{"record":{"id":"57501be947fe2eb4","repo":"Mintplex-Labs/anything-llm","slug":"file-not-found-or-access-denied","errorCode":null,"errorMessage":"File not found or access denied","messagePattern":"File not found or access denied","errorType":"http","errorClass":null,"httpStatus":404,"severity":"warning","filePath":"server/endpoints/agentFileServer.js","lineNumber":54,"sourceCode":"        if (!filename)\n          return response.status(400).json({ error: \"Filename is required\" });\n\n        // Validate filename format\n        const parsed = createFilesLib.parseFilename(filename);\n        if (!parsed) {\n          return response\n            .status(400)\n            .json({ error: \"Invalid filename format\" });\n        }\n\n        // Find a chat or scheduled job run that references this file\n        const fileSource = await findFileSource(filename, {\n          user,\n          isMultiUser: multiUserMode(response),\n        });\n\n        if (!fileSource) {\n          return response.status(404).json({\n            error: \"File not found or access denied\",\n          });\n        }\n\n        // Retrieve the file from storage\n        const fileData = await createFilesLib.getGeneratedFile(filename);\n        if (!fileData) {\n          return response\n            .status(404)\n            .json({ error: \"File not found in storage\" });\n        }\n\n        // Get mime type and set headers for download\n        const mimeType = createFilesLib.getMimeType(`.${parsed.extension}`);\n        const safeFilename = createFilesLib.sanitizeFilenameForHeader(\n          fileSource.displayFilename || filename\n        );\n        response.setHeader(\"Content-Type\", mimeType);","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/3aec848f2885144aa8f1e53b9731a04310d5d558/server/endpoints/agentFileServer.js#L36-L72","documentation":"Returned (HTTP 404) by GET /agent-skills/generated-files/:filename when findFileSource(filename, {user, isMultiUser}) returns null. findFileSource searches (1) workspace chats the requesting user can access under multi-user permissions, then (2) scheduled job runs (single-user mode only). Null means no accessible record references the file — it does not exist in any chat/job, or the current user lacks permission. The 404 deliberately conflates 'missing' and 'denied' to avoid leaking which files exist.","triggerScenarios":"In multi-user mode, requesting a file generated inside another user's workspace chat; using a filename from a different instance (frontend pointing at a backend with another database); the chat that referenced the file was deleted; the session resolves to a different/anonymous user than the one who generated it.","commonSituations":"Sharing artifact URLs between users (denied by design in multi-user mode); split frontend/backend environments with divergent data; stale links after workspace cleanup; login state confusion where the browser session belongs to a lesser-privileged account.","solutions":["Log in as the user who owns/participates in the chat that generated the file and copy the link from that chat","Confirm your frontend talks to the same instance (same DB and storage) that generated the file","Regenerate the artifact from a chat your user can access","Operators: verify the workspace_chats / job-run records actually reference the filename before assuming a bug"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before sharing a link, confirm the current session can see its source chat\nconst me = await currentUser();\nif (artifact.chatId && !me.accessibleChatIds.includes(artifact.chatId))\n  throw new Error('this file belongs to a workspace you cannot access');","typeGuard":null,"tryCatchPattern":"const res = await fetch(url, {credentials: 'include'});\nif (res.status === 404) {\n  // indistinguishable by design: missing OR denied —\n  // re-authenticate as the owning user or regenerate the file\n}","preventionTips":["Generate files in chats the consumer user can access when sharing is intended","Keep frontend and backend on one instance so authorizing records actually exist","Treat these URLs as per-user secrets; do not persist them in shared documents"],"tags":["http-404","authorization","file-download","multi-user","workspace-chat"],"backgroundTag":"resource-not-found-or-access-denied","analyzedSha":"3aec848f2885144aa8f1e53b9731a04310d5d558","analyzedAt":"2026-08-18T10:02:21.017Z","contentChangedAt":"2026-08-18T10:02:21.017Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}