Repository navigation
GET /api/auth/me returns 500 (KeyError 'username') for valid token instead of user info or 401 #12135
Description
Summary
GET /api/auth/me returns HTTP 500 for an authenticated request, crashing with KeyError: 'username' in api.auth (Error getting user info: 'username'). Instead of returning the current user (or a clean 4xx), the handler raises an unhandled KeyError, which misleads clients into thinking auth failed when the token is actually valid.
Repro
curl -sk "https://<host>/api/auth/me" -H "Authorization: Bearer <token>"
# -> {"detail":"Error retrieving user information"} (HTTP 500)- Expected: 200 with the current user object (or 401 if the token is invalid).
- Actual: 500; log shows
KeyError: 'username'.
Log
api.auth - ERROR - Error getting user info: 'username'
Traceback (most recent call last):
…
KeyError: 'username'
Likely cause
The user-info assembly reads user['username'] (or similar dict access) on a user/claims object that does not contain a username key in all auth paths (e.g., a token minted by a different backend, or a user record missing the field). The lookup should use .get('username') with a fallback, or validate the claim and return 401 rather than 500.
Environment
- Python 3.14, deployed via
install.sh,/opt/autobot.
Impact
Medium — /api/auth/me is a common client bootstrap call; a 500 here breaks session validation and makes debugging auth misleading (looks like an auth failure when the token is valid — the same token successfully creates LLC goals via /api/llc/goals).
Activity
mrveiss commentedon Jul 23, 2026
The same
KeyError: 'username'fromget_current_useralso 500sGET /api/llc/companies/{id}/org-chart(confirmed in backend.log:Unhandled exception on GET …/org-chart→ ExceptionGroup →KeyError: 'username'). So this isn't limited to/api/auth/me— it breaks every LLC board endpoint that depends onget_current_userfor a token whose claims lackusername. Worth fixing at theget_current_user/user-info source and auditing which endpoints depend on it.fix(auth): /api/auth/me no longer 500s on missing username claim — sa…
github-actions commentedon Jul 23, 2026
PR #12137 (merged to
Dev_new_gui) references this issue with a close keyword.If this issue is fully resolved, close it manually. If work remains, no action is needed.
mrveiss commentedon Jul 23, 2026
Closed — merged to Dev_new_gui via #12137 (
d2ecd33cc). Root cause: auth_middleware.py hard-accessed token_data['username'], but SLM-minted tokens carry identity in 'sub' → KeyError → 500. Fixed with the codebase's standard username/sub/user_id fallback (role defaults to least-privilege 'user'); a token with NO identity claim still returns a clean 401, never 500. Defense-in-depth added in the /me handler too. 8 new tests + 142 related tests green. Reviewed: APPROVE.fix(security): a token minted for a purpose is not a login (#17049)
fix(security): a token minted for a purpose is not a login (#17049)
fix(security): the desktop socket needs desktop-control, and a purpos…