{"record":{"id":"edce11572e746987","repo":"TencentCloud/TencentDB-Agent-Memory","slug":"filter-not-allowed","errorCode":"filter_not_allowed","errorMessage":"filters are not allowed for normal team members","messagePattern":"filters are not allowed for normal team members","errorType":"error_code","errorClass":"MetadataError","httpStatus":null,"severity":"error","filePath":"MemoryCore/src/metadata/service/metadata-service.ts","lineNumber":577,"sourceCode":"\n    if (!ctx.userId) {\n      throw new MetadataError(\"permission_denied\", \"authentication required\");\n    }\n\n    const member = await this.store.getTeamMember(teamId, ctx.userId);\n    if (!member || member.status !== \"active\") {\n      throw new MetadataError(\"permission_denied\", \"not a team member\");\n    }\n\n    const isTeamAdmin = member.role === \"admin\";\n    if (isTeamAdmin) {\n      const page = await this.store.listUsersByTeam(teamId, pagination, storeFilter);\n      const items = filterVisibleUsers(page.items, ctx, { allowTeamPeers: true });\n      return formatListResult({ items, total: page.total }, pagination);\n    }\n\n    if (filtersPresent) {\n      throw new MetadataError(\"filter_not_allowed\", \"filters are not allowed for normal team members\");\n    }\n\n    const self = await this.store.getUserById(ctx.userId);\n    if (!self) {\n      throw new MetadataError(\"user_not_found\", `user not found: ${ctx.userId}`);\n    }\n    const visible = filterVisibleUsers([self], ctx);\n    if (pagination.offset > 0) {\n      return wrapPaginated([], 1, pagination);\n    }\n    return wrapPaginated(visible, 1, pagination);\n  }\n\n  private buildUserListStoreFilter(input: UserListFilter): InstanceUserListFilter | undefined {\n    const filter: InstanceUserListFilter = {};\n    if (input.user_ids?.length) filter.user_ids = input.user_ids;\n    if (input.username) filter.username = input.username;\n    return Object.keys(filter).length ? filter : undefined;","sourceCodeStart":559,"sourceCodeEnd":595,"githubUrl":"https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/3efcd317b84146d6a08518ac0f7ee7c8a8d200ec/MemoryCore/src/metadata/service/metadata-service.ts#L559-L595","documentation":"MetadataError code 'filter_not_allowed' thrown by listUsersForCaller when a plain (non-admin) team member supplies list filters (user_ids or username). Ordinary team members may only fetch the paginated member list unfiltered; targeted lookups by id/username are reserved for team admins and system admins.","triggerScenarios":"Calling listUsersForCaller with team_id set, caller is an authenticated active team member with role !== 'admin', and input.user_ids is non-empty or input.username is set (filtersPresent true).","commonSituations":"A UI autocomplete trying to resolve usernames within the team using a regular member token; code copied from an admin flow reused with member credentials; a version change where filters were previously tolerated for members.","solutions":["Remove user_ids/username filters from the request and iterate the paginated member list client-side instead.","Elevate the caller to team admin (member.role === 'admin') if targeted lookups are genuinely needed.","Have a system admin run the filtered query.","Catch MetadataError code 'filter_not_allowed' and fall back to the unfiltered list with client-side filtering."],"exampleFix":"// before\nawait service.listUsersForCaller(ctx, { team_id: 't1', username: 'bob' }, pagination);\n// after (member caller)\nawait service.listUsersForCaller(ctx, { team_id: 't1' }, pagination); // filter client-side","handlingStrategy":"validation","validationCode":"const filtersPresent = !!(input.user_ids?.length || input.username);\nif (filtersPresent && !ctx.isSystemAdmin && member?.role !== 'admin') {\n  // drop filters and filter client-side, or reject before the call\n}","typeGuard":"function mayFilter(ctx: V3AuthContext, member?: { role: string } | null): boolean {\n  return ctx.isSystemAdmin || member?.role === 'admin';\n}","tryCatchPattern":"try {\n  return await service.listUsersForCaller(ctx, input, pagination);\n} catch (e) {\n  if (e instanceof MetadataError && e.code === 'filter_not_allowed') {\n    return await service.listUsersForCaller(ctx, { team_id: input.team_id }, pagination); // unfiltered fallback\n  }\n  throw e;\n}","preventionTips":["Strip user_ids/username filters for non-admin members at the API layer","Use the unfiltered paginated list plus client-side filtering for regular members","Document that filters are admin-only in your API docs","Add integration tests covering member-with-filter rejection"],"tags":["authorization","validation","rbac"],"backgroundTag":"insufficient-permissions","analyzedSha":"3efcd317b84146d6a08518ac0f7ee7c8a8d200ec","analyzedAt":"2026-09-01T05:44:22.276Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}