{"record":{"id":"a98e9b62b9313171","repo":"Dokploy/dokploy","slug":"unauthorized-a98e9b","errorCode":"UNAUTHORIZED","errorMessage":"You are not allowed to access this DNS provider","messagePattern":"You are not allowed to access this DNS provider","errorType":"exception","errorClass":"TRPCError","httpStatus":401,"severity":"error","filePath":"packages/server/src/services/dns-provider.ts","lineNumber":110,"sourceCode":"\tconst provider = await db.query.dnsProvider.findFirst({\n\t\twhere: eq(dnsProvider.dnsProviderId, dnsProviderId),\n\t});\n\tif (!provider) {\n\t\tthrow new TRPCError({\n\t\t\tcode: \"NOT_FOUND\",\n\t\t\tmessage: \"DNS provider not found\",\n\t\t});\n\t}\n\treturn provider;\n};\n\nexport const findDnsProviderInOrganization = async (\n\tdnsProviderId: string,\n\torganizationId: string,\n) => {\n\tconst provider = await findDnsProviderById(dnsProviderId);\n\tif (provider.organizationId !== organizationId) {\n\t\tthrow new TRPCError({\n\t\t\tcode: \"UNAUTHORIZED\",\n\t\t\tmessage: \"You are not allowed to access this DNS provider\",\n\t\t});\n\t}\n\treturn provider;\n};\n\nexport const findDnsProvidersByOrganizationId = async (\n\torganizationId: string,\n) => {\n\treturn await db.query.dnsProvider.findMany({\n\t\twhere: eq(dnsProvider.organizationId, organizationId),\n\t\torderBy: (providers, { asc }) => [asc(providers.name)],\n\t});\n};\n\nexport const updateDnsProvider = async (\n\tdnsProviderId: string,","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/Dokploy/dokploy/blob/546686ea3587f12ec5652217dedd9f7960fb6d15/packages/server/src/services/dns-provider.ts#L92-L128","documentation":"findDnsProviderInOrganization loads a DNS provider then checks that its organizationId matches the caller's organization; a mismatch throws UNAUTHORIZED. This is multi-tenant isolation: the provider exists, but it belongs to a different organization.","triggerScenarios":"Accessing a DNS provider ID from another organization — e.g. an ID leaked via shared links, logs, or a client hardcoding an ID — while authenticated to a different org. Also happens after moving resources between organizations.","commonSituations":"Cross-tenant ID reuse in multi-tenant deployments; testing with production IDs; importing data that carries old organization IDs; token from one org used against another org's resources.","solutions":["Verify you are using the correct organization context/token for that provider","List providers within your own organization and use those IDs","If the provider should be accessible, have an admin move/recreate it under the right organization","Audit where the foreign ID came from (hardcoded config, stale cache)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const provider = await findDnsProviderById(id);\nif (provider.organizationId !== currentOrganizationId) { /* use a provider from your own org */ }","typeGuard":"const isInOrg = (p: DnsProvider, orgId: string) => p.organizationId === orgId;","tryCatchPattern":"try { await findDnsProviderInOrganization(id, orgId); } catch (e) { if (e instanceof TRPCError && e.code === \"UNAUTHORIZED\") { /* fetch org-scoped provider list */ } }","preventionTips":["Always source IDs from org-scoped list endpoints","Never share IDs across tenants","Verify auth token matches the target organization"],"tags":["authorization","multi-tenant","dns"],"backgroundTag":"cross-tenant-access-denied","analyzedSha":"546686ea3587f12ec5652217dedd9f7960fb6d15","analyzedAt":"2026-08-27T05:18:58.095Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}