onetimesecret/onetimesecret · error · Onetime::Forbidden

Requires admin role

Error message

Requires admin role

What it means

Error "Requires admin role" thrown in onetimesecret/onetimesecret.

Source

Thrown at lib/onetime/application/authorization_policies.rb:163

      #
      # @example Must be colonel AND pass custom check
      #   verify_all_roles!(
      #     colonel: true,
      #     custom_check: -> { @organization.owner?(cust) },
      #     error_key: 'api.organizations.errors.colonel_owner_required',
      #   )
      def verify_all_roles!(colonel: false, admin: false, custom_check: nil,
                            error_message: nil, error_key: nil, args: {})
        # Check colonel if required
        if colonel && !has_system_role?('colonel')
          message = error_message || 'Requires colonel role'
          raise Onetime::Forbidden.new(message, error_key: error_key, args: args)
        end

        # Check admin if required
        if admin && !has_system_role?('admin')
          message = error_message || 'Requires admin role'
          raise Onetime::Forbidden.new(message, error_key: error_key, args: args)
        end

        # Check custom condition if specified
        if custom_check && !custom_check.call
          message = error_message || 'Insufficient permissions'
          raise Onetime::Forbidden.new(message, error_key: error_key, args: args)
        end

        true
      end

      # Verify current user owns the organization
      #
      # DEPRECATED (ADR-012 Stage 3): Use require_entitlement! with an owner-level
      # entitlement (e.g., 'manage_org', 'manage_sso') instead. Role predicates
      # like owner? remain for display logic; authorization should use entitlements.
      #
      # Colonels (site admins) have automatic superuser bypass.

View on GitHub (pinned to f81295e41b)

Solutions

1. Use an account with the admin role, or have an administrator grant admin access to the current account.

When it happens

Trigger: Thrown at lib/onetime/application/authorization_policies.rb:163 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of onetimesecret/onetimesecret@f81295e41b (2026-08-23). Data as JSON: /api/errors/fe4eace8654df0c6. Report an issue: GitHub.