{"record":{"id":"c5065f9c5e37d83d","repo":"phacility/phabricator","slug":"you-do-not-have-permission-to-access-the-diffusion","errorCode":null,"errorMessage":"You do not have permission to access the Diffusion application, so you can not interact with repositories over SSH.","messagePattern":"You do not have permission to access the Diffusion application, so you can not interact with repositories over SSH\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/diffusion/ssh/DiffusionSSHWorkflow.php","lineNumber":172,"sourceCode":"      'ssh %Ls -l %s -i %s -p %s %s -- %s %Ls',\n      $options,\n      $username,\n      $key_path,\n      $port,\n      $host,\n      '@'.$this->getSSHUser()->getUsername(),\n      $this->getOriginalArguments());\n  }\n\n  final public function execute(PhutilArgumentParser $args) {\n    $this->args = $args;\n\n    $viewer = $this->getSSHUser();\n    $have_diffusion = PhabricatorApplication::isClassInstalledForViewer(\n      'PhabricatorDiffusionApplication',\n      $viewer);\n    if (!$have_diffusion) {\n      throw new Exception(\n        pht(\n          'You do not have permission to access the Diffusion application, '.\n          'so you can not interact with repositories over SSH.'));\n    }\n\n    $repository = $this->identifyRepository();\n    $this->setRepository($repository);\n\n    // NOTE: Here, we're just figuring out if this is a proxyable request to\n    // a clusterized repository or not. We don't (and can't) use the URI we get\n    // back directly.\n\n    // For example, we may get a read-only URI here but be handling a write\n    // request. We only care if we get back `null` (which means we should\n    // handle the request locally) or anything else (which means we should\n    // proxy it to an appropriate device).\n\n    $is_cluster_request = $this->getIsClusterRequest();","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/diffusion/ssh/DiffusionSSHWorkflow.php#L154-L190","documentation":"Every repository SSH workflow starts by checking that the Diffusion application is installed and visible to the authenticated SSH user (PhabricatorApplication::isClassInstalledForViewer). If the user's policies hide Diffusion, the request is refused before any repository is resolved.","triggerScenarios":"Connecting over SSH as a user who cannot see the Diffusion application: its policy is restricted to a project the user is not in, prototypes are disabled for their roles, or the application is uninstalled.","commonSituations":"Installs with tightened application policies; bot or machine accounts not added to the permitted project; policy audits that accidentally lock users out.","solutions":["Check Applications -> Diffusion -> Policy and the default application policy settings","Add the user to whatever project or role the Diffusion policy requires","Confirm the same user can browse Diffusion in the web UI, then retry the SSH operation"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Check application visibility before invoking an SSH workflow\n$viewer = $this->getSSHUser();\nif (!PhabricatorApplication::isClassInstalledForViewer(\n      'PhabricatorDiffusionApplication',\n      $viewer)) {\n  // refuse early with a policy explanation\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the Diffusion application policy aligned with who should use repositories over SSH","For bot accounts, grant Diffusion access explicitly and test in the web UI first","Remember SSH access mirrors web visibility — locked-out users fail here, not at the repo policy"],"tags":["permissions","ssh","diffusion","policy"],"backgroundTag":"permission-denied","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}