vxcontrol/pentagi · warning

Auth.InactiveUser

Auth.InactiveUser

Error message

user is inactive

What it means

AuthLogin compares the bcrypt password successfully but then rejects the account because its status is not 'active', returning the Auth.InactiveUser error code. Accounts can be in other statuses (e.g. disabled/deactivated) as an administrative control; only 'active' accounts may log in locally.

Source

Thrown at backend/pkg/server/services/auth.go:140

	} else if err = user.Valid(); err != nil {
		logger.FromContext(c).WithError(err).Errorf("error validating user data '%s'", user.Hash)
		response.Error(c, response.ErrAuthInvalidUserData, err)
		return
	} else if user.RoleID == 100 {
		logger.FromContext(c).WithError(err).Errorf("can't authorize external user '%s'", user.Hash)
		response.Error(c, response.ErrAuthInvalidUserData, fmt.Errorf("user is external"))
		return
	}

	if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(data.Password)); err != nil {
		logger.FromContext(c).Errorf("error matching user input password")
		response.Error(c, response.ErrAuthInvalidCredentials, err)
		return
	}

	if user.Status != "active" {
		logger.FromContext(c).Errorf("error checking active state for user '%s'", user.Status)
		response.Error(c, response.ErrAuthInactiveUser, fmt.Errorf("user is inactive"))
		return
	}

	var privs []string
	err := s.db.Table("privileges").
		Where("role_id = ?", user.RoleID).
		Pluck("name", &privs).Error
	if err != nil {
		logger.FromContext(c).WithError(err).Errorf("error getting user privileges list '%s'", user.Hash)
		response.Error(c, response.ErrAuthInvalidServiceData, err)
		return
	}

	uuid, err := rdb.MakeUuidStrFromHash(user.Hash)
	if err != nil {
		logger.FromContext(c).WithError(err).Errorf("error validating user data '%s'", user.Hash)
		response.Error(c, response.ErrAuthInvalidUserData, err)
		return

View on GitHub (pinned to ea665308ba)

Solutions

1. Ask an admin to set the account back to active: UPDATE users SET status='active' WHERE ...
2. Check with your administrator why the account was deactivated (audit logs).
3. If the account should stay disabled, use a different account.
4. Verify no automation/job is mass-deactivating accounts unexpectedly.

Example fix

-- reactivate a user account
UPDATE users SET status = 'active' WHERE hash = '<user-hash>';

// check account status before attempting login
var user models.User
if err := db.Where("email = ?", email).First(&user).Error; err == nil {
    if user.Status != "active" {
        return fmt.Errorf("account is %s; contact an administrator", user.Status)
    }
}

func isActivatableUser(u models.User) bool {
    return u.Status == "active"
}

_, err := auth.Login(ctx, data)
var respErr *response.Error
if errors.As(err, &respErr) && respErr.Code == response.ErrAuthInactiveUser {
    showUserMessage("Your account is deactivated. Please contact your administrator.")
    return
}
if err != nil { return err }

When it happens

Trigger: POST to the local login endpoint with correct credentials for a user whose users.status is anything other than 'active' (e.g. 'disabled', 'inactive', 'blocked' set by an admin or automated deactivation).

Common situations: Admin disabled the account for policy reasons; automated cleanup deactivated stale users; a newly provisioned account not yet activated; user deactivated themselves and forgot.

Related errors

• Auth.InvalidUserData
• cookie claim invalid
• session expired
• user hash mismatch - session invalid for this installation
• user has been deleted

AI-assisted analysis of vxcontrol/pentagi@ea665308ba (2026-09-01). Data as JSON: /api/errors/2ceb76ef020c9b0b. Report an issue: GitHub.