m1k1o/neko · warning · ErrSessionLoginDisabled

session login disabled

Error message

session login disabled

What it means

ErrSessionLoginDisabled is a sentinel error in the neko types package returned by Authenticate when the member profile associated with the session has CanLogin=false. Authentication is refused because the account is not permitted to log in.

Source

Thrown at server/pkg/types/session.go:13

package types

import (
	"errors"
	"net/http"
	"time"
)

var (
	ErrSessionNotFound         = errors.New("session not found")
	ErrSessionAlreadyExists    = errors.New("session already exists")
	ErrSessionAlreadyConnected = errors.New("session is already connected")
	ErrSessionLoginDisabled    = errors.New("session login disabled")
	ErrSessionLoginsLocked     = errors.New("session logins locked")
)

type Cursor struct {
	X int `json:"x"`
	Y int `json:"y"`
}

type SessionProfile struct {
	Id      string
	Token   string
	Profile MemberProfile
}

type SessionState struct {
	IsConnected bool `json:"is_connected"`
	// when the session was last connected
	ConnectedSince *time.Time `json:"connected_since,omitempty"`

View on GitHub (pinned to b0f01cedea)

Solutions

1. Set CanLogin=true on the member's profile (UpdateProfile) if the account should be allowed to log in.
2. Authenticate as an admin and update the member's permissions.
3. Delete the disabled member's sessions/tokens so they get a clear not-authorized result instead of this error.
4. Check the member provider data source for the can_login field value.
5. Document/handle disabled accounts on the client with a distinct 'account disabled' UX.

Example fix

// before
profile := types.MemberProfile{Name: "alice"} // CanLogin defaults to false
// after
profile := types.MemberProfile{Name: "alice", CanLogin: true}

// ensure the member profile permits login before authenticating
profile, err := provider.Select(id)
if err == nil && !profile.CanLogin {
    return errors.New("account login disabled")
}

func CanLogin(p types.MemberProfile) bool { return p.CanLogin }

session, err := sessions.Authenticate(r)
if errors.Is(err, types.ErrSessionLoginDisabled) {
    http.Error(w, "account disabled", http.StatusForbidden)
    return
}
return err

When it happens

Trigger: Authenticate(r) resolving a session whose MemberProfile.CanLogin flag is false; an admin revoking login rights for a member while their session/token is still in use.

Common situations: Admins disabling login for a user but the user's old cookie/token still being presented; provisioning members with a default profile that leaves can_login false; config-driven member files missing the permission field.

Related errors

• session not found
• session logins locked
• session token already exists
• member does not exist
• invalid password

AI-assisted analysis of m1k1o/neko@b0f01cedea (2026-09-01). Data as JSON: /api/errors/5151d159ece18900. Report an issue: GitHub.