{"record":{"id":"92ff182d1ef87f3e","repo":"iflytek/astron-agent","slug":"app-tenant-platform-unauthorized-error","errorCode":"APP_TENANT_PLATFORM_UNAUTHORIZED_ERROR","errorMessage":"Current app_id does not have permission to publish to {SOURCE_MAPPING[plat]}","messagePattern":"Current app_id does not have permission to publish to (.+?)","errorType":"error_code","errorClass":"CustomException","httpStatus":null,"severity":"warning","filePath":"core/workflow/service/publish_service.py","lineNumber":87,"sourceCode":"\n\nasync def _check_permissions(db_app: App, db_flow: Flow, plat: int, span: Span) -> None:\n    \"\"\"\n    Validate tenant application permissions for platform publishing.\n\n    Checks if the tenant application has the necessary permissions to publish\n    workflows to the target platform and if the workflow's source platform\n    is authorized for the tenant.\n\n    :param db_app: The tenant application object\n    :param db_flow: The workflow object to be published\n    :param plat: Target platform identifier\n    :param span: Tracing span for observability\n    :raises CustomException: If tenant lacks platform publishing permissions\n    \"\"\"\n    # Check if tenant has permission to publish to target platform\n    if db_app.plat_release_auth & plat == 0:\n        await span.add_info_event_async(\n            f\"App platform release auth: {db_app.plat_release_auth}\"\n        )\n        raise CustomException(\n            CodeEnum.APP_TENANT_PLATFORM_UNAUTHORIZED_ERROR,\n            err_msg=f\"Current app_id does not have permission \"\n            f\"to publish to {SOURCE_MAPPING[plat]}\",\n        )\n    # Check if tenant has permission for workflow's source platform\n    if db_app.plat_release_auth & db_flow.source == 0:\n        await span.add_info_event_async(\n            f\"App platform release auth: {db_app.plat_release_auth}\"\n        )\n        raise CustomException(\n            CodeEnum.APP_TENANT_PLATFORM_UNAUTHORIZED_ERROR,\n            err_msg=f\"Current flow is on platform {SOURCE_MAPPING[db_flow.source]}, \"\n            f\"but current app_id does not have permission for \"\n            f\"{SOURCE_MAPPING[db_flow.source]}\",\n        )","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/core/workflow/service/publish_service.py#L69-L105","documentation":"APP_TENANT_PLATFORM_UNAUTHORIZED_ERROR raised in publish_service._check_permissions when the app's plat_release_auth bitmask ANDed with the target platform flag plat is 0 — the tenant app was never granted permission to publish to that platform.","triggerScenarios":"Calling the publish flow (handle → _check_permissions) with a plat whose bit is not set in db_app.plat_release_auth, e.g., publishing to a web/app platform the tenant isn't authorized for.","commonSituations":"Tenant provisioned without the target platform in its release-auth bitmask, admin hasn't granted the platform permission, targeting the wrong platform in the publish request.","solutions":["Request that an admin set the platform bit in the app's plat_release_auth","Publish only to platforms present in the app's current plat_release_auth","Verify the plat constant used in the request matches the intended platform","Re-provision/update the tenant app's platform authorizations"],"exampleFix":"// before\nplat_release_auth = 0b0001  # only platform 1\npublish(plat=PLATFORM_2)    # denied\n// after\nplat_release_auth = 0b0011  # grant platform 2\npublish(plat=PLATFORM_2)    # allowed","handlingStrategy":"validation","validationCode":"if (db_app.plat_release_auth & target_plat) == 0:\n    raise ValueError(f'app {db_app.id} lacks publish permission for platform {target_plat}')","typeGuard":null,"tryCatchPattern":"try:\n    publish_service.handle(...)\nexcept CustomException as e:\n    if e.err_code == CodeEnum.APP_TENANT_PLATFORM_UNAUTHORIZED_ERROR:\n        return error_response(403, 'Request platform permission from your tenant admin')\n    raise","preventionTips":["Check plat_release_auth before offering publish targets in the UI","Have admins grant platform bits at tenant provisioning time","Surface which platforms an app may publish to via an API","Log the app's plat_release_auth in publish-failure diagnostics"],"tags":["permission","publish","platform","bitmask"],"backgroundTag":"insufficient-permissions","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}