{"record":{"id":"a7367864079726cd","repo":"paperclipai/paperclip","slug":"only-the-comment-author-can-cancel-queued-comments","errorCode":null,"errorMessage":"Only the comment author can cancel queued comments","messagePattern":"Only the comment author can cancel queued comments","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/routes/issues.ts","lineNumber":12578,"sourceCode":"  );\n\n  router.get(\"/issues/:id/interactions\", async (req, res) => {\n    const id = req.params.id as string;\n    const issue = await getAccessibleResource(req, res, getIssueById(req, id), \"Issue not found\");\n    if (!issue) return;\n    if (!(await assertIssueReadAllowed(req, res, issue))) return;\n    const interactions = await issueThreadInteractionService(db).listForIssue(id);\n    res.json(interactions);\n  });\n\n  router.post(\"/issues/:id/interactions\", validate(createIssueThreadInteractionSchema), async (req, res) => {\n    const id = req.params.id as string;\n    const issue = await getAccessibleResource(req, res, svc.getById(id), \"Issue not found\");\n    if (!issue) return;\n    if (req.actor.type === \"agent\") {\n      if (!(await assertAgentIssueMutationAllowed(req, res, issue, { allowVisibleIssueWrite: true }))) return;\n      if (await assertLowTrustControlPlaneDenied(req, res, issue.companyId, issue)) return;\n    } else {\n      assertBoard(req);\n    }\n\n    const actor = getActorInfo(req);\n    const agentSourceRunId = req.actor.type === \"agent\" ? requireAgentRunId(req, res) : null;\n    if (req.actor.type === \"agent\" && !agentSourceRunId) return;\n    if (\n      req.body.kind === \"request_confirmation\"\n      && req.body.addresseeAgentId\n      && req.body.payload?.toolAction !== undefined\n    ) {\n      throw badRequest(\"Tool-action confirmations cannot be addressed to agents\");\n    }\n    if (req.body.kind === \"request_confirmation\" && req.body.payload?.toolAction !== undefined) {\n      throw unprocessable(\"payload.toolAction is server-owned metadata and cannot be supplied when creating an interaction\");\n    }\n    if (req.body.kind === \"request_confirmation\" && req.body.payload?.secretProposal !== undefined) {\n      throw unprocessable(\"payload.secretProposal is server-owned metadata and cannot be supplied when creating an interaction\");","sourceCodeStart":12560,"sourceCodeEnd":12596,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/routes/issues.ts#L12560-L12596","documentation":"403 on comment delete/cancel. Fires in cancel mode (or when the comment is a queued comment for an active run) and the acting actor is not the comment's original author: only the author agent or user may cancel their queued comment.","triggerScenarios":"Thrown at server/src/routes/issues.ts:11574 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).","If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}