What causes "user has been blocked" in vxcontrol/pentagi?

Contact an administrator to unblock the account if the block is unexpected

user has been blocked

Error message

user has been blocked

What it means

After loading the user record, the middleware switches on user status; a user in UserStatusBlocked is rejected with 'user has been blocked'. The session may be otherwise valid, but blocked accounts are denied all authenticated requests until an admin changes the status.

Source

Thrown at backend/pkg/server/auth/auth_middleware.go:168

	if time.Now().Unix() > expVal {
		return authResultFail, errSessionExpired
	}

	// Verify user hash matches database
	userID := uid.(uint64)
	sessionHash := uhash.(string)

	dbHash, userStatus, err := p.userCache.GetUserHash(userID)
	if err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return authResultFail, errors.New("user has been deleted")
		}
		return authResultFail, fmt.Errorf("error checking user status: %w", err)
	}

	switch userStatus {
	case models.UserStatusBlocked:
		return authResultFail, errors.New("user has been blocked")
	case models.UserStatusCreated:
		return authResultFail, errors.New("user is not ready")
	case models.UserStatusActive:
	}

	if dbHash != sessionHash {
		return authResultFail, fmt.Errorf("%w - session invalid for this installation", errUserHashMismatch)
	}

	c.Set("prm", prms)
	c.Set("uid", userID)
	c.Set("uhash", sessionHash)
	c.Set("rid", rid.(uint64))
	c.Set("exp", exp.(int64))
	c.Set("gtm", gtm.(int64))
	c.Set("tid", tid.(string))
	c.Set("uname", uname.(string))

View on GitHub (pinned to ea665308ba)

Solutions

Contact an administrator to unblock the account if the block is unexpected
Stop automated retries — retrying will not succeed while the status is blocked
Log in with a different, active account

Defensive patterns

Strategy: try-catch

Try / catch

try {
  await api.call();
} catch (e) {
  if (e.response?.status === 401 || e.response?.status === 403) {
    // surface a clear 'account blocked' message; do not retry automatically
    showError('Your account has been blocked. Contact an administrator.');
  }
}

Prevention

Do not build automatic retry loops that hammer a blocked account
Notify blocked users with a clear UI message instead of generic auth failure
Check account status in the admin panel before debugging credentials

When it happens

Trigger: Any authenticated request from an account whose status is blocked — an admin blocked the user, automated abuse-prevention blocked the account, or the user was blocked in one environment while the client keeps retrying against it.

Common situations: Security team blocks an account with active browser sessions; user believes their credentials are wrong but the account is actually blocked; automated scripts retry endlessly against a blocked account.

Related errors

AI-assisted analysis of vxcontrol/pentagi@ea665308ba (2026-09-01). Data as JSON: /api/errors/bc4d13bded1a2a4b. Report an issue: GitHub.