What causes "error checking user status: %w" in vxcontrol/pentagi?

Check backend logs for the wrapped %w cause and verify PostgreSQL connectivity (docker compose ps, connection env vars)

error checking user status: %w

Error message

error checking user status: %w

What it means

In tryUserCookieAuthentication, after the session cookie's JWT is validated, p.userCache.GetUserHash(userID) is called. Any error other than gorm.ErrRecordNotFound is wrapped as "error checking user status: %w" — the user's hash/status could not be fetched from the cache/backing store, so authentication cannot proceed.

Source

Thrown at backend/pkg/server/auth/auth_middleware.go:163

	expVal, ok := exp.(int64)
	if !ok {
		return authResultFail, errors.New("token claim invalid")
	}
	if time.Now().Unix() > expVal {
		return authResultFail, errSessionExpired
	}

	// Verify user hash matches database
	userID := uid.(uint64)
	sessionHash := uhash.(string)

	dbHash, userStatus, err := p.userCache.GetUserHash(userID)
	if err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return authResultFail, errors.New("user has been deleted")
		}
		return authResultFail, fmt.Errorf("error checking user status: %w", err)
	}

	switch userStatus {
	case models.UserStatusBlocked:
		return authResultFail, errors.New("user has been blocked")
	case models.UserStatusCreated:
		return authResultFail, errors.New("user is not ready")
	case models.UserStatusActive:
	}

	if dbHash != sessionHash {
		return authResultFail, fmt.Errorf("%w - session invalid for this installation", errUserHashMismatch)
	}

	c.Set("prm", prms)
	c.Set("uid", userID)
	c.Set("uhash", sessionHash)
	c.Set("rid", rid.(uint64))

View on GitHub (pinned to ea665308ba)

Solutions

Check backend logs for the wrapped %w cause and verify PostgreSQL connectivity (docker compose ps, connection env vars)
Retry the request if the cause is transient (pool exhaustion, restart in progress)
Run database migrations (goose runs at startup) to ensure schema is current
Inspect userCache configuration and its underlying store for misconfiguration

Example fix

// before
// DB unreachable
docker compose stop db
// after
docker compose up -d db && docker compose up -d pentagi

Defensive patterns

Strategy: retry

Type guard

func isDBStatusError(err error) bool {
    return err != nil && strings.Contains(err.Error(), "error checking user status:") &&
        !errors.Is(err, gorm.ErrRecordNotFound)
}

Try / catch

result, err := doRequest()
if err != nil && strings.Contains(err.Error(), "error checking user status") {
    if isTransient(err) {
        time.Sleep(backoff)
        return doRequest() // retry during transient DB issues
    }
}
return result, err

Prevention

Monitor PostgreSQL health and set readiness probes so traffic stops during outages
Size the DB connection pool for peak concurrent authenticated requests
Ensure migrations run at startup and complete before serving traffic
Alert on cache/DB error rates from the auth middleware

When it happens

Trigger: Database connection failure, timeout, or serialization error while reading the user row through the cache; cache misconfiguration; transient backend (Postgres) outage during a cookie-authenticated request.

Common situations: Postgres restarted or unreachable; connection pool exhausted under load; cache layer returning unexpected errors; migrations not run so the users table/columns are missing.

Related errors

AI-assisted analysis of vxcontrol/pentagi@ea665308ba (2026-09-01). Data as JSON: /api/errors/3fb45f475f681ca6. Report an issue: GitHub.