{"record":{"id":"bcb93f0477d093de","repo":"phacility/phabricator","slug":"this-request-is-authenticated-as-a-cluster-device","errorCode":null,"errorMessage":"This request is authenticated as a cluster device, but is performing a write. Writes must be performed with a real user account.","messagePattern":"This request is authenticated as a cluster device, but is performing a write\\. Writes must be performed with a real user account\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/diffusion/ssh/DiffusionSSHWorkflow.php","lineNumber":265,"sourceCode":"    }\n\n    if ($repository->getVersionControlSystem() != $vcs) {\n      $this->raiseWrongVCSException($repository);\n    }\n\n    return $repository;\n  }\n\n  protected function requireWriteAccess($protocol_command = null) {\n    if ($this->hasWriteAccess === true) {\n      return;\n    }\n\n    $repository = $this->getRepository();\n    $viewer = $this->getSSHUser();\n\n    if ($viewer->isOmnipotent()) {\n      throw new Exception(\n        pht(\n          'This request is authenticated as a cluster device, but is '.\n          'performing a write. Writes must be performed with a real '.\n          'user account.'));\n    }\n\n    if ($repository->isReadOnly()) {\n      throw new Exception($repository->getReadOnlyMessageForDisplay());\n    }\n\n    $protocol = PhabricatorRepositoryURI::BUILTIN_PROTOCOL_SSH;\n    if ($repository->canServeProtocol($protocol, true)) {\n      $can_push = PhabricatorPolicyFilter::hasCapability(\n        $viewer,\n        $repository,\n        DiffusionPushCapability::CAPABILITY);\n      if (!$can_push) {\n        throw new Exception(","sourceCodeStart":247,"sourceCodeEnd":283,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/diffusion/ssh/DiffusionSSHWorkflow.php#L247-L283","documentation":"requireWriteAccess rejects pushes authenticated as an omnipotent identity (a cluster device). Writes must be attributed to a real user for permissions and audit, so when $viewer->isOmnipotent() and a write is requested, this exception is thrown before the push proceeds.","triggerScenarios":"A cluster device connection performing git-receive-pack or an hg push as the device account itself instead of proxying the end user's credentials, or custom automation authenticating over SSH with device credentials.","commonSituations":"Misconfigured intracluster proxying (front node not forwarding the original user); scripts using device keys directly for pushes.","solutions":["Ensure intracluster requests proxy with the original user: correct diffusion.ssh-user plus device keys on the front node","Perform pushes as a real user account over SSH, never as the device","Review Almanac binding and protocol configuration if a legitimately proxied write is being misdetected"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Refuse writes from device identities before executing them\nif ($viewer->isOmnipotent()) {\n  // do not enter the write path; proxy with the real user instead\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never use device credentials for pushes; authenticate as a real user","Keep intracluster proxying configured (diffusion.ssh-user + device keys) so the original user is forwarded","Audit automation that talks SSH to ensure it uses user accounts, not cluster devices"],"tags":["cluster","permissions","write-access","ssh"],"backgroundTag":"device-account-write-forbidden","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}