crater-invoice-inc/crater · error · ValidationException

The provided credentials are incorrect.

Error message

The provided credentials are incorrect.

What it means

Mobile admin login throws a Laravel ValidationException (HTTP 422 with an 'email' field error) when no User matches the given username/email or the password hash check fails — a generic guard that deliberately hides whether the account or the password was wrong.

Solutions

1. Return the 422 validation response to the mobile client and display 'incorrect email or password'
2. Verify the user exists and the account is enabled before troubleshooting the password
3. Confirm the password column uses bcrypt hashes compatible with Hash::check

When it happens

Trigger: Thrown at app/Http/Controllers/V1/Admin/Mobile/AuthController.php:20 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crater-invoice-inc/crater@05d5ce26fd (2026-09-13). Data as JSON: /api/errors/a7775be1064422ea. Report an issue: GitHub.

Appendix: source

Thrown at app/Http/Controllers/V1/Admin/Mobile/AuthController.php:20

namespace Crater\Http\Controllers\V1\Admin\Mobile;

use Crater\Http\Controllers\Controller;
use Crater\Http\Requests\LoginRequest;
use Crater\Models\User;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use Illuminate\Validation\ValidationException;

class AuthController extends Controller
{
    public function login(LoginRequest $request)
    {
        $user = User::where('email', $request->username)->first();

        if (! $user || ! Hash::check($request->password, $user->password)) {
            throw ValidationException::withMessages([
                'email' => ['The provided credentials are incorrect.'],
            ]);
        }

        return response()->json([
            'type' => 'Bearer',
            'token' => $user->createToken($request->device_name)->plainTextToken,
        ]);
    }

    public function logout(Request $request)
    {
        $request->user()->currentAccessToken()->delete();

        return response()->json([
            'success' => true,
        ]);
    }

View on GitHub (pinned to 05d5ce26fd)