{"record":{"id":"3d749bf37ea710e9","repo":"onetimesecret/onetimesecret","slug":"requires-conditions-join-or-last","errorCode":null,"errorMessage":"Requires #{conditions.join(', ')} or #{last}","messagePattern":"Requires #(.+?) or #(.+?)","errorType":"http","errorClass":"Onetime::Forbidden","httpStatus":403,"severity":"error","filePath":"lib/onetime/application/authorization_policies.rb","lineNumber":130,"sourceCode":"      def verify_one_of_roles!(colonel: false, admin: false, custom_check: nil,\n                               error_message: nil, error_key: nil, args: {})\n        # Check colonel (superuser)\n        return true if colonel && has_system_role?('colonel')\n\n        # Check admin (includes colonel via has_system_role?)\n        return true if admin && has_system_role?('admin')\n\n        # Check custom condition\n        return true if custom_check&.call\n\n        # All checks failed\n        message = error_message || build_authorization_error_message(\n          colonel: colonel,\n          admin: admin,\n          has_custom: !custom_check.nil?,\n        )\n\n        raise Onetime::Forbidden.new(message, error_key: error_key, args: args)\n      end\n\n      # Verify user has ALL of the specified roles/permissions\n      #\n      # Supports multi-condition authorization with AND logic.\n      # Must pass ALL checks (colonel AND admin AND custom).\n      #\n      # @param colonel [Boolean] Require colonel (superuser) role\n      # @param admin [Boolean] Require admin role\n      # @param custom_check [Proc, nil] Custom authorization check (must return true)\n      # @param error_message [String, nil] Override default error message (legacy)\n      # @param error_key [String, nil] i18n key for the Forbidden message\n      # @param args [Hash] Interpolation args for the i18n key\n      # @raise [Onetime::Forbidden] If any condition fails\n      #\n      # @example Must be colonel AND pass custom check\n      #   verify_all_roles!(\n      #     colonel: true,","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/onetimesecret/onetimesecret/blob/f81295e41bc3e808a3dd2cbea03ef65401a662e4/lib/onetime/application/authorization_policies.rb#L112-L148","documentation":"Error \"Requires #{conditions.join(', ')} or #{last}\" thrown in onetimesecret/onetimesecret.","triggerScenarios":"Thrown at lib/onetime/application/authorization_policies.rb:130 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Sign in with an account that has one of the listed roles/permissions, or have an administrator grant one of them."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"f81295e41bc3e808a3dd2cbea03ef65401a662e4","analyzedAt":"2026-08-23T21:13:10.635Z","schemaVersion":2},"datasetVersion":"2026-08-24T02:17:37.098Z"}