gitroomhq/postiz-app · error · HttpException

Unauthorized

Error message

Unauthorized

What it means

GET /billing/charges returns Stripe charges for the current organization but is gated to super admins (instance operators), not org members. Non-super-admin users receive HttpException('Unauthorized', 400).

Source

Thrown at apps/backend/src/api/routes/billing.controller.ts:162

    return this._stripeService.setToCancel(org.id);
  }

  @Post('/prorate')
  prorate(
    @GetOrgFromRequest() org: Organization,
    @Body() body: BillingSubscribeDto
  ) {
    return this._stripeService.prorate(org.id, body);
  }

  @Get('/charges')
  async getCharges(
    @GetUserFromRequest() user: User,
    @GetOrgFromRequest() org: Organization
  ) {
    if (!user.isSuperAdmin) {
      throw new HttpException('Unauthorized', 400);
    }

    return this._stripeService.getCharges(org.id);
  }

  @Post('/refund-charges')
  async refundCharges(
    @GetUserFromRequest() user: User,
    @GetOrgFromRequest() org: Organization,
    @Body() body: { chargeIds: string[] }
  ) {
    if (!user.isSuperAdmin) {
      throw new HttpException('Unauthorized', 400);
    }

    return this._stripeService.refundCharges(org.id, body.chargeIds);
  }

View on GitHub (pinned to 0f1647f749)

Solutions

1. Authenticate as the instance super admin before calling this endpoint
2. If you need org-level billing history as a normal user, use the user-facing billing endpoints instead of /billing/charges
3. Verify isSuperAdmin on your User record

const user = await getMe();
if (user.isSuperAdmin) await fetchCharges(orgId);

const canViewCharges = (u: User) => u.isSuperAdmin === true;

try { await getCharges(); } catch (e) { if (unauthorized(e)) redirect('/settings/billing'); else throw e; }

When it happens

Trigger: A regular org user or org admin hitting GET /billing/charges for their organization; only the platform super admin may view raw Stripe charges.

Common situations: Building custom billing UI on a self-hosted instance and assuming org admins can list charges; using a normal user's API token.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unauthorized
• Unauthorized
• Subscription required: section ${item[1]}, action ${item[0]}
• Invalid redirect_uri
• code_challenge is required for this client

AI-assisted analysis of gitroomhq/postiz-app@0f1647f749 (2026-08-27). Data as JSON: /api/errors/9a2e5aca9ba71364. Report an issue: GitHub.