{"record":{"id":"735e30832cd9809e","repo":"TencentCloud/TencentDB-Agent-Memory","slug":"missing-team-id","errorCode":"missing_team_id","errorMessage":"team_id is required for non-system-admin callers","messagePattern":"team_id is required for non-system-admin callers","errorType":"error_code","errorClass":"MetadataError","httpStatus":null,"severity":"error","filePath":"MemoryCore/src/metadata/service/metadata-service.ts","lineNumber":545,"sourceCode":"    }\n    return this.deleteUsers(userIds);\n  }\n\n  async deleteUsers(userIds: string[]): Promise<BatchDeleteResult> {\n    return this.store.deleteUsers(userIds);\n  }\n\n  async listUsersForCaller(\n    input: { team_id?: string } & UserListFilter,\n    ctx: V3AuthContext,\n    pagination: PaginationParams,\n  ): Promise<PaginatedResult<UserPublic>> {\n    const filtersPresent = !!(input.user_ids?.length || input.username);\n    const storeFilter = this.buildUserListStoreFilter(input);\n\n    if (!input.team_id) {\n      if (!ctx.isSystemAdmin) {\n        throw new MetadataError(\"missing_team_id\", \"team_id is required for non-system-admin callers\");\n      }\n      const page = await this.store.listUsers(pagination, storeFilter);\n      const items = filterVisibleUsers(page.items, ctx);\n      return formatListResult({ items, total: page.total }, pagination);\n    }\n\n    const teamId = input.team_id;\n\n    if (ctx.isSystemAdmin) {\n      const page = await this.store.listUsersByTeam(teamId, pagination, storeFilter);\n      const items = filterVisibleUsers(page.items, ctx);\n      return formatListResult({ items, total: page.total }, pagination);\n    }\n\n    if (!ctx.userId) {\n      throw new MetadataError(\"permission_denied\", \"authentication required\");\n    }\n","sourceCodeStart":527,"sourceCodeEnd":563,"githubUrl":"https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/3efcd317b84146d6a08518ac0f7ee7c8a8d200ec/MemoryCore/src/metadata/service/metadata-service.ts#L527-L563","documentation":"MetadataError code 'missing_team_id' thrown by listUsersForCaller when a paginated user list is requested without a team_id filter. The library restricts team-less global user listing to system administrators; every other caller must scope the query to a team. It exists to prevent non-admin users from enumerating all users in the system.","triggerScenarios":"Calling listUsersForCaller (directly or via listUsersByTeamForCaller) with an input object whose team_id is undefined/empty while the V3AuthContext has isSystemAdmin=false. E.g. passing only {username} or {user_ids:[...]} filters with no team_id.","commonSituations":"Forgetting to set team_id in the list request after migrating from an admin-only API; a client builds the filter dynamically and omits team_id when no team filter is checked in the UI; a service account that was downgraded from system_admin still issues global user-list calls.","solutions":["Add team_id to the input passed to listUsersForCaller / listUsersByTeamForCaller so the query is team-scoped.","If a global listing is truly intended, elevate the caller's auth context to isSystemAdmin=true (valid system admin credential).","Split the request into per-team requests, one per team the caller belongs to, and merge results client-side.","Wrap the call in error handling for MetadataError with code 'missing_team_id' and surface a actionable message to the caller."],"exampleFix":"// before\nawait service.listUsersForCaller(ctx, { username: 'alice' }, pagination);\n// after\nawait service.listUsersForCaller(ctx, { team_id: teamId, username: 'alice' }, pagination);","handlingStrategy":"validation","validationCode":"function canList(input, ctx) { return Boolean(input.team_id) || ctx.isSystemAdmin; }\nif (!canList(input, ctx)) throw new Error('Provide team_id or use a system-admin context');","typeGuard":"function hasTeamScope(input): input is typeof input & { team_id: string } {\n  return typeof input.team_id === 'string' && input.team_id.length > 0;\n}","tryCatchPattern":"try {\n  await service.listUsersForCaller(ctx, input, pagination);\n} catch (e) {\n  if (e instanceof MetadataError && e.code === 'missing_team_id') { /* re-scope to a team or elevate ctx */ }\n  throw e;\n}","preventionTips":["Always include team_id in user-list requests unless the caller is a system admin","Validate request DTOs (e.g. zod) to require team_id for non-admin roles at the API boundary","Derive team_id from the caller's active team in middleware instead of trusting the client","Add a unit test asserting the missing_team_id path for non-admin contexts"],"tags":["authorization","validation","missing-parameter"],"backgroundTag":"missing-required-argument","analyzedSha":"3efcd317b84146d6a08518ac0f7ee7c8a8d200ec","analyzedAt":"2026-09-01T05:44:22.276Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}