{"record":{"id":"227fbb681126cf95","repo":"invoke-ai/InvokeAI","slug":"queue-user-is-not-authorized-to-access-this-image","errorCode":null,"errorMessage":"Queue user is not authorized to access this image","messagePattern":"Queue user is not authorized to access this image","errorType":"exception","errorClass":"PermissionError","httpStatus":null,"severity":"error","filePath":"invokeai/app/services/shared/invocation_context.py","lineNumber":182,"sourceCode":"        \"\"\"\n        self._services.logger.error(message)\n\n\nclass ImagesInterface(InvocationContextInterface):\n    def __init__(self, services: InvocationServices, data: InvocationContextData, util: \"UtilInterface\") -> None:\n        super().__init__(services, data)\n        self._util = util\n\n    def _assert_read_access(self, image_name: str) -> None:\n        if not self._services.configuration.multiuser:\n            return\n        user_id = self._data.queue_item.user_id\n        user = self._services.users.get(user_id)\n        # A deactivated or deleted account keeps no queue-time privileges: its\n        # queued graphs must not read media even if the item slipped past the\n        # processor's owner checks.\n        if user is None or not user.is_active:\n            raise PermissionError(\"Queue user is not authorized to access this image\")\n        if user.is_admin or self._services.image_records.get_user_id(image_name) == user_id:\n            return\n        board_id = self._services.board_image_records.get_board_for_image(image_name)\n        if board_id is not None:\n            board = self._services.boards.get_dto(board_id)\n            if board.board_visibility in (BoardVisibility.Shared, BoardVisibility.Public):\n                return\n        raise PermissionError(\"Queue user is not authorized to access this image\")\n\n    def save(\n        self,\n        image: Image,\n        board_id: Optional[str] = None,\n        image_category: ImageCategory = ImageCategory.GENERAL,\n        metadata: Optional[MetadataField] = None,\n    ) -> ImageDTO:\n        \"\"\"Saves an image, returning its DTO.\n","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/services/shared/invocation_context.py#L164-L200","documentation":"ImagesInterface._assert_read_access throws PermissionError when the queue item's user cannot read the given image. In multiuser mode a deactivated or deleted user account retains no queue-time privileges, and non-owner/non-admin users may only read images they own or that sit on a Shared/Public board.","triggerScenarios":"Invocation code calling images.get_pil/get_metadata/get_dto/get_path for an image while (a) the queue item's user_id resolves to a None or inactive user, or (b) the user is not admin, does not own the image, and the image is not on a Shared/Public board.","commonSituations":"An admin deactivates a user while their queue items are still processing; a workflow loads another user's image outputs; images left on private boards being read by shared workflows.","solutions":["Ensure the queue-time user account exists and is active (reactivate it or reassign queue items)","Have the image placed on a Shared or Public board so the queue user can read it","Run the workflow as an admin user or the image owner","Catch PermissionError in the invocation and substitute a fallback image or fail gracefully"],"exampleFix":"# before: reading another user's private image\npil = context.images.get_pil(other_users_image_name)\n# after: guard access first\nuser = services.users.get(context.queue_item.user_id)\nif user and user.is_active and services.image_records.get_user_id(name) == user.id:\n    pil = context.images.get_pil(name)","handlingStrategy":"try-catch","validationCode":"user = services.users.get(context._data.queue_item.user_id)\nowner = services.image_records.get_user_id(image_name)\nboard_id = services.board_image_records.get_board_for_image(image_name)\nassert user and user.is_active, \"queue user deactivated\"\nassert user.is_admin or owner == user.id or (board_id and services.boards.get_dto(board_id).board_visibility in (BoardVisibility.Shared, BoardVisibility.Public)), \"no read access\"","typeGuard":"def can_read_image(services, queue_item, image_name: str) -> bool:\n    user = services.users.get(queue_item.user_id)\n    if not user or not user.is_active:\n        return False\n    if user.is_admin or services.image_records.get_user_id(image_name) == user.id:\n        return True\n    board_id = services.board_image_records.get_board_for_image(image_name)\n    return bool(board_id) and services.boards.get_dto(board_id).board_visibility in (BoardVisibility.Shared, BoardVisibility.Public)","tryCatchPattern":"try:\n    pil = context.images.get_pil(image_name)\nexcept PermissionError:\n    pil = None  # fallback / fail node gracefully","preventionTips":["Deactivate accounts only after purging their queue items","Put images needed by shared workflows on Shared/Public boards","Run shared workflows under the resource owner or admin","Check user.is_active before long-running batches"],"tags":["permissions","multiuser","invokeai","image-access"],"backgroundTag":"permission-denied","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}