What causes "current user not found" in fullstackhero/dotnet-starter-kit?

Re-authenticate to get a token bound to a live user.

fullstackhero/dotnet-starter-kit · error · UnauthorizedException

current user not found

Error message

current user not found

What it means

Thrown by BuildToggleContextAsync when the authenticated actor's id (from claims) no longer resolves to an existing ApplicationUser via FindByIdAsync. The claims are valid but the backing user record is gone or invisible to the current tenant context.

Solutions

Re-authenticate to get a token bound to a live user.
Verify the actor's user row exists in the current tenant database.
If users were reseeded, invalidate outstanding tokens (reset security stamp / revoke sessions).
Check tenant filters — the actor may exist in another tenant.

Example fix

// before: keeps retrying with a stale token
await toggleStatus(targetId, ct); // UnauthorizedException: current user not found
// after: refresh credentials first
await auth.relogin();
await toggleStatus(targetId, ct);

Defensive patterns

Strategy: retry

Validate before calling

const me = await apiFetch("/api/v1/users/current");
if (!me || !me.id) throw new Error("Token is bound to a missing user — re-authenticate");

Try / catch

try { await toggleStatus(userId); } catch (e) {
  if (e.status === 401 && /current user not found/i.test(e.message)) { await logoutAndRelogin(); return retryOnce(); }
  throw e;
}

Prevention

Rotate tokens after reseeding or hard-deleting users (reset security stamps).
Keep tokens short-lived so stale identities expire quickly.
Verify the actor exists in the tenant database before administrative operations.

When it happens

Trigger: Toggling another user's status with a token issued for a user that was deleted; actor's user row filtered out by tenant query filters; database was reseeded while old tokens remained valid.

Common situations: Stale long-lived JWTs after a database reset or user hard-delete; cross-tenant token reuse; migration/seed scripts removing users without revoking sessions.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

AI-assisted analysis of fullstackhero/dotnet-starter-kit@3f2959e683 (2026-09-15). Data as JSON: /api/errors/044ec8a261a080c9. Report an issue: GitHub.

Appendix: source

Thrown at src/Modules/Identity/Modules.Identity/Services/UserStatusService.cs:59

        if (string.IsNullOrWhiteSpace(multiTenantContextAccessor?.MultiTenantContext?.TenantInfo?.Id))
        {
            throw new UnauthorizedException("invalid tenant");
        }
    }

    private async Task<ToggleStatusContext> BuildToggleContextAsync(
        string userId,
        bool activateUser,
        CancellationToken cancellationToken)
    {
        var actorId = currentUser.GetUserId();
        if (actorId == Guid.Empty)
        {
            throw new UnauthorizedException("authenticated user required to toggle status");
        }

        var actor = await userManager.FindByIdAsync(actorId.ToString())
            ?? throw new UnauthorizedException("current user not found");

        var targetUser = await userManager.Users
            .Where(u => u.Id == userId)
            .FirstOrDefaultAsync(cancellationToken)
            ?? throw new NotFoundException("User Not Found.");

        return new ToggleStatusContext(
            ActorId: actorId,
            Actor: actor,
            TargetUser: targetUser,
            ActivateUser: activateUser,
            TenantId: multiTenantContextAccessor?.MultiTenantContext?.TenantInfo?.Id);
    }

    private async Task ValidateTogglePermissionsAsync(
        ToggleStatusContext context,
        CancellationToken cancellationToken)
    {

View on GitHub (pinned to 3f2959e683)