{"record":{"id":"fe0675962b369148","repo":"Mintplex-Labs/anything-llm","slug":"could-not-validate-login","errorCode":null,"errorMessage":"Could not validate login.","messagePattern":"Could not validate login\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"frontend/src/models/system.js","lineNumber":143,"sourceCode":"  },\n\n  checkAuth: async function (currentToken = null) {\n    const valid = await fetch(`${API_BASE}/system/check-token`, {\n      headers: baseHeaders(currentToken),\n    })\n      .then((res) => res.ok)\n      .catch(() => false);\n\n    window.localStorage.setItem(AUTH_TIMESTAMP, Number(new Date()));\n    return valid;\n  },\n  requestToken: async function (body) {\n    return await fetch(`${API_BASE}/request-token`, {\n      method: \"POST\",\n      body: JSON.stringify({ ...body }),\n    })\n      .then((res) => {\n        if (!res.ok) throw new Error(\"Could not validate login.\");\n        return res.json();\n      })\n      .then((res) => res)\n      .catch((e) => {\n        return { valid: false, message: e.message };\n      });\n  },\n  /**\n   * Refreshes the user object from the session.\n   * @returns {Promise<{success: boolean, user: Object | null, message: string | null}>}\n   */\n  refreshUser: () => {\n    return fetch(`${API_BASE}/system/refresh-user`, {\n      headers: baseHeaders(),\n    })\n      .then((res) => {\n        if (!res.ok) throw new Error(\"Could not refresh user.\");\n        return res.json();","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/526360e320da9d1b36074be5ed64fe76e5bbfbbd/frontend/src/models/system.js#L125-L161","documentation":"Thrown by System.requestToken on a non-2xx POST to /api/request-token. This is the login endpoint, so notably NO baseHeaders() is sent — the body is the credentials. The .catch() returns {valid:false, message:e.message}, so the thrown string becomes the user-facing login error.","triggerScenarios":"Calling requestToken({username,password}) with wrong credentials (403), when multi-user mode is disabled and the route is unavailable, when the body is missing required fields, or when the account is locked.","commonSituations":"Single-user mode where /request-token is gated differently than multi-user mode; a typo in the username/password; the password was recently changed; brute-force lockout triggered.","solutions":["Confirm the deployment's auth mode via System.isMultiUserMode() before calling.","Verify the body shape matches what /request-token expects (username + password).","Read the response body — many login failures include a specific message that gets discarded into a generic Error.","Check that the user account exists and is not suspended."],"exampleFix":"// before\nconst res = await System.requestToken({ username, password });\nif (!res.valid) alert(res.message);\n\n// after (surface server message instead of generic 'Could not validate login.')\nconst r = await fetch(`${API_BASE}/request-token`, { method:\"POST\", body: JSON.stringify({ username, password }) });\nconst data = await r.json();\nif (!r.ok) alert(data.message || \"Login failed\");","handlingStrategy":"try-catch","validationCode":"function validLoginBody(body) {\n  return !!body && typeof body.username === \"string\" && typeof body.password === \"string\" && body.password.length > 0;\n}","typeGuard":"/** @param {any} r @returns {r is {valid:boolean}} */\nfunction isLoginResult(r) { return r != null && typeof r.valid === \"boolean\"; }","tryCatchPattern":"// Library returns {valid:false, message} on failure — read the message.\nconst res = await System.requestToken(body);\nif (!isLoginResult(res) || !res.valid) {\n  showLoginError(res.message || \"Login failed\");\n}","preventionTips":["Do not send baseHeaders() here — login is pre-auth.","Validate credentials shape before the network call.","Surface res.message rather than a hardcoded string."],"tags":["network","auth","login"],"backgroundTag":null,"analyzedSha":"526360e320da9d1b36074be5ed64fe76e5bbfbbd","analyzedAt":"2026-08-13T01:45:47.170Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}