iflytek/astron-agent · error · CustomException

APP_TENANT_NOT_FOUND_ERROR

APP_TENANT_NOT_FOUND_ERROR

Error message

{tenant_app_id} is not a tenant

What it means

APP_TENANT_NOT_FOUND_ERROR raised in auth_service.handle after get_info succeeds but the resolved app has is_tenant=False. The referenced app exists but is not marked as a tenant app, which the auth flow requires as the caller context.

Solutions

  1. Verify tenant_app_id refers to an app with is_tenant=true in the app_source table
  2. Set is_tenant=true on the intended tenant app if it should be a tenant
  3. Check argument order — don't pass the user app_id as tenant_app_id
  4. Re-provision the tenant app on the management platform with tenant type

Example fix

// before
auth_input = AuthInput(app_id=user_app_id)  # not a tenant
// after
auth_input = AuthInput(app_id=tenant_app_id)  # app with is_tenant=true
Defensive patterns

Strategy: validation

Validate before calling

db_app = session.query(AppSource).filter_by(source_id=tenant_app_id).first()
if not db_app or not db_app.is_tenant:
    raise ValueError(f'{tenant_app_id} is not a tenant app')

Try / catch

try:
    result = await auth_service.handle(auth_input, session, span)
except CustomException as e:
    if e.err_code == CodeEnum.APP_TENANT_NOT_FOUND_ERROR and 'is not a tenant' in e.err_msg:
        return error_response(400, 'tenant_app_id must reference a tenant app')
    raise

Prevention

When it happens

Trigger: Calling the auth flow with a tenant_app_id whose AppSource.is_tenant flag is false — i.e., an ordinary user app passed where a tenant app is required.

Common situations: Swapping tenant_app_id and user_app_id arguments, using a user-level app as the tenant context, the app's is_tenant flag not being set during provisioning.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/379f4bea14ad545c. Report an issue: GitHub.

Appendix: source

Thrown at core/workflow/service/auth_service.py:36

    This function validates tenant permissions, checks workflow publish status,
    and registers the binding relationship in the license table.

    :param session: Database session for data operations
    :param tenant_app_id: Tenant application ID for validation
    :param auth_input: Authentication input containing app_id and flow_id
    :param span: Distributed tracing span for monitoring
    :return: None
    :raises CustomException: When tenant not found, flow not found,
            or flow not published
    """
    user_app_id = auth_input.app_id

    # Validate tenant application exists and is a tenant
    db_tenant_app = await app_service.get_info(tenant_app_id, session, span)
    if not db_tenant_app.is_tenant:
        await span.add_info_event_async(f"Tenant app ID: {tenant_app_id}")
        raise CustomException(
            CodeEnum.APP_TENANT_NOT_FOUND_ERROR,
            err_msg=f"{tenant_app_id} is not a tenant",
        )

    # Get user application information
    db_app = await app_service.get_info(user_app_id, session, span)

    # Validate workflow exists
    db_flow = session.query(Flow).filter_by(id=auth_input.flow_id).first()
    if not db_flow:
        await span.add_info_event_async(f"Flow ID: {auth_input.flow_id}")
        raise CustomException(CodeEnum.FLOW_NOT_FOUND_ERROR)

    group_id = db_flow.group_id
    release_status = (
        db_flow.release_status
    )  # Current workflow publish permissions across platforms
    rs = TenantPublishMatrix(

View on GitHub (pinned to 5e758547a8)