{"record":{"id":"f7a51a00c16b194b","repo":"gitroomhq/postiz-app","slug":"unauthorized-f7a51a","errorCode":null,"errorMessage":"Unauthorized","messagePattern":"Unauthorized","errorType":"http","errorClass":"HttpException","httpStatus":400,"severity":"error","filePath":"apps/backend/src/api/routes/announcements.controller.ts","lineNumber":32,"sourceCode":"import { AnnouncementDto } from '@gitroom/nestjs-libraries/dtos/announcements/announcements.dto';\n\n@ApiTags('Announcements')\n@Controller('/announcements')\nexport class AnnouncementsController {\n  constructor(private _announcementsService: AnnouncementsService) {}\n\n  @Get('/')\n  async getAnnouncements() {\n    return this._announcementsService.getAnnouncements();\n  }\n\n  @Post('/')\n  async createAnnouncement(\n    @GetUserFromRequest() user: User,\n    @Body() body: AnnouncementDto\n  ) {\n    if (!user.isSuperAdmin) {\n      throw new HttpException('Unauthorized', 400);\n    }\n    return this._announcementsService.createAnnouncement(body);\n  }\n\n  @Delete('/:id')\n  async deleteAnnouncement(\n    @GetUserFromRequest() user: User,\n    @Param('id') id: string\n  ) {\n    if (!user.isSuperAdmin) {\n      throw new HttpException('Unauthorized', 400);\n    }\n    return this._announcementsService.deleteAnnouncement(id);\n  }\n}\n","sourceCodeStart":14,"sourceCodeEnd":48,"githubUrl":"https://github.com/gitroomhq/postiz-app/blob/0f1647f7491a217d43eb5ae7a480484bdf0aff3e/apps/backend/src/api/routes/announcements.controller.ts#L14-L48","documentation":"The announcements controller rejects POST /announcements when the requesting user is not a super admin. Announcement banners are a global, instance-wide feature, so only super admins may create them. The check is an inline isSuperAdmin guard throwing HttpException 400 with 'Unauthorized'.","triggerScenarios":"POST /announcement with a session belonging to a non-super-admin user. Typical when a regular org admin or team member tries to create an announcement via API or a modified frontend.","commonSituations":"Self-hosted instance where the operator assumed org admins could post announcements; scripting the API with a token from a normal user account.","solutions":["Confirm your user has isSuperAdmin=true in the database and use that account","On self-hosted, promote your account (set isSuperAdmin on the User row or use the IS_SUPER_ADMIN env at signup)","Use an account/token that belongs to the instance owner"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"if (!(await current_user()).isSuperAdmin) { alert('Only super admins can post announcements'); return; }","typeGuard":"const canManageAnnouncements = (u: User) => u.isSuperAdmin === true;","tryCatchPattern":"try { await createAnnouncement(dto); } catch (e) { if (String(e).includes('Unauthorized')) showForbidden(); else throw e; }","preventionTips":["Hide announcement create/delete controls for non-admin users","Server-side, keep super-admin checks in a shared guard/decorator for consistency"],"tags":["authorization","super-admin","announcements"],"backgroundTag":"authorization-denied","analyzedSha":"0f1647f7491a217d43eb5ae7a480484bdf0aff3e","analyzedAt":"2026-08-27T12:09:55.020Z","schemaVersion":2},"datasetVersion":"2026-08-27T13:17:12.746Z"}