{"record":{"id":"4097946dd94b131b","repo":"odysseus-dev/odysseus","slug":"admin-only-409794","errorCode":null,"errorMessage":"Admin only","messagePattern":"Admin only","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"routes/shell_routes.py","lineNumber":67,"sourceCode":"    git_bash_path,\n)\n\n\ndef _require_admin(request: Request):\n    \"\"\"Reject non-admin callers. Shell exec is admin-only — never expose to\n    regular users; that's RCE-after-signup.\"\"\"\n    auth_manager = getattr(request.app.state, \"auth_manager\", None)\n    if not auth_manager:\n        # No auth at all — only safe in fully-trusted localhost dev mode\n        return\n    user = getattr(request.state, \"current_user\", None)\n    # In-process tool loopback. The AuthMiddleware already validated the\n    # internal token + loopback client before setting this marker, so\n    # honour it here as admin-equivalent.\n    if user == INTERNAL_TOOL_USER:\n        return\n    if not user or user == \"api\":\n        raise HTTPException(403, \"Admin only\")\n    if not auth_manager.is_admin(user):\n        raise HTTPException(403, \"Admin only\")\n\n\ndef _reject_cross_site(request: Request):\n    \"\"\"Reject browser cross-site navigations to shell-touching endpoints.\"\"\"\n    if request.headers.get(\"sec-fetch-site\") == \"cross-site\":\n        raise HTTPException(403, \"Cross-site request rejected\")\n\n\n_SSH_PORT_RE = re.compile(r\"^\\d{1,5}$\")\n_SAFE_VENV_RE = re.compile(r\"^[A-Za-z0-9_./~-]+$\")\n\n\ndef _ssh_base_argv(host: str, ssh_port: str | None) -> list[str]:\n    \"\"\"Build an ssh argv prefix for remote probes without local-shell parsing.\"\"\"\n    if not host or not str(host).strip() or str(host).lstrip().startswith(\"-\"):\n        raise ValueError(\"invalid ssh host\")","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/odysseus-dev/odysseus/blob/f9235ebbf13f693a6fd29ce70b097f6ec83705bf/routes/shell_routes.py#L49-L85","documentation":"Error \"Admin only\" thrown in odysseus-dev/odysseus.","triggerScenarios":"Triggered when the corresponding server-side validation or runtime check at the recorded location rejects the request or operation and returns this error message to the caller.","commonSituations":"See trigger scenarios.","solutions":["Use an admin account for this operation.","Ask an administrator to perform the action."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"f9235ebbf13f693a6fd29ce70b097f6ec83705bf","analyzedAt":"2026-08-14T21:47:48.359Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}