Show friendly message for Zabbix API permission errors - #11
Conversation
When a user's Zabbix role has API access disabled (JSON-RPC code -32500, "No permissions to call ..."), every API call fails the same way regardless of host-group permissions. The app previously surfaced this as a raw exception dump on a blank screen (issue VitexSoftware#10). ZabbixApiException now exposes isPermissionError/friendlyMessage, and ProblemsScreen shows an actionable message with a Retry button instead of the raw error text.
📝 WalkthroughWalkthroughChangesAPI error handling
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant ProblemsScreen
participant FutureBuilder
participant ZabbixApiException
participant ErrorPanel
ProblemsScreen->>FutureBuilder: observe problems request error
FutureBuilder->>ZabbixApiException: provide snapshot.error
ProblemsScreen->>ZabbixApiException: read friendlyMessage and isPermissionError
ZabbixApiException-->>ProblemsScreen: return message and permission status
ProblemsScreen->>ErrorPanel: render message and selected icon
ErrorPanel->>ProblemsScreen: press Retry
ProblemsScreen->>ProblemsScreen: call _refreshData
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@lib/api/zabbix_api.dart`:
- Around line 263-280: Update the `friendlyMessage` getter’s `isPermissionError`
branch to explain both role-level API access restrictions and method-specific
allow/deny rules, rather than only directing users to enable API access. Add
coverage for `-32500` errors representing each case and verify both produce the
broadened guidance.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: fc426525-de73-4a46-bc02-d1ed42b3675a
📒 Files selected for processing (2)
lib/api/zabbix_api.dartlib/screens/problems_screen.dart
| /// True when Zabbix rejected the call because the authenticated user's role | ||
| /// isn't allowed to call the API at all (JSON-RPC code -32500 with a | ||
| /// "No permissions to call ..." data message). This is a role-level | ||
| /// "API access" toggle in Zabbix, not a host-group permission gap, so it | ||
| /// affects every API method for that account, not just the one that failed. | ||
| bool get isPermissionError => | ||
| code == -32500 && | ||
| (details['data']?.toString().toLowerCase().contains('no permissions') ?? false); | ||
|
|
||
| /// A message safe to show directly to end users, instead of the raw | ||
| /// JSON-RPC error payload. | ||
| String get friendlyMessage { | ||
| if (isPermissionError) { | ||
| return 'Your Zabbix account is not allowed to use the API.\n\n' | ||
| 'Ask your Zabbix administrator to enable "Enabled" under API access ' | ||
| 'for your user role (Administration → Users → Roles), then try again.'; | ||
| } | ||
| return message; |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== Files ==\n'
git ls-files 'lib/api/zabbix_api.dart' 'test' | sed -n '1,200p'
printf '\n== Outline: lib/api/zabbix_api.dart ==\n'
ast-grep outline lib/api/zabbix_api.dart --view expanded || true
printf '\n== Relevant lines in lib/api/zabbix_api.dart ==\n'
cat -n lib/api/zabbix_api.dart | sed -n '230,320p'
printf '\n== Search tests / usages for isPermissionError / friendlyMessage / No permissions ==\n'
rg -n "isPermissionError|friendlyMessage|No permissions to call|API access|API method|user role|role" lib test || trueRepository: VitexSoftware/Zabb
Length of output: 4005
🌐 Web query:
Zabbix "No permissions to call" API method denied role API access separate permissions
💡 Result:
The error "No permissions to call [method_name]" in Zabbix indicates that the user account associated with the API request does not have the necessary privileges to execute that specific API method [1][2]. In Zabbix, API access and method execution are strictly governed by User Roles [3][4]. To resolve this issue, verify and adjust the following configurations in your Zabbix web interface: 1. Check the User Role assigned to the user: Go to Users > Users, locate the user associated with your API token or login, and identify their assigned Role [4]. 2. Configure Role-based API access: Navigate to Users > User roles and open the role assigned to that user [4]. Under the API section, ensure that Access to API is enabled [3][2]. Review the API methods section. Zabbix allows you to define an Allow list or a Deny list for API methods [3]. - If you use an Allow list, ensure the specific method (e.g., host.create) is explicitly added to the list [3][2]. - If you use a Deny list, ensure the method is not listed [3]. - Wildcards are supported (e.g., host.* to allow all host-related methods) [3]. 3. Verify other permission dependencies: - User Group Permissions: Even if the API method is allowed by the Role, the user must still have appropriate read/write permissions to the specific host groups or template groups involved in the operation [1][4]. These are assigned via the user's User Group settings [4]. - User Type limitations: The User Role cannot grant permissions that exceed the underlying User Type (User, Admin, or Super admin) [4]. For example, a "User" type cannot be granted "Super admin" capabilities simply by adjusting a custom role [4]. - API Token/User association: Verify that the API token is indeed linked to the user account you intended [1]. Ensure you are not inadvertently using a different user account (e.g., a standard user instead of an administrator) [1]. If you recently upgraded Zabbix, be aware that changes in security defaults or role definitions in newer versions (such as 7.0+) may impact existing permissions [5]. Always verify that the user assigned to the API task has the required scope for the operation [4][6].
Citations:
- 1: https://www.zabbix.com/forum/zabbix-troubleshooting-and-problems/475386-no-permissions-to-call-host-create
- 2: https://blog.zabbix.com/user-roles-for-the-enterprise/12887/
- 3: https://www.zabbix.com/documentation/7.4/en/manual/web_interface/frontend_sections/users/user_roles
- 4: https://www.zabbix.com/documentation/7.4/en/manual/config/users_and_usergroups/permissions
- 5: https://support.zabbix.com/browse/ZBX-26648
- 6: https://www.zabbix.com/documentation/current/en/manual/api
Broaden the permission message
-32500 with “No permissions to call” can also mean the role blocks the requested API method, not just API access. Update the message to mention both API access and method allow/deny rules, and add coverage for both cases.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@lib/api/zabbix_api.dart` around lines 263 - 280, Update the `friendlyMessage`
getter’s `isPermissionError` branch to explain both role-level API access
restrictions and method-specific allow/deny rules, rather than only directing
users to enable API access. Add coverage for `-32500` errors representing each
case and verify both produce the broadened guidance.
2 participants
Summary
ZabbixApiExceptiondump reported in Api error #10 for the case where the Zabbix user's role has API access disabled entirely (JSON-RPC code-32500, "No permissions to call ...").ZabbixApiException(lib/api/zabbix_api.dart) now exposescode,isPermissionError, andfriendlyMessagegetters.ProblemsScreen's error branch (lib/screens/problems_screen.dart) shows an icon + actionable message + Retry button (reusing the existing_refreshData()), instead ofText('Error: ${snapshot.error}').Root cause
As detailed in the investigation on #10: this error isn't a host-group permission gap — it's the Zabbix role's "API access" toggle being off (
api.access: 0), which makes every API call fail identically for that account (host.get,problem.get, etc.). The app had no handling for this class of error at all.Test plan
flutter analyze/flutter test(not run here — no Flutter SDK available in this environment; please run in CI)Closes/relates to #10 (root-cause analysis and screenshots posted there).
Summary by CodeRabbit