{"record":{"id":"abcf60cf6bbcdbc2","repo":"elsa-workflows/elsa-core","slug":"access-denied","errorCode":null,"errorMessage":"Access denied.","messagePattern":"Access denied\\.","errorType":"exception","errorClass":"HubException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.Diagnostics.ConsoleLogs/RealTime/ElsaConsoleLogsHub.cs","lineNumber":77,"sourceCode":"    {\n        await UnsubscribeAsync().ConfigureAwait(false);\n        await base.OnDisconnectedAsync(exception).ConfigureAwait(false);\n    }\n\n    private static ElsaConsoleLogFilter ValidateFilter(ElsaConsoleLogFilter? filter)\n    {\n        filter ??= new();\n\n        if (filter.From is { } from && filter.To is { } to && from > to)\n            throw new HubException(\"The console log filter 'from' timestamp must be earlier than or equal to 'to'.\");\n\n        return filter;\n    }\n\n    private async ValueTask EnsureCanReadAsync(CancellationToken cancellationToken)\n    {\n        if (!await authorizer.CanReadAsync(Context, cancellationToken).ConfigureAwait(false))\n            throw new HubException(\"Access denied.\");\n    }\n}\n\npublic interface IElsaConsoleLogsClient\n{\n    Task ReceiveConsoleLogLineAsync(ConsoleLogLine line, CancellationToken cancellationToken = default);\n    Task ReceiveDroppedLinesAsync(ConsoleLogDroppedSummary summary, CancellationToken cancellationToken = default);\n    Task ReceiveSourceChangedAsync(ConsoleLogSource source, CancellationToken cancellationToken = default);\n}\n","sourceCodeStart":59,"sourceCodeEnd":87,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.Diagnostics.ConsoleLogs/RealTime/ElsaConsoleLogsHub.cs#L59-L87","documentation":"The ElsaConsoleLogsHub checks authorization before streaming, subscribing, or updating filters via an injected authorizer (CanReadAsync). If the caller's connection context is not authorized to read console logs, a HubException(\"Access denied.\") is thrown.","triggerScenarios":"Connecting to the console logs SignalR hub without an authenticated user, without the required permission/policy, or with credentials that the authorizer's policy rejects.","commonSituations":"Calling the hub from a service/background job with no user attached; missing API token or cookie; user lacks the console-logs read permission; anonymous access not enabled in the host.","solutions":["Authenticate the SignalR connection (valid token/cookie) before invoking hub methods","Grant the connecting user/role the permission required to read console logs","If machine-to-machine, configure the authorizer/policy to allow the service identity","Verify hub authorization middleware (e.g. [Authorize] and access-token negotiation) is configured correctly"],"exampleFix":"// before\nvar conn = new HubConnectionBuilder().WithUrl(\"https://host/elsa-console-logs\").Build(); // no token\n// after\nvar conn = new HubConnectionBuilder()\n    .WithUrl(\"https://host/elsa-console-logs\", o => o.AccessToken = token)\n    .Build();","handlingStrategy":"try-catch","validationCode":"// client: ensure an access token is available before connecting\nif (string.IsNullOrEmpty(accessToken)) throw new InvalidOperationException(\"Console logs hub requires authentication.\");","typeGuard":null,"tryCatchPattern":"try { await connection.InvokeAsync(\"StreamAsync\", filter); }\ncatch (HubException ex) when (ex.Message == \"Access denied.\")\n{ logger.LogWarning(\"Not authorized for console logs; check credentials/permissions\"); }","preventionTips":["Attach a valid access token in HubConnection negotiation","Grant the console-logs read permission to the role/service account","Verify the authorizer policy configuration in the host"],"tags":["signalr","authorization","security"],"backgroundTag":"permission-denied","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}