{"record":{"id":"de50ed1465b34236","repo":"Dokploy/dokploy","slug":"unauthorized-de50ed","errorCode":"UNAUTHORIZED","errorMessage":"You don't have access to this project","messagePattern":"You don't have access to this project","errorType":"exception","errorClass":"TRPCError","httpStatus":401,"severity":"error","filePath":"apps/dokploy/server/api/routers/vault-provider.ts","lineNumber":141,"sourceCode":"\t\t\tawait testVaultProviderConnection(config!);\n\t\t\treturn true;\n\t\t}),\n\n\tlistSecretNames: withPermission(\"vaultProvider\", \"read\")\n\t\t.input(apiListVaultSecretNames)\n\t\t.query(async ({ ctx, input }) => {\n\t\t\tconst provider = await findVaultProviderInOrganization(\n\t\t\t\tinput.vaultProviderId,\n\t\t\t\tctx.session.activeOrganizationId,\n\t\t\t);\n\n\t\t\tif (ctx.user.role !== \"owner\" && ctx.user.role !== \"admin\") {\n\t\t\t\tconst { accessedProjects } = await findMemberByUserId(\n\t\t\t\t\tctx.user.id,\n\t\t\t\t\tctx.session.activeOrganizationId,\n\t\t\t\t);\n\t\t\t\tif (!accessedProjects.includes(input.projectId)) {\n\t\t\t\t\tthrow new TRPCError({\n\t\t\t\t\t\tcode: \"UNAUTHORIZED\",\n\t\t\t\t\t\tmessage: \"You don't have access to this project\",\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (\n\t\t\t\t!isVaultProviderAssigned(\n\t\t\t\t\tprovider.assignments,\n\t\t\t\t\tinput.projectId,\n\t\t\t\t\tinput.environmentId,\n\t\t\t\t)\n\t\t\t) {\n\t\t\t\tthrow new TRPCError({\n\t\t\t\t\tcode: \"FORBIDDEN\",\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t\"This vault provider is not enabled for the given project/environment\",\n\t\t\t\t});","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/Dokploy/dokploy/blob/546686ea3587f12ec5652217dedd9f7960fb6d15/apps/dokploy/server/api/routers/vault-provider.ts#L123-L159","documentation":"Thrown by vault-provider endpoints when a non-owner/non-admin user queries a project that is not in their accessedProjects list for the active organization. Dokploy restricts member access to explicitly granted projects; the membership record's accessedProjects array is the source of truth.","triggerScenarios":"Calling a vault-provider mutation/query with input.projectId while ctx.user.role is 'member' and the member record (found via findMemberByUserId) does not include that projectId in accessedProjects.","commonSituations":"Member granted access to some projects but the UI/URL still references a revoked or never-granted project; permissions changed after the page loaded; deep links to a project the user was never added to.","solutions":["Ask an owner/admin to grant the member access to the project (assign permissions)","Switch to a project you have access to, or reselect from the projects list","Sign out/in or refresh permissions if access was just granted but the session/member cache is stale"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const { accessedProjects } = await trpc.member.permissions.query();\nif (accessedProjects.includes(projectId)) {\n  await trpc.vaultProvider.byId.query({ projectId, ... });\n}","typeGuard":"const hasProjectAccess = (accessed: string[], projectId: string) => accessed.includes(projectId);","tryCatchPattern":"catch (e) { if (e?.data?.code === 'UNAUTHORIZED' && /access to this project/.test(e.message)) requestAccess(); else throw e; }","preventionTips":["Filter project lists by the member's accessedProjects","Refresh permissions after access changes","Deep-link guards: verify project access before rendering"],"tags":["dokploy","trpc","authorization","unauthorized","projects","vault"],"backgroundTag":"project-access-denied","analyzedSha":"546686ea3587f12ec5652217dedd9f7960fb6d15","analyzedAt":"2026-08-27T05:18:58.095Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}