{"record":{"id":"7560cb5e31ddc3d1","repo":"invoke-ai/InvokeAI","slug":"not-authorized-to-move-this-video","errorCode":null,"errorMessage":"Not authorized to move this video","messagePattern":"Not authorized to move this video","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"invokeai/app/api/routers/videos.py","lineNumber":124,"sourceCode":"            pass\n\n    raise HTTPException(status_code=403, detail=\"Not authorized to modify this video\")\n\n\ndef _assert_video_direct_owner(video_name: str, current_user: CurrentUserOrDefault) -> None:\n    \"\"\"Raise 403 if the current user is not the direct owner of the video.\n\n    Intentionally stricter than _assert_video_owner: board-ownership and public-board\n    fallbacks are NOT honored. Mirrors _assert_image_direct_owner in board_images.py —\n    board-move operations need to verify the *original* owner, otherwise a user could\n    move someone else's video onto their own board via the board-owner branch.\n    \"\"\"\n    if current_user.is_admin:\n        return\n    owner = ApiDependencies.invoker.services.video_records.get_user_id(video_name)\n    if owner is not None and owner == current_user.user_id:\n        return\n    raise HTTPException(status_code=403, detail=\"Not authorized to move this video\")\n\n\ndef _assert_board_write_access(board_id: str, current_user: CurrentUserOrDefault) -> None:\n    \"\"\"Raise 403 if the current user may not mutate the given board.\n\n    Mirrors _assert_board_write_access in board_images.py: admins and the board owner\n    may write; public boards accept contributions from any user.\n    \"\"\"\n    from invokeai.app.services.board_records.board_records_common import BoardVisibility\n\n    try:\n        board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)\n    except Exception:\n        raise HTTPException(status_code=404, detail=\"Board not found\")\n    if current_user.is_admin:\n        return\n    if board.user_id == current_user.user_id:\n        return","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/videos.py#L106-L142","documentation":"_assert_video_direct_owner raises HTTP 403 unless the current user is an admin or the direct owner of the video record. Unlike _assert_video_owner it deliberately ignores board-ownership and public-board fallbacks, so board-move operations (add/remove video to/from board) can only be performed by the original owner — preventing a user from moving someone else's video onto their own board.","triggerScenarios":"POST /api/v1/videos/{video}/board or DELETE removing a video from a board in multiuser mode, where the caller is not the video's original owner (even if they own the target board or the video sits on a public board).","commonSituations":"A user tries to reorganize videos shared on a public/shared board into their own boards; admin-delegated scripts running as a non-admin token; assuming board ownership grants move rights.","solutions":["Have the original video owner perform the board move","Use an admin account for the operation","If delegation is needed, have the owner re-upload the video so it becomes owned by the intended user","Do not rely on public-board visibility for move operations — it is intentionally not honored"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"owner = requests.get(f\"{base}/api/v1/videos/{name}\").json().get(\"user_id\")\nassert owner == my_user_id or is_admin, \"direct-owner move not permitted\"","typeGuard":null,"tryCatchPattern":"try:\n    requests.post(f\"{base}/api/v1/videos/{name}/board\", json={\"board_id\": board}).raise_for_status()\nexcept requests.HTTPError as e:\n    if e.response.status_code == 403:\n        ask_owner_to_move(name)","preventionTips":["Remember board moves require direct ownership — public visibility does not help","Have the original owner perform reorganization","Prefer re-uploading videos you need to own"],"tags":["http-403","authorization","multiuser","videos"],"backgroundTag":"insufficient-permissions","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}