gitroomhq/postiz-app · error · HttpException

Unauthorized

Error message

Unauthorized

What it means

The announcements controller rejects POST /announcements when the requesting user is not a super admin. Announcement banners are a global, instance-wide feature, so only super admins may create them. The check is an inline isSuperAdmin guard throwing HttpException 400 with 'Unauthorized'.

Source

Thrown at apps/backend/src/api/routes/announcements.controller.ts:32

import { AnnouncementDto } from '@gitroom/nestjs-libraries/dtos/announcements/announcements.dto';

@ApiTags('Announcements')
@Controller('/announcements')
export class AnnouncementsController {
  constructor(private _announcementsService: AnnouncementsService) {}

  @Get('/')
  async getAnnouncements() {
    return this._announcementsService.getAnnouncements();
  }

  @Post('/')
  async createAnnouncement(
    @GetUserFromRequest() user: User,
    @Body() body: AnnouncementDto
  ) {
    if (!user.isSuperAdmin) {
      throw new HttpException('Unauthorized', 400);
    }
    return this._announcementsService.createAnnouncement(body);
  }

  @Delete('/:id')
  async deleteAnnouncement(
    @GetUserFromRequest() user: User,
    @Param('id') id: string
  ) {
    if (!user.isSuperAdmin) {
      throw new HttpException('Unauthorized', 400);
    }
    return this._announcementsService.deleteAnnouncement(id);
  }
}

View on GitHub (pinned to 0f1647f749)

Solutions

1. Confirm your user has isSuperAdmin=true in the database and use that account
2. On self-hosted, promote your account (set isSuperAdmin on the User row or use the IS_SUPER_ADMIN env at signup)
3. Use an account/token that belongs to the instance owner

if (!(await current_user()).isSuperAdmin) { alert('Only super admins can post announcements'); return; }

const canManageAnnouncements = (u: User) => u.isSuperAdmin === true;

try { await createAnnouncement(dto); } catch (e) { if (String(e).includes('Unauthorized')) showForbidden(); else throw e; }

When it happens

Trigger: POST /announcement with a session belonging to a non-super-admin user. Typical when a regular org admin or team member tries to create an announcement via API or a modified frontend.

Common situations: Self-hosted instance where the operator assumed org admins could post announcements; scripting the API with a token from a normal user account.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unauthorized
• Unauthorized
• Subscription required: section ${item[1]}, action ${item[0]}
• Invalid redirect_uri
• code_challenge is required for this client

AI-assisted analysis of gitroomhq/postiz-app@0f1647f749 (2026-08-27). Data as JSON: /api/errors/f7a51a00c16b194b. Report an issue: GitHub.