wekan/wekan · error · Meteor.Error

not-authorized

not-authorized

Error message

You must be an admin.

What it means

The 'cleanupTemplateContainers' Meteor method (server/methods/cleanupTemplateContainers.js:80) throws Meteor.Error('not-authorized', 'You must be an admin.') when the caller either is not logged in (no this.userId) or is logged in but the user document lacks isAdmin. This method inspects/removes unused template container entries, an administrative maintenance operation, so it is deliberately restricted to admins. The error is the app's standard guard for admin-only server methods.

Source

Thrown at server/methods/cleanupTemplateContainers.js:80

      board,
      counts: { templateCount, listCount, swimlaneCount, cardCount },
      options: { defaultTitles: DEFAULT_TITLES },
    });
  }
  return entries;
}

Meteor.methods({
  // options: { apply: false, limit: 0 }
  async cleanupUnusedTemplateContainers(options = {}) {
    check(options, Match.Optional(Object));
    const apply = options.apply === true;
    const limit = Number.isInteger(options.limit) && options.limit > 0
      ? options.limit
      : 0;

    if (!this.userId || !(await ReactiveCache.getUser(this.userId))?.isAdmin) {
      throw new Meteor.Error('not-authorized', 'You must be an admin.');
    }

    const entries = await collectContainers(limit);
    const plan = planTemplateContainerCleanup(entries);

    if (!apply) {
      return {
        applied: false,
        scanned: entries.length,
        wouldRemove: plan.remove.length,
        kept: plan.keep.length,
        // A sample rather than thirteen thousand rows, and the reasons the kept
        // ones were kept - which is what tells an admin the rule is doing what
        // they think it is.
        removeSample: plan.remove.slice(0, 25),
        keepSample: plan.keep.slice(0, 25),
      };
    }

View on GitHub (pinned to eb1433158b)

Solutions

1. Log in as a user with isAdmin true in the users collection before invoking the method.
2. Promote the current user: in the mongo shell run db.users.updateOne({username:'<name>'},{$set:{isAdmin:true}}) (or use the WeKan Admin Panel) then re-login.
3. Ensure the client call is made over an authenticated DDP/REST session (this.userId present), not an anonymous connection.
4. If the intent is a dry run, note that even non-apply (dry-run) calls still require admin; wrap script calls in an admin login flow.

Example fix

// before
call('cleanupUnusedTemplateContainers', { apply: true });
// after
const me = await ReactiveCache.getUser(Meteor.userId());
if (me?.isAdmin) {
  await call('cleanupUnusedTemplateContainers', { apply: true });
} else {
  throw new Error('Admin account required for template container cleanup');
}

const me = await ReactiveCache.getUser(Meteor.userId());
if (!me?.isAdmin) {
  throw new Error('Admin privileges required for template container cleanup');
}
// safe to call: Meteor.call('cleanupUnusedTemplateContainers', { apply: true })

function isAdminUser(u) {
  return !!u && typeof u === 'object' && u.isAdmin === true;
}

try {
  await call('cleanupUnusedTemplateContainers', options);
} catch (e) {
  if (e instanceof Meteor.Error && e.error === 'not-authorized') {
    // route to admin login / show permission UI
  } else throw e;
}

When it happens

Trigger: Calling Meteor.call('cleanupUnusedTemplateContainers', options) from a client session with no authenticated user, or from a logged-in user whose Users document has isAdmin !== true. Also produced by REST/scripted calls that hit the public method with a non-admin account token.

Common situations: A developer tests the cleanup routine while logged in as a normal user; an ops script runs against the server without admin credentials; isAdmin was set via a direct DB edit that did not take effect (wrong field name or user cached), so the guard still fails.

Related errors

• error-notAuthorized
• not-authorized
• error-invalid-user
• error-not-authorized
• error-invalid-user

AI-assisted analysis of wekan/wekan@eb1433158b (2026-09-01). Data as JSON: /api/errors/888017246b2b88c3. Report an issue: GitHub.