ruvnet/ruflo · error · Error

User token not found

Error message

User token not found

What it means

Thrown by getApiToken when config.USE_USER_TOKEN === 'true' but the request's locals.token is missing. In per-user-token mode the app intentionally uses each visitor's own token instead of a shared server key, so a missing per-user token is a hard failure rather than a silent fallback.

Source

Thrown at ruflo/src/ruvocal/src/lib/server/apiToken.ts:6

import { config } from "$lib/server/config";

export function getApiToken(locals: App.Locals | undefined) {
	if (config.USE_USER_TOKEN === "true") {
		if (!locals?.token) {
			throw new Error("User token not found");
		}
		return locals.token;
	}
	return config.OPENAI_API_KEY || config.HF_TOKEN;
}

View on GitHub (pinned to 6b01dc5a68)

Solutions

1. Ensure the auth middleware that sets locals.token runs before any code path calling getApiToken.
2. If you need server-side background inference, do not enable USE_USER_TOKEN for that path (or branch on a non-request context).
3. Set USE_USER_TOKEN exactly to the string 'true' if you intend it on, or unset/false otherwise.
4. For tests, pass a stub locals object: getApiToken({ token: 'test-token' }).

Example fix

// before
const token = getApiToken(locals); // throws in a worker with no locals

// after
if (config.USE_USER_TOKEN === 'true' && !locals?.token) {
  throw new Error('per-user token required but none on request — is auth middleware upstream?');
}
const token = getApiToken(locals);

function getApiTokenSafe(locals?: App.Locals): string {
  if (config.USE_USER_TOKEN === 'true') {
    if (!locals?.token) throw new Error('per-user token required but none on request — is auth middleware upstream?');
    return locals.token;
  }
  return config.OPENAI_API_KEY || config.HF_TOKEN;
}

function hasUserToken(locals: App.Locals | undefined): locals is App.Locals & { token: string } { return !!locals?.token; }

try { return getApiToken(locals); } catch (e) { if ((e as Error).message === 'User token not found') throw new Error('Login required', { cause: e }); throw e; }

When it happens

Trigger: USE_USER_TOKEN is enabled (string 'true') and getApiToken(locals) is called with locals undefined or locals.token absent — e.g. a code path that runs before the auth middleware populates locals, a background job with no request context, or a test that does not stub locals.

Common situations: Enabling USE_USER_TOKEN without ensuring every inference code path has the auth middleware upstream; a cron/queue worker reusing a function that calls getApiToken but with no HTTP request; login/session expired so locals.token was not set; typo in the env var ('True' vs 'true' — note it is a strict string compare to 'true').

Related errors

• Unauthorized
• User not found
• MCP server "${server.name}" returned HTTP ${httpStatus}: ${h
• Pinata JWT required (config.pinataJwt or PINATA_API_JWT)
• SSRF guard: invalid URL — ${rawUrl}

AI-assisted analysis of ruvnet/ruflo@6b01dc5a68 (2026-08-12). Data as JSON: /api/errors/7f073d76a0937f54. Report an issue: GitHub.