{"record":{"id":"eb25509ff3b95beb","repo":"bitwarden/server","slug":"invalid-permissions","errorCode":null,"errorMessage":"Invalid permissions.","messagePattern":"Invalid permissions\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs","lineNumber":223,"sourceCode":"                RevisionDate = DateTime.UtcNow,\n            };\n\n            await _providerUserRepository.CreateAsync(providerUser);\n\n            await SendInviteAsync(providerUser, provider);\n            providerUsers.Add(providerUser);\n        }\n\n        await _eventService.LogProviderUsersEventAsync(providerUsers.Select(pu => (pu, EventType.ProviderUser_Invited, null as DateTime?)));\n\n        return providerUsers;\n    }\n\n    public async Task<List<Tuple<ProviderUser, string>>> ResendInvitesAsync(ProviderUserInvite<Guid> invite)\n    {\n        if (!_currentContext.ProviderManageUsers(invite.ProviderId))\n        {\n            throw new BadRequestException(\"Invalid permissions.\");\n        }\n\n        var providerUsers = await _providerUserRepository.GetManyAsync(invite.UserIdentifiers);\n        var provider = await _providerRepository.GetByIdAsync(invite.ProviderId);\n\n        var result = new List<Tuple<ProviderUser, string>>();\n        foreach (var providerUser in providerUsers)\n        {\n            if (providerUser.Status != ProviderUserStatusType.Invited || providerUser.ProviderId != invite.ProviderId)\n            {\n                result.Add(Tuple.Create(providerUser, \"User invalid.\"));\n                continue;\n            }\n\n            await SendInviteAsync(providerUser, provider);\n            result.Add(Tuple.Create(providerUser, \"\"));\n        }\n","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs#L205-L241","documentation":"Thrown inside ResendInvitesAsync as BadRequestException when _currentContext.ProviderManageUsers(invite.ProviderId) returns false — the caller lacks permission to manage users for that provider. BadRequestException (HTTP 400).","triggerScenarios":"A provider user without manage-users rights calls resend invites; the current context's provider Id does not match; session permission claims expired.","commonSituations":"Role downgrade after page load; cross-provider request with the wrong provider context; expired or stale session token.","solutions":["Verify _currentContext.ProviderManageUsers(providerId) is true before calling.","Ensure the caller holds a ProviderAdmin (or equivalent) role with user-management rights for that provider.","Refresh the session/permission claims if they are stale."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (!_currentContext.ProviderManageUsers(invite.ProviderId))\n    throw new UnauthorizedAccessException(\"Caller lacks ProviderManageUsers permission.\");","typeGuard":null,"tryCatchPattern":"try { await _providerService.ResendInvitesAsync(invite); }\ncatch (BadRequestException ex) when (ex.Message == \"Invalid permissions.\")\n{ /* refresh session / re-check role */ }","preventionTips":["Gate the UI resend action on ProviderManageUsers permission.","Refresh permission claims if the user's role changed.","Ensure the provider context in the request matches the user's scope."],"tags":["provider","invite","authorization","permissions","bitwarden"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}