toeverything/AFFiNE · error · WrongSignInCredentials

wrong_sign_in_credentials

wrong_sign_in_credentials

Error message

Wrong user email or password: ${email}

What it means

Thrown by UserModel.signIn (user.ts:146) when getUserByEmail returns null — i.e. no user matches the case-insensitive email, or the only match is a disabled account (getUserByEmail excludes disabled unless withDisabled:true). The message is deliberately identical to the wrong-password case so callers cannot enumerate which emails are registered. UserFriendlyError, code wrong_sign_in_credentials, type invalid_input, HTTP 400, data {email}.

Source

Thrown at packages/backend/server/src/models/user.ts:146

  async getUserByEmail(
    email: string,
    filter: UserFilter = {}
  ): Promise<User | null> {
    const rows = await this.db.$queryRaw<User[]>`
      SELECT id, name, email, password, registered, email_verified as "emailVerifiedAt", avatar_url as "avatarUrl", registered, created_at as "createdAt", disabled
      FROM "users"
      WHERE lower("email") = lower(${email})
      ${Prisma.raw(filter.withDisabled ? '' : 'AND disabled = false')}
    `;

    return rows[0] ?? null;
  }

  async signIn(email: string, password: string): Promise<User> {
    const user = await this.getUserByEmail(email);

    if (!user) {
      throw new WrongSignInCredentials({ email });
    }

    if (!user.password) {
      throw new WrongSignInMethod();
    }

    const passwordMatches = await this.crypto.verifyPassword(
      password,
      user.password
    );

    if (!passwordMatches) {
      throw new WrongSignInCredentials({ email });
    }

    return user;
  }

View on GitHub (pinned to 26c515e050)

Solutions

1. Verify the email spelling and retry.
2. If unregistered, complete sign-up first.
3. If the account was disabled, ask an admin to re-enable it.
4. In the UI, show the same generic 'email or password incorrect' message as for a wrong password.

import { WrongSignInCredentials } from '../base/error/errors.gen';

try {
  const user = await models.user.signIn(email, password);
  // success
} catch (e) {
  if (e instanceof WrongSignInCredentials) {
    // show generic 'email or password incorrect'; do NOT reveal whether email exists
  } else throw e;
}

When it happens

Trigger: POST /sign-in (or UserModel.signIn) with an unregistered email, a disabled user's email, or a mistyped email.

Common situations: User mistypes their email; the account was disabled by an admin; testing against an environment where the user record was never seeded; user believes they registered but used a different address.

Related errors

• wrong_sign_in_method
• unsupported_client_version
• action_forbidden
• wrong_sign_in_credentials
• invalid_auth_state

AI-assisted analysis of toeverything/AFFiNE@26c515e050 (2026-08-12). Data as JSON: /api/errors/4bb4270ba269e473. Report an issue: GitHub.