{"record":{"id":"b519981d654d2b97","repo":"ruvnet/RuView","slug":"admin-privileges-required","errorCode":null,"errorMessage":"Admin privileges required","messagePattern":"Admin privileges required","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"archive/v1/src/api/dependencies.py","lineNumber":138,"sourceCode":"            headers={\"WWW-Authenticate\": \"Bearer\"},\n        )\n    \n    # Check if user is active\n    if not current_user.get(\"is_active\", True):\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail=\"Inactive user\"\n        )\n    \n    return current_user\n\n\nasync def get_admin_user(\n    current_user: Dict[str, Any] = Depends(get_current_active_user)\n) -> Dict[str, Any]:\n    \"\"\"Get current admin user (admin privileges required).\"\"\"\n    if not current_user.get(\"is_admin\", False):\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail=\"Admin privileges required\"\n        )\n    \n    return current_user\n\n\n# Permission dependencies\ndef require_permission(permission: str):\n    \"\"\"Dependency factory for permission checking.\"\"\"\n    \n    async def check_permission(\n        current_user: Dict[str, Any] = Depends(get_current_active_user)\n    ) -> Dict[str, Any]:\n        \"\"\"Check if user has required permission.\"\"\"\n        user_permissions = current_user.get(\"permissions\", [])\n        \n        # Admin users have all permissions","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/ruvnet/RuView/blob/4685618388a5e49fad5b3005806f3bdd6a7c25c3/archive/v1/src/api/dependencies.py#L120-L156","documentation":"get_admin_user raises 403 'Admin privileges required' when the authenticated active user lacks is_admin=True. It chains through get_current_active_user, so it only fires after authentication already succeeded — it is a role check, not an authentication failure.","triggerScenarios":"A regular user's token used on an admin-only route; a JWT minted without the admin claim; the admin flag removed from the user record while their token remains valid.","commonSituations":"Calling admin endpoints with a normal login; role changes not reflected until the token is re-issued; scripts or tools configured with the wrong credentials.","solutions":["Authenticate as an account with is_admin=True and retry","Grant is_admin to the account (admin console or DB update) and log in again","Verify the token issuer actually includes the admin claim your API checks"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# Check the admin claim before calling admin endpoints\nclaims = jwt.decode(token, options={'verify_signature': False})\nif not claims.get('is_admin', False):\n    raise PermissionError('This operation requires an admin token')\nclient.get('/api/admin/users', headers={'Authorization': f'Bearer {token}'})","typeGuard":null,"tryCatchPattern":"try:\n    r = client.get('/api/admin/users', headers=auth)\n    r.raise_for_status()\nexcept httpx.HTTPStatusError as e:\n    if e.response.status_code == 403:\n        # role problem, not session problem: hide admin UI, do not retry with same token\n        disable_admin_ui()\n    raise","preventionTips":["Gate admin UI on the token's is_admin claim before issuing calls","Separate admin tokens from regular user tokens in tooling","Treat 403 as authorization state to respect, never as transient"],"tags":["authorization","admin","http-403","python"],"backgroundTag":null,"analyzedSha":"4685618388a5e49fad5b3005806f3bdd6a7c25c3","analyzedAt":"2026-08-16T06:09:40.886Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}