{"record":{"id":"95fe2c70ee3beac4","repo":"Dokploy/dokploy","slug":"unauthorized-95fe2c","errorCode":"UNAUTHORIZED","errorMessage":"You are not allowed to access this vault provider","messagePattern":"You are not allowed to access this vault provider","errorType":"exception","errorClass":"TRPCError","httpStatus":401,"severity":"error","filePath":"packages/server/src/services/vault-provider.ts","lineNumber":152,"sourceCode":"\tconst provider = await db.query.vaultProvider.findFirst({\n\t\twhere: eq(vaultProvider.vaultProviderId, vaultProviderId),\n\t});\n\tif (!provider) {\n\t\tthrow new TRPCError({\n\t\t\tcode: \"NOT_FOUND\",\n\t\t\tmessage: \"Vault provider not found\",\n\t\t});\n\t}\n\treturn provider;\n};\n\nexport const findVaultProviderInOrganization = async (\n\tvaultProviderId: string,\n\torganizationId: string,\n) => {\n\tconst provider = await findVaultProviderById(vaultProviderId);\n\tif (provider.organizationId !== organizationId) {\n\t\tthrow new TRPCError({\n\t\t\tcode: \"UNAUTHORIZED\",\n\t\t\tmessage: \"You are not allowed to access this vault provider\",\n\t\t});\n\t}\n\treturn provider;\n};\n\nexport const findVaultProvidersByOrganizationId = async (\n\torganizationId: string,\n) => {\n\treturn await db.query.vaultProvider.findMany({\n\t\twhere: eq(vaultProvider.organizationId, organizationId),\n\t\torderBy: (providers, { asc }) => [asc(providers.name)],\n\t});\n};\n\nexport const updateVaultProvider = async (\n\tvaultProviderId: string,","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/Dokploy/dokploy/blob/546686ea3587f12ec5652217dedd9f7960fb6d15/packages/server/src/services/vault-provider.ts#L134-L170","documentation":"The requested vault provider exists, but its organizationId does not match the caller's organization. This is an ownership/tenancy check enforced in application code, surfaced as UNAUTHORIZED.","triggerScenarios":"Calling findVaultProviderInOrganization(providerId, orgId) where the provider belongs to a different organization — e.g. a user pasting another org's provider ID into an API request or a cross-tenant reference in your data.","commonSituations":"Multi-tenant leakage attempts, using an ID obtained from a different account/workspace, or passing the wrong organizationId from session context.","solutions":["Use provider IDs that belong to the caller's own organization (list them via the org-scoped endpoint)","Verify the provider's organizationId in the DB matches the session's organization","Audit callers that store provider IDs to make sure they never persist cross-org references"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const provider = await db.query.vaultProvider.findFirst({ where: and(eq(vaultProvider.vaultProviderId, id), eq(vaultProvider.organizationId, sessionOrgId)) });\nif (!provider) throw new Error('provider not in your organization');","typeGuard":null,"tryCatchPattern":"try { await findVaultProviderInOrganization(id, orgId); } catch (e) { if (e instanceof TRPCError && e.code === 'UNAUTHORIZED') { hideProviderFromUI(id); return; } throw e; }","preventionTips":["Always fetch provider lists through org-scoped endpoints","Never accept raw provider IDs from client input without an org check","Keep session organizationId authoritative, not a client-supplied value"],"tags":["vault","authorization","multi-tenant","trpc"],"backgroundTag":"cross-tenant-access-denied","analyzedSha":"546686ea3587f12ec5652217dedd9f7960fb6d15","analyzedAt":"2026-08-27T05:18:58.095Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}