toeverything/AFFiNE · warning · ActionForbidden

action_forbidden

action_forbidden

Error message

You are not allowed to perform this action.

What it means

Thrown by `POST /api/auth/sign-in` when `AuthService.canSignIn(email)` returns false. In the stock implementation `canSignIn` always returns true, so this fires only when a subclass/override adds a gate (e.g. signup disabled, email allow-list, account disabled). HTTP 403.

Source

Thrown at packages/backend/server/src/core/auth/controller.ts:123

  @Get('/methods')
  async boundMethods(@CurrentUser() user: CurrentUser) {
    return this.authMethods.boundMethods(user.id);
  }

  @Public()
  @UseNamedGuard('version', 'captcha')
  @Post('/sign-in')
  @Header('content-type', 'application/json')
  async signIn(
    @Req() req: Request,
    @Res() res: Response,
    @Body() body?: unknown
  ) {
    const credential = SignInBodySchema.parse(body);
    validators.assertValidEmail(credential.email);
    const canSignIn = await this.auth.canSignIn(credential.email);
    if (!canSignIn) {
      throw new ActionForbidden();
    }

    if (credential.password) {
      await this.passwordSignIn(
        req,
        res,
        credential.email,
        credential.password
      );
    } else {
      await this.sendMagicLink(
        req,
        res,
        credential.email,
        credential.callbackUrl,
        credential.client_nonce
      );
    }

View on GitHub (pinned to 26c515e050)

Solutions

1. Check the server's sign-in/sign-up policy config (e.g. `affine.specifications` / feature flags) for the email in question.
2. If you override `AuthService`, inspect why `canSignIn` returned false for that user.
3. Sign in with an already-registered account, or ask the administrator to allow-list the email/domain.

try {
  await signIn(email, password);
} catch (e) {
  if (e.code === 'action_forbidden') {
    showNotice('Sign-in is not allowed for this account. Contact your administrator.');
  } else throw e;
}

When it happens

Trigger: A customized `AuthService.canSignIn` rejects the email — for example self-hosted deployment with sign-up disabled, an email-domain allow-list, or an abuse/feature flag that blocks the address.

Common situations: Self-hosted instance configured to forbid new account creation, an enterprise deployment restricting sign-in to corporate domains, or a temporary abuse-mitigation rule.

Related errors

• wrong_sign_in_credentials
• action_forbidden
• action_forbidden
• authentication_required
• auth_session_temporarily_unavailable

AI-assisted analysis of toeverything/AFFiNE@26c515e050 (2026-08-12). Data as JSON: /api/errors/2526b43b78d76326. Report an issue: GitHub.