TencentCloud/TencentDB-Agent-Memory · error · MetadataError

permission_denied

permission_denied

Error message

user management requires system admin

What it means

MetadataError 'permission_denied' from deleteUsersForCaller: the supplied auth context fails canManageUsers, meaning only system admins may delete users. The check runs before any lookup or deletion, so the batch is rejected wholesale.

Source

Thrown at MemoryCore/src/metadata/service/metadata-service.ts:517

    }
    return toPublicUser(user, ctx);
  }

  async getUserById(userId: string): Promise<UserEntity | null> {
    return this.store.getUserById(userId);
  }

  async getUserByKey(userKey: string): Promise<UserEntity | null> {
    return this.store.getUserByKey(userKey);
  }

  async getUserByExternalId(authProvider: string, externalId: string): Promise<UserEntity | null> {
    return this.store.getUserByExternalId(authProvider, externalId);
  }

  async deleteUsersForCaller(userIds: string[], ctx: V3AuthContext): Promise<BatchDeleteResult> {
    if (!canManageUsers(ctx)) {
      throw new MetadataError("permission_denied", "user management requires system admin");
    }
    let deletingSystemAdmins = 0;
    for (const id of userIds) {
      const u = await this.getUserById(id);
      if (u && isSystemAdminUser(u)) deletingSystemAdmins++;
    }
    const totalAdmins = await this.store.countSystemAdmins();
    if (totalAdmins > 0 && totalAdmins - deletingSystemAdmins < 1) {
      throw new MetadataError("last_system_admin", "cannot delete the last system_admin user");
    }
    return this.deleteUsers(userIds);
  }

  async deleteUsers(userIds: string[]): Promise<BatchDeleteResult> {
    return this.store.deleteUsers(userIds);
  }

  async listUsersForCaller(

View on GitHub (pinned to 3efcd317b8)

Solutions

1. Re-authenticate as (or obtain a token for) a system_admin user
2. Check the token/context carries admin role claims before calling; re-issue if role changed
3. Handle 'permission_denied' in the UI by hiding admin actions for non-admins

Example fix

// before
await svc.deleteUsersForCaller(ids, normalUserCtx); // throws
// after
if (canManageUsers(ctx)) {
  await svc.deleteUsersForCaller(ids, ctx);
}

if (!canManageUsers(ctx)) {
  throw new Error('caller is not a system admin; refusing delete');
}

function isSystemAdminCtx(ctx: V3AuthContext): boolean {
  return canManageUsers(ctx);
}

try {
  await svc.deleteUsersForCaller(ids, ctx);
} catch (e) {
  if (e instanceof MetadataError && e.code === 'permission_denied') {
    // show 403-equivalent UI state
  } else throw e;
}

When it happens

Trigger: Calling deleteUsersForCaller with a V3AuthContext whose role/type is not system admin (e.g. normal user token, missing admin claims).

Common situations: Calling an admin-only endpoint with a regular user's token; tokens minted without admin role after an auth-provider config change; stale tokens issued before a role promotion.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• invalid_param_scope
• missing_team_id
• filter_not_allowed
• member_not_found

AI-assisted analysis of TencentCloud/TencentDB-Agent-Memory@3efcd317b8 (2026-09-01). Data as JSON: /api/errors/8f06770804b0ddb4. Report an issue: GitHub.