bytedance/deer-flow · error · HTTPException

USER_NOT_FOUND

USER_NOT_FOUND

Error message

User not found

What it means

HTTP 401 with code USER_NOT_FOUND: the JWT decoded successfully (payload.sub is a valid claim) but the local auth provider's get_user(sub) returned None — the user referenced by the token no longer exists in the user store.

Source

Thrown at backend/app/gateway/deps.py:770

    access_token = request.cookies.get("access_token")
    if not access_token:
        raise HTTPException(
            status_code=401,
            detail=AuthErrorResponse(code=AuthErrorCode.NOT_AUTHENTICATED, message="Not authenticated").model_dump(),
        )

    payload = decode_token(access_token)
    if isinstance(payload, TokenError):
        raise HTTPException(
            status_code=401,
            detail=AuthErrorResponse(code=token_error_to_code(payload), message=f"Token error: {payload.value}").model_dump(),
        )

    provider = get_local_provider()
    user = await provider.get_user(payload.sub)
    if user is None:
        raise HTTPException(
            status_code=401,
            detail=AuthErrorResponse(code=AuthErrorCode.USER_NOT_FOUND, message="User not found").model_dump(),
        )

    # Token version mismatch → password was changed, token is stale
    if user.token_version != payload.ver:
        raise HTTPException(
            status_code=401,
            detail=AuthErrorResponse(code=AuthErrorCode.TOKEN_INVALID, message="Token revoked (password changed)").model_dump(),
        )

    return user


async def require_admin_user(request: Request, *, detail: str) -> None:
    """Require the authenticated caller to be an admin user.

    ``AuthMiddleware`` normally stamps ``request.state.user`` before the request

View on GitHub (pinned to 1dd6ba1acb)

Solutions

  1. Clear the access_token cookie (and session) in the client, then log in again — login recreates/looks up the user and issues a matching token
  2. If accounts were deleted intentionally, communicate that affected users must re-authenticate
  3. If using a persistent DB, verify the users table still contains the expected rows (`sqlite3`/psql query on the users table)
  4. In tests, create the user before minting a token that references it

Example fix

null
Defensive patterns

Strategy: validation

Validate before calling

null

Type guard

null

Try / catch

if (e.status === 401 && e.detail?.code === 'USER_NOT_FOUND') {
  // account gone: cookie is dead weight
  document.cookie = 'access_token=; Max-Age=0; path=/';
  goToLogin();
}

Prevention

When it happens

Trigger: Authenticated call with a valid, unexpired token whose subject id was deleted from the users table (account removed, DB reset, switch from persistent to in-memory user store).

Common situations: Database wiped or re-provisioned while browsers keep old cookies; user account deleted by an admin; dev environment restarted against a fresh in-memory store but the browser still holds last week's token; test fixtures issuing tokens for non-existent user ids.

Related errors

AI-assisted analysis of bytedance/deer-flow@1dd6ba1acb (2026-08-14). Data as JSON: /api/errors/9df6ee870934b018. Report an issue: GitHub.