{"record":{"id":"c3f4b61cf4cc869f","repo":"Dokploy/dokploy","slug":"forbidden-c3f4b6","errorCode":"FORBIDDEN","errorMessage":"You are not allowed to access this environment","messagePattern":"You are not allowed to access this environment","errorType":"exception","errorClass":"TRPCError","httpStatus":403,"severity":"error","filePath":"apps/dokploy/server/api/routers/environment.ts","lineNumber":86,"sourceCode":"\t\t\t\tif (error instanceof TRPCError) {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tthrow new TRPCError({\n\t\t\t\t\tcode: \"BAD_REQUEST\",\n\t\t\t\t\tmessage: `Error creating the environment: ${error instanceof Error ? error.message : error}`,\n\t\t\t\t\tcause: error,\n\t\t\t\t});\n\t\t\t}\n\t\t}),\n\n\tone: protectedProcedure\n\t\t.input(apiFindOneEnvironment)\n\t\t.query(async ({ input, ctx }) => {\n\t\t\tconst environment = await findEnvironmentById(input.environmentId);\n\t\t\tif (\n\t\t\t\tenvironment.project.organizationId !== ctx.session.activeOrganizationId\n\t\t\t) {\n\t\t\t\tthrow new TRPCError({\n\t\t\t\t\tcode: \"FORBIDDEN\",\n\t\t\t\t\tmessage: \"You are not allowed to access this environment\",\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (ctx.user.role !== \"owner\" && ctx.user.role !== \"admin\") {\n\t\t\t\tconst { accessedEnvironments, accessedServices } =\n\t\t\t\t\tawait findMemberByUserId(\n\t\t\t\t\t\tctx.user.id,\n\t\t\t\t\t\tctx.session.activeOrganizationId,\n\t\t\t\t\t);\n\n\t\t\t\tif (!accessedEnvironments.includes(environment.environmentId)) {\n\t\t\t\t\tthrow new TRPCError({\n\t\t\t\t\t\tcode: \"FORBIDDEN\",\n\t\t\t\t\t\tmessage: \"You are not allowed to access this environment\",\n\t\t\t\t\t});\n\t\t\t\t}","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/Dokploy/dokploy/blob/546686ea3587f12ec5652217dedd9f7960fb6d15/apps/dokploy/server/api/routers/environment.ts#L68-L104","documentation":"Thrown by environmentRouter.findOne when the fetched environment belongs to a different organization than the caller's active session organization. This is an ownership boundary check that runs before any role/permission logic.","triggerScenarios":"Calling environment.one with an environmentId whose project.organizationId differs from ctx.session.activeOrganizationId — e.g. copying an environmentId from another org, or having the wrong organization switched active in the UI.","commonSituations":"User has multiple organizations and the active one is switched while a stale environment page is open; environmentId leaked across organizations via shared links or bookmarks.","solutions":["Verify the environmentId belongs to the currently active organization","Switch the active organization in the client to the one owning the environment","Re-fetch the environment list for the active org to get valid IDs"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":"function isCrossOrgForbidden(e: unknown): boolean {\n  return e instanceof TRPCClientError && e.data?.code === 'FORBIDDEN'\n    && /not allowed to access this environment/.test(e.message);\n}","tryCatchPattern":"catch (e) { if (isCrossOrgForbidden(e)) refetchEnvironments(); else throw e; }","preventionTips":["Always derive environmentIds from a live org-scoped list","Reload environment list after switching active organization"],"tags":["dokploy","environment","trpc","authorization","forbidden"],"backgroundTag":"resource-ownership-mismatch","analyzedSha":"546686ea3587f12ec5652217dedd9f7960fb6d15","analyzedAt":"2026-08-27T05:18:58.095Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}