{"record":{"id":"a0c5895b58140930","repo":"infiniflow/ragflow","slug":"message-compilenotsupported-a0c589","errorCode":null,"errorMessage":"message.compileNotSupported","messagePattern":"message\\.compileNotSupported","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"web/src/hooks/use-knowledge-request.ts","lineNumber":991,"sourceCode":"};\n\nexport const useRunArtifactIndex = (kind: string) => {\n  const knowledgeBaseId = useKnowledgeBaseId();\n  const queryClient = useQueryClient();\n\n  const {\n    data,\n    isPending: loading,\n    mutateAsync,\n  } = useMutation({\n    mutationKey: [KnowledgeApiAction.RunArtifactIndex],\n    mutationFn: async () => {\n      // Go/hybrid: wiki compilation is auto-driven by the scheduler; there is no\n      // legacy RunIndex endpoint. Reject instead of reporting success so a wiki\n      // update can't be mistaken for a real re-merge (the UI hides/disables the\n      // update control — plan v4.1 §4.2).\n      if (isGoDatasetBackend()) {\n        throw new Error(i18n.t('message.compileNotSupported'));\n      }\n      const { data } = await runIndex(knowledgeBaseId, 'wiki');\n      if (data?.code === 0) {\n        message.success(i18n.t('message.operated'));\n        queryClient.invalidateQueries({\n          queryKey: ArtifactAlterationKeys.detail(knowledgeBaseId, kind),\n        });\n        queryClient.invalidateQueries({\n          queryKey: ArtifactKeys.listByDataset(knowledgeBaseId),\n        });\n        queryClient.invalidateQueries({\n          queryKey: ArtifactTopicKeys.listByDataset(knowledgeBaseId),\n        });\n        queryClient.invalidateQueries({\n          queryKey: DatasetGenerateKeys.traceById(\n            GenerateType.Artifact,\n            knowledgeBaseId,\n          ),","sourceCodeStart":973,"sourceCodeEnd":1009,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/web/src/hooks/use-knowledge-request.ts#L973-L1009","documentation":"The validation Drive call returned HttpError 403. Unlike a generic scope problem, this branch indicates the Drive API itself refused the app: required scopes not granted to the token, Drive API/Drive apps disabled for the domain, or the service account not domain-wide-delegated. Mapped to InsufficientPermissionsError.","triggerScenarios":"Token minted with fewer scopes than GOOGLE_SCOPES requires (e.g. missing drive.readonly.metadata or admin directory scope), Workspace admin has disabled Drive apps, or a service account without domain-wide delegation with admin impersonation (sub=user@domain).","commonSituations":"Scope list changed between app versions and old tokens lack new scopes, Workspace 'Restrict Google Drive' policy, GCP project's Drive API disabled, service account delegated at the wrong client ID.","solutions":["Check GCP > APIs & Services > Library and enable the Google Drive API for the project","Redo the OAuth flow with the full requested scope set so consent covers them (or set GOOGLE_OAUTH_SCOPE_OVERRIDE to scopes you are allowed to request)","For Workspace: Admin console > Security > API controls > Domain-wide delegation — add the client ID with the Drive + Admin Directory scopes","Verify Workspace hasn't blocked the app: Admin console > Apps > Drive apps / Access tokens"],"exampleFix":"# before: token only has drive.file scope → files().list 403\ncreds.scopes  # ['https://www.googleapis.com/auth/drive.file']\n\n# after: mint token with the connector's required scope set\nexport GOOGLE_OAUTH_SCOPE_OVERRIDE=\"https://www.googleapis.com/auth/drive.readonly.metadata,https://www.googleapis.com/auth/admin.directory.user.readonly\"\n# then re-run the OAuth flow so consent includes both scopes","handlingStrategy":"try-catch","validationCode":"REQUIRED_SCOPES = {\n    \"https://www.googleapis.com/auth/drive.readonly.metadata\",\n    \"https://www.googleapis.com/auth/admin.directory.user.readonly\",\n}\n\ndef token_covers_required_scopes(creds) -> bool:\n    return REQUIRED_SCOPES <= set(creds.scopes or [])","typeGuard":null,"tryCatchPattern":"from common.data_source.exceptions import InsufficientPermissionsError\n\ntry:\n    connector.validate_connector_settings()\nexcept InsufficientPermissionsError as e:\n    if \"403\" in str(e):\n        run_admin_checklist(e)  # enable Drive API, domain-wide delegation, consent-screen scopes\n        # then re-mint token and retry once\n        connector.load_credentials(reissue_oauth_with_full_scopes())\n        connector.validate_connector_settings()","preventionTips":["Automate a post-deploy check that the Drive API is enabled in the GCP project","Keep the consent-screen scope list in sync with the code's requested scopes (compare on release)","For Workspace, pre-register the client ID for domain-wide delegation before first sync"],"tags":["google-drive","authorization","http-403","scopes","workspace"],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}