Dokploy/dokploy · error · TRPCError

UNAUTHORIZED

UNAUTHORIZED

Error message

You are not allowed to access this destination

What it means

Thrown by the `destination.one` tRPC procedure when the destination being fetched belongs to a different organization than the caller's active session organization. Dokploy scopes resources (destinations are S3-compatible backup targets) per organization, and this is a server-side tenant-isolation check that runs even after `withPermission('destination','read')` has authorized the permission level.

Source

Thrown at apps/dokploy/server/api/routers/destination.ts:110

					await execAsync(rcloneCommand);
				}
			} catch (error) {
				throw new TRPCError({
					code: "BAD_REQUEST",
					message:
						error instanceof Error
							? error?.message
							: "Error connecting to bucket",
					cause: error,
				});
			}
		}),
	one: withPermission("destination", "read")
		.input(apiFindOneDestination)
		.query(async ({ input, ctx }) => {
			const destination = await findDestinationById(input.destinationId);
			if (destination.organizationId !== ctx.session.activeOrganizationId) {
				throw new TRPCError({
					code: "UNAUTHORIZED",
					message: "You are not allowed to access this destination",
				});
			}
			return destination;
		}),
	all: withPermission("destination", "read").query(async ({ ctx }) => {
		return await db.query.destinations.findMany({
			where: eq(destinations.organizationId, ctx.session.activeOrganizationId),
			orderBy: [desc(destinations.createdAt)],
		});
	}),
	remove: withPermission("destination", "delete")
		.input(apiRemoveDestination)
		.mutation(async ({ input, ctx }) => {
			try {
				const destination = await findDestinationById(input.destinationId);

View on GitHub (pinned to 546686ea35)

Solutions

1. Verify the destinationId belongs to the currently active organization (check the organization switcher / session) before calling the API
2. Re-fetch the destination list via `destination.list` for the active org to get valid IDs
3. If the resource legitimately belongs to another org you are a member of, switch the active organization in the session/header and retry
4. If cross-org access is genuinely required, an admin must recreate or move the destination under the correct organization — there is no bypass flag

Example fix

// before
const dest = await trpc.destination.one.query({ destinationId: copiedId });
// after — only query IDs from the active org's own list
const destinations = await trpc.destination.list.query();
const dest = await trpc.destination.one.query({
  destinationId: destinations.find((d) => d.destinationId === copiedId)?.destinationId ?? destinations[0].destinationId,
});

const destinations = await trpc.destination.list.query();
const ok = destinations.some(
  (d) => d.destinationId === destinationId,
);
if (!ok) throw new Error('destination not accessible in active organization');
const dest = await trpc.destination.one.query({ destinationId });

try {
  const dest = await trpc.destination.one.query({ destinationId });
} catch (e) {
  if (e instanceof TRPCClientError && e.data?.code === 'UNAUTHORIZED') {
    // refresh org context / destination list, do not retry blindly
  }
  throw e;
}

When it happens

Trigger: Calling `destination.one` with a `destinationId` whose row in the `destination` table has an `organizationId` that differs from `ctx.session.activeOrganizationId` — e.g. copying a destinationId from another org, using a stale ID after the resource was reassigned, or having the wrong organization selected in the UI header.

Common situations: Multi-organization setups where the user switches organizations in the UI but an old tab/page still holds destinationIds from the previous org; importing or scripting requests with IDs from a different instance; a destination that was created under a different org by an admin.

Related errors

• UNAUTHORIZED
• UNAUTHORIZED
• UNAUTHORIZED
• FORBIDDEN
• UNAUTHORIZED

AI-assisted analysis of Dokploy/dokploy@546686ea35 (2026-08-27). Data as JSON: /api/errors/d73669e6fe952c94. Report an issue: GitHub.