{"record":{"id":"d0056431925952c4","repo":"mastra-ai/mastra","slug":"rbac-provider-does-not-support-role-permission-res","errorCode":null,"errorMessage":"RBAC provider does not support role permission resolution","messagePattern":"RBAC provider does not support role permission resolution","errorType":"http","errorClass":"HTTPException","httpStatus":404,"severity":"error","filePath":"packages/server/src/server/handlers/auth.ts","lineNumber":804,"sourceCode":"  responseSchema: rolePermissionsResponseSchema,\n  summary: 'Get permissions for a role',\n  description:\n    'Returns the resolved permissions for a specific role. Only accessible by admin users. Used by the \"View as role\" feature.',\n  tags: ['Auth'],\n  handler: async ctx => {\n    try {\n      const { mastra, requestContext, roleId } = ctx as any;\n\n      // Check that the caller is an admin\n      const callerPermissions: string[] = requestContext?.get(MASTRA_USER_PERMISSIONS_KEY) ?? [];\n      const isAdmin = callerPermissions.some((p: string) => p === '*' || p === '*:*');\n      if (!isAdmin) {\n        throw new HTTPException(403, { message: 'Admin access required' });\n      }\n\n      const rbac = getRBACProvider(mastra);\n      if (!rbac?.getPermissionsForRole) {\n        throw new HTTPException(404, { message: 'RBAC provider does not support role permission resolution' });\n      }\n\n      const permissions = await rbac.getPermissionsForRole(roleId);\n      return { roleId, permissions };\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error getting role permissions');\n    }\n  },\n});\n\n// ============================================================================\n// GET /auth/permission-patterns\n// ============================================================================\n\nexport const GET_PERMISSION_PATTERNS_ROUTE = createRoute({\n  method: 'GET',\n  path: '/auth/permission-patterns',","sourceCodeStart":786,"sourceCodeEnd":822,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/server/src/server/handlers/auth.ts#L786-L822","documentation":"Thrown as a 404 by the GET /auth/roles/:roleId/permissions handler when the resolved RBAC provider exists but does not expose getPermissionsForRole. It means the configured RBAC backend cannot resolve per-role permission sets, regardless of who is calling.","triggerScenarios":"Calling GET /auth/roles/:roleId/permissions on a server whose RBAC provider lacks a getPermissionsForRole method — e.g. a custom or legacy RBAC provider implementing only the base interface, or no full RBAC provider registered so a stub/partial provider is returned.","commonSituations":"Custom RBAC implementations built before getPermissionsForRole was added to the interface; running with a minimal/default RBAC setup and assuming role-permission introspection is available; version drift where the provider wasn't updated after upgrading Mastra.","solutions":["Implement getPermissionsForRole(roleId) on your RBAC provider, returning the permission list for a role.","Upgrade or replace the RBAC provider with one that supports role permission resolution.","If the backend cannot support it, stop calling this endpoint and maintain role-permission mappings on the client/admin side.","Check the Mastra version changelog for RBAC interface additions and update your custom provider accordingly."],"exampleFix":"// before\nclass MyRbacProvider {\n  async checkPermission() { /* ... */ }\n}\n\n// after\nclass MyRbacProvider {\n  async checkPermission() { /* ... */ }\n  async getPermissionsForRole(roleId: string): Promise<string[]> {\n    return this.store.permissionsForRole(roleId);\n  }\n}","handlingStrategy":"type-guard","validationCode":"// Server-side: before registering routes, assert RBAC capability\nconst rbac = getRBACProvider(mastra);\nif (!rbac?.getPermissionsForRole) {\n  console.warn('RBAC provider lacks getPermissionsForRole; role permission endpoint will 404');\n}","typeGuard":"function supportsRolePermissionResolution(rbac: unknown): rbac is RBACProvider & { getPermissionsForRole: (roleId: string) => Promise<string[]> } {\n  return typeof rbac === 'object' && rbac !== null && typeof (rbac as any).getPermissionsForRole === 'function';\n}","tryCatchPattern":"try {\n  const { permissions } = await getRolePermissions(roleId);\n} catch (e) {\n  if (e.status === 404 && /does not support role permission resolution/.test(e.message)) {\n    throw new Error('Your RBAC provider cannot resolve role permissions — upgrade/implement getPermissionsForRole.');\n  }\n  throw e;\n}","preventionTips":["Implement getPermissionsForRole on custom RBAC providers.","After upgrades, run an interface conformance check against the RBAC provider interface.","Feature-detect capability before exposing the role-permissions UI.","Keep custom providers in sync with the RBAC interface changelog."],"tags":["rbac","api-surface","http-404"],"backgroundTag":"provider-method-not-implemented","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}