{"record":{"id":"409484d02d9e01f2","repo":"forem/forem","slug":"only-the-session-owner-can-embed-this-session","errorCode":null,"errorMessage":"Only the session owner can embed this session","messagePattern":"Only the session owner can embed this session","errorType":"exception","errorClass":"StandardError","httpStatus":null,"severity":"error","filePath":"app/liquid_tags/agent_session_tag.rb","lineNumber":89,"sourceCode":"      partial: PARTIAL,\n      locals: { agent_session: @agent_session, message_range: @range, slice_name: @slice_name },\n    )\n  end\n\n  private\n\n  def find_session(id_or_slug)\n    session = if id_or_slug.match?(/\\A\\d+\\z/)\n                AgentSession.find_by(id: id_or_slug)\n              else\n                AgentSession.find_by(slug: id_or_slug)\n              end\n    unless session\n      raise StandardError,\n            I18n.t(\"liquid_tags.agent_session_tag.not_found\", default: \"Agent session not found\")\n    end\n    unless session.published? || (@embedding_user && @embedding_user.id == session.user_id)\n      raise StandardError,\n            I18n.t(\"liquid_tags.agent_session_tag.unpublished\",\n                   default: \"Only the session owner can embed this session\")\n    end\n\n    session\n  end\nend\n\nLiquid::Template.register_tag(\"agent_session\", AgentSessionTag)\n","sourceCodeStart":71,"sourceCodeEnd":99,"githubUrl":"https://github.com/forem/forem/blob/f354c376a7c5d1330dc40d66f150be8d1289020d/app/liquid_tags/agent_session_tag.rb#L71-L99","documentation":"StandardError raised by AgentSessionTag#find_session when the referenced AgentSession exists but is not published and the embedding context is not the session's owner (@embedding_user nil or a different user). Owner-only visibility applies only to unpublished sessions; published ones embed anywhere.","triggerScenarios":"Embedding {% agent_session 42 %} while session 42 has published? == false (e.g. status 'draft') from an article whose author differs from the session's user_id; also embedding an unpublished session in system context where @embedding_user was never set.","commonSituations":"Collaborator embeds a teammate's draft session; author pastes the tag into a different account's article; session flipped back to draft after publication; tests rendering the tag without assigning @embedding_user.","solutions":["Publish the AgentSession first (session.update!(published: true) or the publishing UI), then embed.","Embed unpublished sessions only from content authored by the session owner.","If embedding programmatically, ensure the tag receives the embedding user context (@embedding_user) matching session.user_id.","Otherwise swap the reference to a published session."],"exampleFix":"# before\nsession.update!(published: false)\nUserArticle.create!(body: \"{% agent_session #{session.id} %}\", user: other_user)\n\n# after\nsession.update!(published: true)\nUserArticle.create!(body: \"{% agent_session #{session.id} %}\", user: other_user)","handlingStrategy":"validation","validationCode":"session = AgentSession.find_by(id: ref) || AgentSession.find_by(slug: ref)\nembeddable = session&.published? || session&.user_id == current_user&.id","typeGuard":null,"tryCatchPattern":"begin\n  Liquid::Template.parse(body)\nrescue StandardError => e\n  prompt_publish_session if e.message.include?('session owner')\nend","preventionTips":["Publish sessions before embedding them in other authors' content.","Pass @embedding_user when rendering tags programmatically so ownership checks can pass legitimately.","Re-embed or remove tags when a session's published state changes."],"tags":["liquid","agent-session","permissions","unpublished","forem"],"backgroundTag":"authorization-denied","analyzedSha":"f354c376a7c5d1330dc40d66f150be8d1289020d","analyzedAt":"2026-08-21T12:43:44.428Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}