toeverything/AFFiNE · error · WrongSignInMethod

wrong_sign_in_method

wrong_sign_in_method

Error message

You are trying to sign in by a different method than you signed up with.

What it means

Thrown by UserModel.signIn (user.ts:150) when the user exists but has no password set (user.password is null/empty) — meaning they registered via OAuth or magic link, not email/password. Prevents invoking crypto.verifyPassword against a null hash. UserFriendlyError, code wrong_sign_in_method, type invalid_input, HTTP 400.

Source

Thrown at packages/backend/server/src/models/user.ts:150

    const rows = await this.db.$queryRaw<User[]>`
      SELECT id, name, email, password, registered, email_verified as "emailVerifiedAt", avatar_url as "avatarUrl", registered, created_at as "createdAt", disabled
      FROM "users"
      WHERE lower("email") = lower(${email})
      ${Prisma.raw(filter.withDisabled ? '' : 'AND disabled = false')}
    `;

    return rows[0] ?? null;
  }

  async signIn(email: string, password: string): Promise<User> {
    const user = await this.getUserByEmail(email);

    if (!user) {
      throw new WrongSignInCredentials({ email });
    }

    if (!user.password) {
      throw new WrongSignInMethod();
    }

    const passwordMatches = await this.crypto.verifyPassword(
      password,
      user.password
    );

    if (!passwordMatches) {
      throw new WrongSignInCredentials({ email });
    }

    return user;
  }

  async getPublicUserByEmail(email: string): Promise<PublicUser | null> {
    const rows = await this.db.$queryRaw<PublicUser[]>`
      SELECT id, name, avatar_url as "avatarUrl"
      FROM "users"

View on GitHub (pinned to 26c515e050)

Solutions

1. Sign in via the OAuth provider / magic link used at sign-up.
2. If password login is required, set a password through the password-reset flow first.
3. When this error appears, guide the user: 'You registered with <provider>; use that to sign in.'

import { WrongSignInMethod } from '../base/error/errors.gen';

try {
  await models.user.signIn(email, password);
} catch (e) {
  if (e instanceof WrongSignInMethod) {
    // prompt: 'You registered via OAuth/magic link — use that method.'
  } else throw e;
}

When it happens

Trigger: A user who signed up with Google/GitHub/magic-link then submits the email+password sign-in form.

Common situations: SSO-only users hitting the legacy password form; mixed auth providers where some users never set a password; user expects a password exists but none was ever created.

Related errors

• wrong_sign_in_credentials
• action_forbidden
• unsupported_client_version
• action_forbidden
• wrong_sign_in_credentials

AI-assisted analysis of toeverything/AFFiNE@26c515e050 (2026-08-12). Data as JSON: /api/errors/b490d3ea0b796cfc. Report an issue: GitHub.