{"record":{"id":"fe4eace8654df0c6","repo":"onetimesecret/onetimesecret","slug":"requires-admin-role","errorCode":null,"errorMessage":"Requires admin role","messagePattern":"Requires admin role","errorType":"http","errorClass":"Onetime::Forbidden","httpStatus":403,"severity":"error","filePath":"lib/onetime/application/authorization_policies.rb","lineNumber":163,"sourceCode":"      #\n      # @example Must be colonel AND pass custom check\n      #   verify_all_roles!(\n      #     colonel: true,\n      #     custom_check: -> { @organization.owner?(cust) },\n      #     error_key: 'api.organizations.errors.colonel_owner_required',\n      #   )\n      def verify_all_roles!(colonel: false, admin: false, custom_check: nil,\n                            error_message: nil, error_key: nil, args: {})\n        # Check colonel if required\n        if colonel && !has_system_role?('colonel')\n          message = error_message || 'Requires colonel role'\n          raise Onetime::Forbidden.new(message, error_key: error_key, args: args)\n        end\n\n        # Check admin if required\n        if admin && !has_system_role?('admin')\n          message = error_message || 'Requires admin role'\n          raise Onetime::Forbidden.new(message, error_key: error_key, args: args)\n        end\n\n        # Check custom condition if specified\n        if custom_check && !custom_check.call\n          message = error_message || 'Insufficient permissions'\n          raise Onetime::Forbidden.new(message, error_key: error_key, args: args)\n        end\n\n        true\n      end\n\n      # Verify current user owns the organization\n      #\n      # DEPRECATED (ADR-012 Stage 3): Use require_entitlement! with an owner-level\n      # entitlement (e.g., 'manage_org', 'manage_sso') instead. Role predicates\n      # like owner? remain for display logic; authorization should use entitlements.\n      #\n      # Colonels (site admins) have automatic superuser bypass.","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/onetimesecret/onetimesecret/blob/f81295e41bc3e808a3dd2cbea03ef65401a662e4/lib/onetime/application/authorization_policies.rb#L145-L181","documentation":"Error \"Requires admin role\" thrown in onetimesecret/onetimesecret.","triggerScenarios":"Thrown at lib/onetime/application/authorization_policies.rb:163 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an account with the admin role, or have an administrator grant admin access to the current account."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"f81295e41bc3e808a3dd2cbea03ef65401a662e4","analyzedAt":"2026-08-23T21:13:10.635Z","schemaVersion":2},"datasetVersion":"2026-08-24T02:17:37.098Z"}