t8y2/dbx · error

user is required

Error message

user is required

What it means

authUserGet returns this error when it is asked to look up an etcd user but no username could be resolved. After applying the current-user fallback (authUsername from the authenticated session) and the current-user/auth-disabled fast path, an empty user string means there is nothing to query. The library treats a missing user as an invalid request rather than querying etcd with an empty name.

Source

Thrown at agents/drivers/etcd-go/auth.go:210

func (s *etcdSession) authUserGet(params map[string]json.RawMessage) (any, error) {
	user := strings.TrimSpace(stringOrDefault(params, "user", ""))
	currentUserRequest := user == ""
	s.clientMu.Lock()
	authUsername := s.username
	authEnabled := s.authEnabled
	s.clientMu.Unlock()
	client, clientErr := s.activeClient()
	if currentUserRequest && clientErr == nil {
		authEnabled = s.refreshAuthEnabled(client)
	}
	if user == "" {
		user = authUsername
	}
	if currentUserRequest && !authEnabled {
		return map[string]any{"user": user, "roles": []string{}, "authEnabled": false}, nil
	}
	if user == "" {
		return nil, errors.New("user is required")
	}
	if clientErr != nil {
		return nil, clientErr
	}
	ctx, cancel := s.beginOperation()
	defer s.endOperation(cancel)
	response, err := client.Auth.UserGet(ctx, user)
	if err != nil {
		if currentUserRequest && isAuthenticationNotEnabled(err) {
			s.disableAuth()
			return map[string]any{"user": user, "roles": []string{}, "authEnabled": false}, nil
		}
		return nil, err
	}
	return map[string]any{"user": user, "roles": response.Roles, "authEnabled": true}, nil
}

func (s *etcdSession) authUserAdd(params map[string]json.RawMessage) (any, error) {

View on GitHub (pinned to c0390bff16)

Solutions

1. Pass an explicit non-empty 'user' parameter to the auth user get call.
2. Ensure the session carries an authenticated username (authUsername) if you rely on the current-user fallback.
3. Validate the username is non-empty in the caller before invoking the agent.
4. If listing users, use the user-list operation instead of user-get.

Example fix

// before
result, err := agent.handle(ctx, map[string]any{"op": "auth-user-get"})
// after
result, err := agent.handle(ctx, map[string]any{"op": "auth-user-get", "user": "alice"})

func validateUserGetParams(params map[string]json.RawMessage, currentUser string, authEnabled bool) error {
	hasUser := false
	if raw, ok := params["user"]; ok {
		var u string
		if err := json.Unmarshal(raw, &u); err == nil && u != "" {
			hasUser = true
		}
	}
	if !hasUser && currentUser == "" {
		return errors.New("user is required: pass a 'user' param or authenticate the session")
	}
	return nil
}

func hasUser(params map[string]json.RawMessage) bool {
	raw, ok := params["user"]
	if !ok {
		return false
	}
	var u string
	return json.Unmarshal(raw, &u) == nil && u != ""
}

if raw, ok := params["user"]; !ok || string(raw) == `""` {
	return nil, errors.New("user is required: pass a 'user' param or authenticate the session")
}
result, err := session.authUserGet(username)

When it happens

Trigger: Calling the auth user get operation with neither a 'user' parameter nor a resolvable current-user identity (authUsername empty), while auth is enabled or the request is not a current-user request.

Common situations: Handlers that forget to pass the username parameter; scripts run against a session where the current-user context was never populated; calling the API with user="" explicitly; testing auth paths without establishing an authenticated session.

Understand the failure class

Background: Missing required parameter errors: what 'X is required' and 'the required X param is missing' mean, and how to fix them — this error's family across 27 libraries.

Related errors

• Key is required
• agentSessionId is required
• ETCD_DEFRAG_TARGET_REQUIRED
• ETCD_NEWKEY_REQUIRED
• Key is required

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/1dd8428aa3f03816. Report an issue: GitHub.