get_account_by_email_with_case_fallback lead account detach instance error

[fatelei]

Self Checks

• I have read the Contributing Guide and Language Policy.
• This is only for bug report, if you would like to ask a question, please head to Discussions.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed.
• 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
• Please do not modify this template :) and fill in all the required fields.

Dify version

1.13.3

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

1. forget password
2. call failed

✔️ Expected Behavior

no error

❌ Actual Behavior

[dosubot]

This is a DetachedInstanceError caused by the session management refactoring introduced in PR #33966, which shipped with v1.13.3. The Account object returned by get_account_by_email_with_case_fallback is accessed after the database session has already closed.

Specifically, in the forgot-password endpoint [1]:

with sessionmaker(db.engine).begin() as session:
    account = AccountService.get_account_by_email_with_case_fallback(args.email, session=session)

# ← session is closed here, account attributes are expired
token = AccountService.send_reset_password_email(
    account=account,  # accessing expired attributes → DetachedInstanceError
    ...
)

Workaround: In api/controllers/console/auth/forgot_password.py, change the session creation to use expire_on_commit=False:

with sessionmaker(db.engine, expire_on_commit=False).begin() as session:
    account = AccountService.get_account_by_email_with_case_fallback(args.email, session=session)

This is the same fix pattern used for identical detached instance errors in other parts of Dify [2]. This has been a recurring issue across multiple versions [3] [4].

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}