{"record":{"id":"55a4f0dd0d4f631a","repo":"phacility/phabricator","slug":"you-do-not-have-permission-to-push-to-this-reposit","errorCode":null,"errorMessage":"You do not have permission to push to this repository.","messagePattern":"You do not have permission to push to this repository\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/diffusion/ssh/DiffusionSSHWorkflow.php","lineNumber":283,"sourceCode":"      throw new Exception(\n        pht(\n          'This request is authenticated as a cluster device, but is '.\n          'performing a write. Writes must be performed with a real '.\n          'user account.'));\n    }\n\n    if ($repository->isReadOnly()) {\n      throw new Exception($repository->getReadOnlyMessageForDisplay());\n    }\n\n    $protocol = PhabricatorRepositoryURI::BUILTIN_PROTOCOL_SSH;\n    if ($repository->canServeProtocol($protocol, true)) {\n      $can_push = PhabricatorPolicyFilter::hasCapability(\n        $viewer,\n        $repository,\n        DiffusionPushCapability::CAPABILITY);\n      if (!$can_push) {\n        throw new Exception(\n          pht('You do not have permission to push to this repository.'));\n      }\n    } else {\n      if ($protocol_command !== null) {\n        throw new Exception(\n          pht(\n            'This repository is read-only over SSH (tried to execute '.\n            'protocol command \"%s\").',\n            $protocol_command));\n      } else {\n        throw new Exception(\n          pht('This repository is read-only over SSH.'));\n      }\n    }\n\n    $this->hasWriteAccess = true;\n    return $this->hasWriteAccess;\n  }","sourceCodeStart":265,"sourceCodeEnd":301,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/diffusion/ssh/DiffusionSSHWorkflow.php#L265-L301","documentation":"Policy denial from requireWriteAccess(): PhabricatorPolicyFilter::hasCapability() returned false for DiffusionPushCapability, so the SSH-authenticated viewer does not satisfy the repository's Push policy. The check only runs after the read-only and protocol checks pass, so at this point the repository is writable over SSH but not by this user.","triggerScenarios":"git push / hg push / svn commit over SSH by a user whose account is not allowed by the repository's Push policy (e.g. policy is 'Project Members' and the viewer is not a member), or whose SSH key authenticates as a different, unprivileged account.","commonSituations":"New developers not added to the pushing project; pushes using a service account that lost access; push policy tightened from 'All Users' to a restricted policy during a lockdown.","solutions":["Ask a repository editor to widen the Push policy (Repository -> Edit Policies -> Push) or add the user to the project/group it names","Verify which account the SSH key maps to (ssh user@host whoami) - a key attached to the wrong account is a common cause","As admin, review the effective policy on the repository's Manage page and test it for the affected user"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"$can_push = PhabricatorPolicyFilter::hasCapability(\n  $viewer,\n  $repository,\n  DiffusionPushCapability::CAPABILITY);\nif (!$can_push) {\n  // deny early with a policy explanation\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pre-check hasCapability() before spawning protocol subprocesses to fail fast","Keep push policies project-based so access management happens in one place"],"tags":["phabricator","diffusion","ssh","push","policy","authorization"],"backgroundTag":"push-permission-denied","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}