TencentCloud/TencentDB-Agent-Memory · error · MetadataError

permission_denied

permission_denied

Error message

user management requires system admin

What it means

MetadataError 'permission_denied' from deleteUsersForCaller: the supplied auth context fails canManageUsers, meaning only system admins may delete users. The check runs before any lookup or deletion, so the batch is rejected wholesale.

Solutions

1. Re-authenticate as (or obtain a token for) a system_admin user
2. Check the token/context carries admin role claims before calling; re-issue if role changed
3. Handle 'permission_denied' in the UI by hiding admin actions for non-admins

Example fix

// before
await svc.deleteUsersForCaller(ids, normalUserCtx); // throws
// after
if (canManageUsers(ctx)) {
  await svc.deleteUsersForCaller(ids, ctx);
}

if (!canManageUsers(ctx)) {
  throw new Error('caller is not a system admin; refusing delete');
}

function isSystemAdminCtx(ctx: V3AuthContext): boolean {
  return canManageUsers(ctx);
}

try {
  await svc.deleteUsersForCaller(ids, ctx);
} catch (e) {
  if (e instanceof MetadataError && e.code === 'permission_denied') {
    // show 403-equivalent UI state
  } else throw e;
}

When it happens

Trigger: Calling deleteUsersForCaller with a V3AuthContext whose role/type is not system admin (e.g. normal user token, missing admin claims).

Common situations: Calling an admin-only endpoint with a regular user's token; tokens minted without admin role after an auth-provider config change; stale tokens issued before a role promotion.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• filter_not_allowed
• invalid_param_scope
• member_not_found
• missing_team_id

AI-assisted analysis of TencentCloud/TencentDB-Agent-Memory@3efcd317b8 (2026-09-01). Data as JSON: /api/errors/8f06770804b0ddb4. Report an issue: GitHub.

Appendix: source

Thrown at MemoryCore/src/metadata/service/metadata-service.ts:517

    }
    return toPublicUser(user, ctx);
  }

  async getUserById(userId: string): Promise<UserEntity | null> {
    return this.store.getUserById(userId);
  }

  async getUserByKey(userKey: string): Promise<UserEntity | null> {
    return this.store.getUserByKey(userKey);
  }

  async getUserByExternalId(authProvider: string, externalId: string): Promise<UserEntity | null> {
    return this.store.getUserByExternalId(authProvider, externalId);
  }

  async deleteUsersForCaller(userIds: string[], ctx: V3AuthContext): Promise<BatchDeleteResult> {
    if (!canManageUsers(ctx)) {
      throw new MetadataError("permission_denied", "user management requires system admin");
    }
    let deletingSystemAdmins = 0;
    for (const id of userIds) {
      const u = await this.getUserById(id);
      if (u && isSystemAdminUser(u)) deletingSystemAdmins++;
    }
    const totalAdmins = await this.store.countSystemAdmins();
    if (totalAdmins > 0 && totalAdmins - deletingSystemAdmins < 1) {
      throw new MetadataError("last_system_admin", "cannot delete the last system_admin user");
    }
    return this.deleteUsers(userIds);
  }

  async deleteUsers(userIds: string[]): Promise<BatchDeleteResult> {
    return this.store.deleteUsers(userIds);
  }

  async listUsersForCaller(

View on GitHub (pinned to 3efcd317b8)