odysseus-dev/odysseus · error · HTTPException

Authentication required

Error message

Authentication required

What it means

Error "Authentication required" thrown in odysseus-dev/odysseus.

Source

Thrown at routes/session_routes.py:108

def _reject_compact_during_active_run(session_id: str) -> None:
    from src import agent_runs
    if agent_runs.is_active(session_id):
        raise HTTPException(409, "Session has an active run; try compacting after it finishes")


def _verify_session_owner(request: Request, session_id: str, session_manager=None):
    """Verify the current user owns the session, honoring single-user modes.

    Authenticated requests must match the stored DB or in-memory owner. When
    auth is disabled and no user is present, treat the app as single-user mode:
    verify that the session exists, but do not compare its stored owner. This
    keeps QA/dev instances with AUTH_ENABLED=false from rejecting owner-stamped
    rows created while auth was previously enabled.
    """
    user = effective_user(request)
    if not user and not _auth_disabled():
        raise HTTPException(401, "Authentication required")
    db = SessionLocal()
    try:
        row = db.query(DbSession.owner).filter(DbSession.id == session_id).first()
    finally:
        db.close()
    if row is not None:
        if user and row.owner != user:
            raise HTTPException(404, f"Session {session_id} not found")
        return
    # No DB row — allow the caller to act on an in-memory ghost they own.
    if session_manager is not None:
        ghost = getattr(session_manager, "sessions", {}).get(session_id)
        if ghost is not None and (not user or getattr(ghost, "owner", None) == user):
            return
    raise HTTPException(404, f"Session {session_id} not found")

logger = logging.getLogger(__name__)

View on GitHub (pinned to f9235ebbf1)

Solutions

1. Log in and retry the request.
2. Provide valid credentials or an API token.

When it happens

Trigger: Triggered when the corresponding server-side validation or runtime check at the recorded location rejects the request or operation and returns this error message to the caller.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of odysseus-dev/odysseus@f9235ebbf1 (2026-08-14). Data as JSON: /api/errors/d348ec9a24cad36f. Report an issue: GitHub.