onetimesecret/onetimesecret · error · Onetime::Forbidden

Requires #{conditions.join(', ')} or #{last}

Error message

Requires #{conditions.join(', ')} or #{last}

What it means

Error "Requires #{conditions.join(', ')} or #{last}" thrown in onetimesecret/onetimesecret.

Source

Thrown at lib/onetime/application/authorization_policies.rb:130

      def verify_one_of_roles!(colonel: false, admin: false, custom_check: nil,
                               error_message: nil, error_key: nil, args: {})
        # Check colonel (superuser)
        return true if colonel && has_system_role?('colonel')

        # Check admin (includes colonel via has_system_role?)
        return true if admin && has_system_role?('admin')

        # Check custom condition
        return true if custom_check&.call

        # All checks failed
        message = error_message || build_authorization_error_message(
          colonel: colonel,
          admin: admin,
          has_custom: !custom_check.nil?,
        )

        raise Onetime::Forbidden.new(message, error_key: error_key, args: args)
      end

      # Verify user has ALL of the specified roles/permissions
      #
      # Supports multi-condition authorization with AND logic.
      # Must pass ALL checks (colonel AND admin AND custom).
      #
      # @param colonel [Boolean] Require colonel (superuser) role
      # @param admin [Boolean] Require admin role
      # @param custom_check [Proc, nil] Custom authorization check (must return true)
      # @param error_message [String, nil] Override default error message (legacy)
      # @param error_key [String, nil] i18n key for the Forbidden message
      # @param args [Hash] Interpolation args for the i18n key
      # @raise [Onetime::Forbidden] If any condition fails
      #
      # @example Must be colonel AND pass custom check
      #   verify_all_roles!(
      #     colonel: true,

View on GitHub (pinned to f81295e41b)

Solutions

1. Sign in with an account that has one of the listed roles/permissions, or have an administrator grant one of them.

When it happens

Trigger: Thrown at lib/onetime/application/authorization_policies.rb:130 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of onetimesecret/onetimesecret@f81295e41b (2026-08-23). Data as JSON: /api/errors/3d749bf37ea710e9. Report an issue: GitHub.