loginService = app()->make(LoginService::class);\n        $user = auth()->user() ?? $loginService->getLastLoginAttemptUser();\n\n        if (!$user) {\n            throw new NotFoundException(trans('errors.login_user_not_found'));\n        }\n\n        return $user;\n    }\n\n    protected function clearLastAttemptedUser(): void\n    {\n        $loginService = app()->make(LoginService::class);\n        $loginService->clearLastLoginAttempted();\n    }\n}\n","sourceCodeStart":2,"sourceCodeEnd":32,"githubUrl":"https://github.com/BookStackApp/BookStack/blob/18f8469a1c72f8cc8497e9372635e6dea5028071/app/Access/Controllers/HandlesPartialLogins.php#L2-L32","documentation":"This NotFoundException is thrown by currentOrLastAttemptedUser() when there is no authenticated user and no user was stored from the last login attempt. The controller needs a user context (e.g. to render a user-specific page after a partial login) but both lookups came up empty. It guards against acting on a null user.","triggerScenarios":"Calling a controller action that uses HandlesPartialLogins when auth()->user() returns null AND LoginService::getLastLoginAttemptUser() finds no session-stored 'last-login-attempt' user (session expired, cleared, or the method is called without a preceding failed login attempt).","commonSituations":"User hits a partial-login page (e.g. MFA/invite flow) directly via bookmark with an expired or missing session; sessions flushed after app cache clearing; load balancer routing to a different server losing session state; calling the endpoint without ever attempting login.","solutions":["Log in first (complete or attempt a login) so a user is present in session before hitting this route","Check session configuration (SESSION_DRIVER, domain, secure settings) so the last-attempted user persists across requests","If integrating, ensure the flow that redirects into this controller actually stores the attempted user via LoginService before redirecting","Clear stale cookies and retry with a fresh session"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if (auth()->user() === null && \\BookStack\\Access\\LoginService::getLastLoginAttemptUser() === null) {\n    redirect('/login')->send();\n}","typeGuard":"function hasLoginContext(): bool {\n    return auth()->user() instanceof \\BookStack\\Users\\User;\n}","tryCatchPattern":"try {\n    $user = $controller->currentOrLastAttemptedUser();\n} catch (\\BookStack\\Exceptions\\NotFoundException $e) {\n    return redirect('/login')->with('error', $e->getMessage());\n}","preventionTips":["Ensure routes using this trait are only reached from login/MFA flows that set the attempted user","Keep session storage persistent and shared (database/redis) across servers","Avoid long-lived links into partial-login pages; treat sessions as ephemeral"],"tags":["auth","session","http-404"],"backgroundTag":"missing-session-user","analyzedSha":"18f8469a1c72f8cc8497e9372635e6dea5028071","analyzedAt":"2026-09-02T19:49:33.068Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}