{"record":{"id":"3001e4352afcc657","repo":"paperclipai/paperclip","slug":"issue-activity-is-outside-this-actor-s-authorizati","errorCode":null,"errorMessage":"Issue activity is outside this actor's authorization boundary","messagePattern":"Issue activity is outside this actor's authorization boundary","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/routes/activity.ts","lineNumber":210,"sourceCode":"    assigneeUserId: string | null;\n    status: string;\n  }) {\n    const decision = await access.decide({\n      actor: req.actor,\n      action: \"issue:read\",\n      resource: {\n        type: \"issue\",\n        companyId: issue.companyId,\n        issueId: issue.id,\n        projectId: issue.projectId,\n        parentIssueId: issue.parentId,\n        assigneeAgentId: issue.assigneeAgentId,\n        assigneeUserId: issue.assigneeUserId,\n        status: issue.status,\n      },\n    });\n    if (decision.allowed) return true;\n    res.status(403).json({ error: \"Issue activity is outside this actor's authorization boundary\" });\n    return false;\n  }\n\n  async function resolveIssueByRef(rawId: string) {\n    const identifier = normalizeIssueIdentifier(rawId);\n    if (identifier) {\n      return issueSvc.getByIdentifier(identifier);\n    }\n    return issueSvc.getById(rawId);\n  }\n\n  router.get(\"/companies/:companyId/activity\", async (req, res) => {\n    const companyId = req.params.companyId as string;\n    assertCompanyAccess(req, companyId);\n    if (!(await assertCompanyScopeReadAllowed(req, res, companyId))) return;\n\n    const filters = {\n      companyId,","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/paperclipai/paperclip/blob/a7e689b3c35347b529cb9f54c9b9a8575a3dcab6/server/src/routes/activity.ts#L192-L228","documentation":"Per-issue authorization gate in the activity routes: the 'issue:read' access decision for the referenced issue was denied (the actor cannot see this issue given its project/parent/assignee context), so its activity entries are withheld with a 403.","triggerScenarios":"Thrown at server/src/routes/activity.ts:210 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Request issue activity only for issues within the actor's authorized company scope."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a7e689b3c35347b529cb9f54c9b9a8575a3dcab6","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}