{"record":{"id":"b5621f12dfc42a35","repo":"mastra-ai/mastra","slug":"you-do-not-have-permission-to-update-this-connecti","errorCode":null,"errorMessage":"You do not have permission to update this connection","messagePattern":"You do not have permission to update this connection","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"warning","filePath":"packages/server/src/server/handlers/tool-providers.ts","lineNumber":700,"sourceCode":"      const storage = mastra.getStorage();\n      const store = await storage?.getStore('toolProviderConnections');\n      if (!store) {\n        throw new HTTPException(500, {\n          message: 'Tool provider connections storage is not configured',\n        });\n      }\n\n      const rows = await store.listConnectionsByAuthor({ providerId: provider.info.id });\n      const match = rows.find(r => r.connectionId === connectionId);\n      if (!match) {\n        throw new HTTPException(404, {\n          message: `Connection ${connectionId} not found for provider ${providerId}`,\n        });\n      }\n\n      const isShared = match.scope === 'shared';\n      if (!isShared && match.authorId !== callerAuthorId && !isAdmin) {\n        throw new HTTPException(403, {\n          message: 'You do not have permission to update this connection',\n        });\n      }\n\n      // Normalize: empty string and explicit null both clear the label.\n      const nextLabel: string | null = typeof label === 'string' && label.trim().length > 0 ? label.trim() : null;\n\n      await store.upsertConnection({\n        authorId: match.authorId,\n        providerId: provider.info.id,\n        toolkit: match.toolkit,\n        connectionId,\n        label: nextLabel,\n        scope: match.scope,\n      });\n\n      return { ok: true as const, label: nextLabel };\n    } catch (error) {","sourceCodeStart":682,"sourceCodeEnd":718,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/server/src/server/handlers/tool-providers.ts#L682-L718","documentation":"A 403 thrown when the authenticated caller is neither the connection's author nor an admin, and the connection is not shared-scope. The server prevents non-owners from updating a personal-scope connection.","triggerScenarios":"PUT/PATCH to update a connection (e.g. its label) where match.scope !== 'shared', match.authorId !== callerAuthorId, and the request context lacks admin bypass for TOOL_PROVIDERS_RESOURCE.","commonSituations":"Team member updating a colleague's personally-created connection; service account lacking admin claims performing maintenance on user-owned connections; caller authenticated as a different user than who created the connection.","solutions":["Have the connection's author make the update, or ask them to set its scope to 'shared'.","Obtain admin permissions (admin bypass for the tool-providers resource) for the caller.","Create your own connection and reference its ID instead."],"exampleFix":"// before (non-owner personal connection)\nawait api.put(`/api/tool-providers/github/connections/${id}`, { label: 'new-label' }); // 403\n// after: author shares the connection first\nawait api.put(`/api/tool-providers/github/connections/${id}`, { scope: 'shared' }); // by author\n// now any member can update","handlingStrategy":"validation","validationCode":"const conn = (await api.get(`/api/tool-providers/${providerId}/connections`)).connections.find(c => c.connectionId === id);\nconst canUpdate = conn && (conn.scope === 'shared' || conn.authorId === currentUserId || isAdmin);\nif (!canUpdate) throw new Error('Not allowed to update this connection');","typeGuard":null,"tryCatchPattern":"try {\n  await api.put(`/api/tool-providers/${p}/connections/${id}`, { label });\n} catch (e) {\n  if (e.status === 403) throw new Error('Ask the connection owner or an admin to make this change.');\n  throw e;\n}","preventionTips":["Check connection scope/authorId in UI before offering edit controls.","Prefer shared-scope connections for team-owned resources.","Handle 403 gracefully with a permission message."],"tags":["http-403","authorization","tool-providers","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}