{"record":{"id":"d132296bd013011b","repo":"langfuse/langfuse","slug":"forbidden-d13229","errorCode":"FORBIDDEN","errorMessage":"You do not have the required access rights","messagePattern":"You do not have the required access rights","errorType":"exception","errorClass":"TRPCError","httpStatus":403,"severity":"error","filePath":"web/src/features/rbac/server/allMembersRoutes.ts","lineNumber":227,"sourceCode":"    }),\n  allFromProject: protectedProjectProcedure\n    .input(projectLevelMemberQuery)\n    .query(async ({ input, ctx }) => {\n      const orgId = ctx.session.orgId;\n      const orgAccess = hasOrganizationAccess({\n        session: ctx.session,\n        organizationId: orgId,\n        scope: \"organizationMembers:read\",\n      });\n\n      const projectAccess = hasProjectAccess({\n        session: ctx.session,\n        projectId: input.projectId,\n        scope: \"projectMembers:read\",\n      });\n\n      if (!orgAccess && !projectAccess) {\n        throw new TRPCError({\n          code: \"FORBIDDEN\",\n          message: \"You do not have the required access rights\",\n        });\n      }\n\n      return getMembers(\n        ctx.prisma,\n        {\n          ...input,\n          orgId,\n        },\n        orgAccess,\n      );\n    }),\n};\n","sourceCodeStart":209,"sourceCodeEnd":243,"githubUrl":"https://github.com/langfuse/langfuse/blob/59d92c7cf365150d10b753b5a0d1708902a2ed60/web/src/features/rbac/server/allMembersRoutes.ts#L209-L243","documentation":"Thrown by the RBAC allMembers tRPC route when both the organization access check and the project access check for scope 'projectMembers:read' fail. It is the member-list equivalent of the invites guard: read permission on members is required at org or project level.","triggerScenarios":"Calling allMembers with a projectId where the caller's roles lack projectMembers:read — e.g. a viewer-role user, or a user whose project membership was revoked but the UI still issues the query.","commonSituations":"Frontend pages (members table) loaded with a stale project switcher state, custom roles with read scopes accidentally removed, or session not yet reflecting a newly granted membership.","solutions":["Check the user's effective scopes for the target project (role definitions + project membership)","Refresh the session / re-login after role or membership changes","Ensure the UI only queries allMembers for projects the user currently belongs to","Grant a role containing projectMembers:read if listing members is intended"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const allowed =\n  hasProjectAccess({ session, projectId, scope: \"projectMembers:read\" }) ||\n  hasOrganizationAccess({ session, organizationId: orgId, scope: \"organizationMembers:read\" });\nif (!allowed) skipMembersQuery();","typeGuard":null,"tryCatchPattern":"catch (e) { if (e.data?.code === \"FORBIDDEN\") { renderNoPermissionState(); } else throw e; }","preventionTips":["Only query members for projects present in the session's project list","Filter role pickers and management UI by effective scopes"],"tags":["rbac","trpc","forbidden","authorization","members"],"backgroundTag":"rbac-insufficient-permission","analyzedSha":"59d92c7cf365150d10b753b5a0d1708902a2ed60","analyzedAt":"2026-08-27T22:22:00.402Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}