{"record":{"id":"56db436af803e97e","repo":"AlistGo/alist","slug":"permission-denied","errorCode":null,"errorMessage":"permission denied","messagePattern":"permission denied","errorType":"exception","errorClass":"PermissionDenied","httpStatus":null,"severity":"error","filePath":"internal/errs/operate.go","lineNumber":6,"sourceCode":"package errs\n\nimport \"errors\"\n\nvar (\n\tPermissionDenied = errors.New(\"permission denied\")\n\tInvalidName      = errors.New(\"invalid file name\")\n)\n","sourceCodeStart":1,"sourceCodeEnd":9,"githubUrl":"https://github.com/AlistGo/alist/blob/843d9dc8149126976b2625911e45a4d3ffd6f2f5/internal/errs/operate.go#L1-L9","documentation":"PermissionDenied is a sentinel in internal/errs/operate.go representing refusal of a filesystem operation because the authenticated user lacks the required permission. The op/permission layer (and guest restrictions) raise it when the user's role/path permissions do not grant the requested access.","triggerScenarios":"A guest or limited user attempting write operations (mkdir, rename, delete, upload) on paths outside their permitted base path or without the write permission bit; FTP/WebDAV users issuing modifying commands on read-only shares; admin-only operations invoked by non-admin tokens.","commonSituations":"Default guest account (read-only) being used for uploads; permissions not granted for the specific path after mounting a new storage; reverse proxy stripping auth so requests resolve to guest; user role changed but the client caches an old session.","solutions":["Grant the user (or their role) the needed permission for that path in the admin permission settings","Verify the request is authenticated as the intended user (token present, not falling back to guest)","Sign out and back in / refresh the token after permission changes","For FTP/WebDAV, confirm the same user context is used as in the web UI"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// confirm effective user/permission before write ops\nu, _ := ctx.Value(\"user\").(*model.User)\nif u == nil || !u.CanWrite(path) { // per your permission helper\n    return errs.PermissionDenied\n}","typeGuard":"func isPermissionDenied(err error) bool {\n    return err != nil && errors.Is(errors.Cause(err), errs.PermissionDenied)\n}","tryCatchPattern":"if err := fs.Put(ctx, dst, r, up); err != nil {\n    if isPermissionDenied(err) { /* 403: stop, do not retry */ }\n}","preventionTips":["Grant explicit path permissions to non-admin roles","Verify token presence so requests do not degrade to guest","Refresh sessions after permission changes","Return 403 for this sentinel; never retry"],"tags":["auth","permission","filesystem"],"backgroundTag":null,"analyzedSha":"843d9dc8149126976b2625911e45a4d3ffd6f2f5","analyzedAt":"2026-08-15T12:14:11.722Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}