ruvnet/RuView · error · HTTPException

Inactive user

Error message

Inactive user

What it means

After successful authentication, get_current_active_user raises 403 'Inactive user' when the authenticated user record has is_active=False (defaulting to True when absent). The token itself is valid; the account behind it is disabled.

Source

Thrown at archive/v1/src/api/dependencies.py:125

        ),
        headers={"WWW-Authenticate": "Bearer"},
    )


async def get_current_active_user(
    current_user: Optional[Dict[str, Any]] = Depends(get_current_user)
) -> Dict[str, Any]:
    """Get current active user (required authentication)."""
    if not current_user:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Authentication required",
            headers={"WWW-Authenticate": "Bearer"},
        )
    
    # Check if user is active
    if not current_user.get("is_active", True):
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Inactive user"
        )
    
    return current_user


async def get_admin_user(
    current_user: Dict[str, Any] = Depends(get_current_active_user)
) -> Dict[str, Any]:
    """Get current admin user (admin privileges required)."""
    if not current_user.get("is_admin", False):
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Admin privileges required"
        )
    
    return current_user

View on GitHub (pinned to 4685618388)

Solutions

1. Re-enable the account (set is_active=True) or have the user authenticate as an active account
2. Invalidate existing tokens when deactivating a user (short JWT expiry or a denylist)
3. Fix test fixtures that create users with is_active=False when active users are intended

# Before relying on a stored account, check its active flag
import jwt
def account_is_usable(token, verify=False):
    claims = jwt.decode(token, options={'verify_signature': verify})
    return claims.get('is_active', True)
if not account_is_usable(saved_token):
    saved_token = None  # force re-authentication instead of hitting 403

try:
    r = client.get('/api/me', headers=auth)
    r.raise_for_status()
except httpx.HTTPStatusError as e:
    if e.response.status_code == 403 and 'Inactive user' in e.response.text:
        # account disabled: stop retrying, prompt for support/other account
        logout()
    raise

When it happens

Trigger: A deactivated account presenting a still-valid JWT; test fixtures seeding users with is_active=False; an admin toggling is_active off without revoking existing tokens.

Common situations: Offboarded user whose long-lived token has not expired; database flips of is_active that outpace token expiry; dev seed data marking users inactive.

Related errors

• Admin privileges required
• Permission '{permission}' required
• Access denied to zone '{zone_id}'
• Access denied to router '{router_id}'
• Not enough permissions. Required scope: {scope}

AI-assisted analysis of ruvnet/RuView@4685618388 (2026-08-16). Data as JSON: /api/errors/3d2b74616f79f498. Report an issue: GitHub.