{"record":{"id":"9e19017fd7c6a389","repo":"Mintplex-Labs/anything-llm","slug":"image-not-found-or-access-denied","errorCode":null,"errorMessage":"Image not found or access denied","messagePattern":"Image not found or access denied","errorType":"http","errorClass":null,"httpStatus":404,"severity":"warning","filePath":"server/endpoints/agentFileServer.js","lineNumber":118,"sourceCode":"        const fs = require(\"fs\");\n        const path = require(\"path\");\n        const {\n          generatedImagesPath,\n          GENERATED_IMAGE_FILENAME_PATTERN,\n        } = require(\"../utils/files\");\n        const user = await userFromSession(request, response);\n        const { filename } = request.params;\n\n        if (!filename || !GENERATED_IMAGE_FILENAME_PATTERN.test(filename))\n          return response.status(400).json({ error: \"Invalid filename\" });\n\n        const fileSource = await findFileSource(filename, {\n          user,\n          isMultiUser: multiUserMode(response),\n        });\n        if (!fileSource)\n          return response\n            .status(404)\n            .json({ error: \"Image not found or access denied\" });\n\n        const imagePath = path.resolve(generatedImagesPath, filename);\n        let imageBuffer;\n        try {\n          imageBuffer = await fs.promises.readFile(imagePath);\n        } catch {\n          return response\n            .status(404)\n            .json({ error: \"Image not found in storage\" });\n        }\n\n        response.setHeader(\"Content-Type\", \"image/png\");\n        return response.send(imageBuffer);\n      } catch (error) {\n        console.error(\"[agentFileServer] Image serve error:\", error.message);\n        return response.status(500).json({ error: \"Failed to serve image\" });\n      }","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/3aec848f2885144aa8f1e53b9731a04310d5d558/server/endpoints/agentFileServer.js#L100-L136","documentation":"Returned (HTTP 404) by GET /image-generation/generated-images/:filename when findFileSource(filename, {user, isMultiUser}) returns null — no workspace chat the requesting user can access (and, in single-user mode, no scheduled job run) references this image. As with the documents route, 'not found' and 'not permitted' are intentionally merged into one 404 so the endpoint does not leak which images exist for other users.","triggerScenarios":"In multi-user mode, requesting an image generated in a chat owned by another user; an <img> src from a different instance/database than the one serving; the generating chat was deleted; the browser session resolved to a user without access to the originating workspace.","commonSituations":"Cross-user sharing of generated image URLs; frontend pointed at a backend whose database has no record of the image; bookmarked image URLs after workspace/chat cleanup; expired or switched login sessions.","solutions":["Open the image from the chat that generated it, logged in as a user with access to that workspace","Verify frontend and backend share the same instance and database","Regenerate the image in an accessible chat if the original chat is gone"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify the requesting session owns a chat that references the image before rendering\nconst source = await findAccessibleChatFor(imageName);\nif (!source) hideImageWithPlaceholder(); // do not request a URL that will 404","typeGuard":null,"tryCatchPattern":"const res = await fetch(imgUrl, {credentials: 'include'});\nif (res.status === 404) {\n  // missing or denied — indistinguishable by design;\n  // re-authenticate as the owning user or regenerate the image in an accessible chat\n}","preventionTips":["Serve image URLs only within chats the current user can access","Do not export/persist per-user image URLs into shared spaces","Regenerate images in an accessible workspace instead of forwarding old links after permission changes"],"tags":["http-404","authorization","image-generation","multi-user","workspace-chat"],"backgroundTag":"resource-not-found-or-access-denied","analyzedSha":"3aec848f2885144aa8f1e53b9731a04310d5d558","analyzedAt":"2026-08-18T10:02:21.017Z","contentChangedAt":"2026-08-18T10:02:21.017Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}