Hello, I am trying to recover access to an AUR account and the password reset form gives me no way to tell what is wrong, so I am following the pointer on that page to ask here.
The username is Wehrwolfmann and the e-mail address is [email protected]. Entering either of them into the password reset form returns "Invalid e-mail." I am fairly sure I have used this account before, which is why I am asking rather than just registering again. The reason I cannot narrow it down myself is that the handler returns the same message for every case -- in aurweb/routers/accounts.py the lookup is criteria = or_(models.User.Username == user, models.User.Email == user) db_user = db.query(models.User, and_(criteria, models.User.Suspended == 0)).first() if db_user is None: context["errors"] = ["Invalid e-mail."] Because the query filters on Suspended == 0, a suspended account, an account under a different address, and an account that never existed all produce exactly the same response. From the outside they are indistinguishable. I am raising it here partly because of the "Active AUR malicious packages incident" notice of 2026-06-12, which lists account creation and package operations as things that may not work while the cleanup is underway. If accounts were suspended in bulk as part of that, an ordinary user in my position has no way to find out that this is what happened -- the site simply tells them they do not exist. So, two questions: 1. Could someone with database access tell me whether an account exists under that name or that address, and if so, whether it is suspended? 2. If it was caught up in the incident cleanup, what is the right way to ask for a review? I would rather not register a second account while this is unresolved, since that would look like working around a suspension. If it turns out no such account ever existed, I will register normally once account creation is working again. As a separate and much smaller point: it might be worth distinguishing the suspended case in that handler, or at least wording the message so it does not assert that the address is invalid. It is a small change in the same function, and it would save the next person in this situation from guessing. I am happy to open an issue for that if it is wanted. Thanks, Wehrwolfmann
