HKUDS/DeepTutor · error · HTTPException

You cannot manage this partner

Error message

You cannot manage this partner

What it means

HTTP 403 from assert_partner_manageable: can_manage_partner(partner_id) returned False, meaning the current user (non-admin, non-owner) tried to configure a partner. Deliberately the same 403 as usage denial so ownership is not leaked.

Source

Thrown at deeptutor/multi_user/partner_access.py:101

    A no-op for admins, for the partner's owner, and for single-user
    deployments (where the current user resolves to the local admin).
    """
    user = get_current_user()
    if can_manage_partner(partner_id, user):
        return
    if str(partner_id or "").strip() in assigned_partner_ids(user_id or user.id):
        return
    raise HTTPException(status_code=403, detail="Partner is not assigned to you")


def assert_partner_manageable(partner_id: str) -> None:
    """Raise 403 unless the current user may configure *partner_id*.

    Deliberately the same 403 an unassigned partner gets: someone who may only
    talk to a partner learns nothing new about who owns it.
    """
    if not can_manage_partner(partner_id):
        raise HTTPException(status_code=403, detail="You cannot manage this partner")


# Identity-only card fields a consumer needs (partner list page, connect modal).
# Deliberately excludes channels / llm_selection / tool config so a user who was
# merely *assigned* a partner sees its face, never its wiring.
_CARD_FIELDS = (
    "partner_id",
    "name",
    "description",
    "emoji",
    "color",
    "avatar",
    "language",
    "running",
)


def identity_card(partner: dict[str, Any]) -> dict[str, Any]:

View on GitHub (pinned to 3e82f13042)

Solutions

1. Have the partner owner or an admin make the configuration change
2. Check is_admin / ownership before showing manage controls in the UI
3. Use read-only card fields (_CARD_FIELDS) for assigned users

Example fix

// before
assert_partner_manageable("partner-123")  # 403 for assigned-only user

// after
from deeptutor.multi_user.partner_access import can_manage_partner
if not can_manage_partner("partner-123"):
    raise HTTPException(403, "Ask the owner to update this partner")
assert_partner_manageable("partner-123")

from deeptutor.multi_user.partner_access import can_manage_partner
if not can_manage_partner(pid):
    raise NotOwner(pid)  # hide manage UI for this partner

def can_configure(pid: str) -> bool:
    return can_manage_partner(pid)

try:
    assert_partner_manageable(pid)
except HTTPException as e:
    if e.status_code == 403:
        raise ManageForbidden(pid) from e

When it happens

Trigger: Calling partner configuration endpoints (edit channels, llm_selection, tool config) for a partner the user was merely assigned to or that someone else owns; non-admin attempting partner CRUD on another user's partner.

Common situations: Assigned users trying to tweak wiring of a shared partner; UI showing manage controls to non-owners.

Related errors

• Partner is not assigned to you
• Access denied
• This model is not assigned to your account.

AI-assisted analysis of HKUDS/DeepTutor@3e82f13042 (2026-08-27). Data as JSON: /api/errors/3e74a53b83989e7b. Report an issue: GitHub.