vxcontrol/pentagi · warning

user has been deleted

Error message

user has been deleted

What it means

During cookie authentication the middleware looks up the user's hash/status via userCache.GetUserHash; if the user record no longer exists (gorm.ErrRecordNotFound) the session cannot belong to a valid account and the request fails with 'user has been deleted'. This is an authResultFail, typically yielding a 401.

Source

Thrown at backend/pkg/server/auth/auth_middleware.go:161

		return authResultFail, errors.New("no permissions granted")
	}

	expVal, ok := exp.(int64)
	if !ok {
		return authResultFail, errors.New("token claim invalid")
	}
	if time.Now().Unix() > expVal {
		return authResultFail, errSessionExpired
	}

	// Verify user hash matches database
	userID := uid.(uint64)
	sessionHash := uhash.(string)

	dbHash, userStatus, err := p.userCache.GetUserHash(userID)
	if err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return authResultFail, errors.New("user has been deleted")
		}
		return authResultFail, fmt.Errorf("error checking user status: %w", err)
	}

	switch userStatus {
	case models.UserStatusBlocked:
		return authResultFail, errors.New("user has been blocked")
	case models.UserStatusCreated:
		return authResultFail, errors.New("user is not ready")
	case models.UserStatusActive:
	}

	if dbHash != sessionHash {
		return authResultFail, fmt.Errorf("%w - session invalid for this installation", errUserHashMismatch)
	}

	c.Set("prm", prms)
	c.Set("uid", userID)

View on GitHub (pinned to ea665308ba)

Solutions

  1. Log in again with an existing account
  2. If the user should still exist, verify the database the server is connected to actually contains that user row
  3. Re-seed scenarios: clear the browser cookie so the stale session is not sent
Defensive patterns

Strategy: try-catch

Try / catch

try {
  await api.call();
} catch (e) {
  if (e.response?.status === 401) {
    // account may no longer exist — clear local state and re-login
    localStorage.clear();
    window.location.href = '/login';
  }
}

Prevention

When it happens

Trigger: A request presents a valid-looking session cookie for a userID that no longer exists in the users table — the account was deleted while the browser still held the cookie, or the DB was reset/reseeded under a running session.

Common situations: Admin deletes a user who still has an open browser session; local dev database dropped/recreated; test environments reseed users with different IDs.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

AI-assisted analysis of vxcontrol/pentagi@ea665308ba (2026-09-01). Data as JSON: /api/errors/defa758b51e7e728. Report an issue: GitHub.