{"record":{"id":"1b09020bbfe06c90","repo":"SigNoz/signoz","slug":"authz-forbidden","errorCode":"authz_forbidden","errorMessage":"only viewers/editors/admins can access this resource","messagePattern":"only viewers/editors/admins can access this resource","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"pkg/http/middleware/authz.go","lineNumber":66,"sourceCode":"\t\tselectors := []coretypes.Selector{\n\t\t\tcoretypes.TypeRole.MustSelector(authtypes.SigNozAdminRoleName),\n\t\t\tcoretypes.TypeRole.MustSelector(authtypes.SigNozEditorRoleName),\n\t\t\tcoretypes.TypeRole.MustSelector(authtypes.SigNozViewerRoleName),\n\t\t}\n\n\t\terr = middleware.authzService.CheckWithTupleCreation(\n\t\t\tctx,\n\t\t\tclaims,\n\t\t\tvaluer.MustNewUUID(claims.OrgID),\n\t\t\tauthtypes.Relation{Verb: coretypes.VerbAssignee},\n\t\t\tcoretypes.NewResourceRole(),\n\t\t\tselectors,\n\t\t\tselectors,\n\t\t)\n\t\tif err != nil {\n\t\t\tmiddleware.logger.WarnContext(ctx, authzDeniedMessage, slog.Any(\"claims\", claims))\n\t\t\tif errors.Asc(err, authtypes.ErrCodeAuthZForbidden) {\n\t\t\t\trender.Error(rw, errors.New(errors.TypeForbidden, authtypes.ErrCodeAuthZForbidden, \"only viewers/editors/admins can access this resource\"))\n\t\t\t\treturn\n\t\t\t}\n\n\t\t\trender.Error(rw, err)\n\t\t\treturn\n\t\t}\n\n\t\tnext(rw, req)\n\t})\n}\n\nfunc (middleware *AuthZ) EditAccess(next http.HandlerFunc) http.HandlerFunc {\n\treturn http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {\n\t\tctx := req.Context()\n\t\tclaims, err := authtypes.ClaimsFromContext(ctx)\n\t\tif err != nil {\n\t\t\trender.Error(rw, err)\n\t\t\treturn","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/SigNoz/signoz/blob/5069bf80b08f1f00d7e014eccc09902f9871004f/pkg/http/middleware/authz.go#L48-L84","documentation":"Authorization middleware rejects the request when the underlying RBAC check fails and the error is authz-forbidden for a viewer/editor/admin-level resource. Only users with at least viewer membership of the org may proceed.","triggerScenarios":"Calling an API guarded by the viewer-authorization middleware with a JWT that has no viewer/editor/owner role in the organization (e.g. invited-but-not-accepted user, wrong org, or no membership).","commonSituations":"Token from a different org, revoked/pending invite, API key without org association, or stale JWT after role changes.","solutions":["Verify the token belongs to a user with an active membership (viewer+) in the target org","Re-login or regenerate the token after membership/role changes","Check org ID headers/claims match the resource being accessed"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if resp.StatusCode == http.StatusForbidden { /* refresh token, verify org membership */ }","preventionTips":["Cache role info and re-check membership on 403","Ensure tokens are issued for the correct org"],"tags":["authz","rbac","forbidden","middleware"],"backgroundTag":"authorization-forbidden","analyzedSha":"5069bf80b08f1f00d7e014eccc09902f9871004f","analyzedAt":"2026-08-28T06:22:12.824Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}