AlistGo/alist · error · PermissionDenied

permission denied

Error message

permission denied

What it means

PermissionDenied is a sentinel in internal/errs/operate.go representing refusal of a filesystem operation because the authenticated user lacks the required permission. The op/permission layer (and guest restrictions) raise it when the user's role/path permissions do not grant the requested access.

Source

Thrown at internal/errs/operate.go:6

package errs

import "errors"

var (
	PermissionDenied = errors.New("permission denied")
	InvalidName      = errors.New("invalid file name")
)

View on GitHub (pinned to 843d9dc814)

Solutions

1. Grant the user (or their role) the needed permission for that path in the admin permission settings
2. Verify the request is authenticated as the intended user (token present, not falling back to guest)
3. Sign out and back in / refresh the token after permission changes
4. For FTP/WebDAV, confirm the same user context is used as in the web UI

// confirm effective user/permission before write ops
u, _ := ctx.Value("user").(*model.User)
if u == nil || !u.CanWrite(path) { // per your permission helper
    return errs.PermissionDenied
}

func isPermissionDenied(err error) bool {
    return err != nil && errors.Is(errors.Cause(err), errs.PermissionDenied)
}

if err := fs.Put(ctx, dst, r, up); err != nil {
    if isPermissionDenied(err) { /* 403: stop, do not retry */ }
}

When it happens

Trigger: A guest or limited user attempting write operations (mkdir, rename, delete, upload) on paths outside their permitted base path or without the write permission bit; FTP/WebDAV users issuing modifying commands on read-only shares; admin-only operations invoked by non-admin tokens.

Common situations: Default guest account (read-only) being used for uploads; permissions not granted for the specific path after mounting a new storage; reverse proxy stripping auth so requests resolve to guest; user role changed but the client caches an old session.

Related errors

• oss: chunkNum invalid
• clientID and clientSecret are required in client_credentials
• share_ids is required
• failed to refresh token: refresh token is empty
• failed to refresh token: sub not match

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/56db436af803e97e. Report an issue: GitHub.