{"record":{"id":"ad2257514fed94f1","repo":"paperclipai/paperclip","slug":"skill-authentication-required","errorCode":"skill_authentication_required","errorMessage":"Authentication required","messagePattern":"Authentication required","errorType":"http","errorClass":"HttpError","httpStatus":401,"severity":"error","filePath":"server/src/routes/company-skill-policy.ts","lineNumber":35,"sourceCode":"      try {\n        req.body = schema.parse(req.body);\n        next();\n      } catch (error) {\n        if (error instanceof ZodError) {\n          next(unprocessable(\"Invalid skill policy document\", {\n            code: \"skill_policy_validation_failed\",\n            issues: error.issues,\n          }));\n          return;\n        }\n        next(error);\n      }\n    };\n  }\n\n  function assertSkillPolicyCompanyAccess(req: Request, companyId: string) {\n    if (req.actor.type === \"none\") {\n      throw new HttpError(401, \"Authentication required\", { code: \"skill_authentication_required\" });\n    }\n    if (req.actor.type === \"agent\" && req.actor.companyId !== companyId) {\n      throw forbidden(\"Agent key cannot access another company\", { code: \"skill_company_boundary_denied\" });\n    }\n    assertCompanyAccess(req, companyId);\n  }\n\n  async function assertCanAdministerPolicy(req: Request, companyId: string) {\n    assertSkillPolicyCompanyAccess(req, companyId);\n    if (req.actor.type === \"board\") {\n      if (req.actor.source === \"local_implicit\" || req.actor.isInstanceAdmin) return;\n      if (await access.canUser(companyId, req.actor.userId, \"users:manage_permissions\")) return;\n    } else if (\n      req.actor.type === \"agent\"\n      && req.actor.agentId\n      && await access.hasPermission(companyId, \"agent\", req.actor.agentId, \"users:manage_permissions\")\n    ) {\n      return;","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/server/src/routes/company-skill-policy.ts#L17-L53","documentation":"Auth guard in assertSkillPolicyCompanyAccess: req.actor.type is 'none', i.e. the request carries no authenticated actor. Skill-policy mutations require at least an authenticated identity, so an HttpError(401) with code skill_authentication_required is thrown before any policy read/write.","triggerScenarios":"Thrown at server/src/routes/company-skill-policy.ts:35 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Authenticate (board session or valid agent API key) before calling this endpoint."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}