{"record":{"id":"e6d8f72447554be9","repo":"toeverything/AFFiNE","slug":"doc-scope-denied","errorCode":"DOC_SCOPE_DENIED","errorMessage":"The document is outside the user-selected document scope.","messagePattern":"The document is outside the user-selected document scope\\.","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/backend/server/src/plugins/copilot/tools/doc-canvas-read.ts","lineNumber":219,"sourceCode":"  return async (\n    options: CopilotChatOptions,\n    docId: string,\n    target: CanvasTarget,\n    cursorValue: string | undefined,\n    requestedLimit: number | undefined\n  ) => {\n    if (!options?.user || !options.workspace) {\n      return toolError('Doc Canvas Read Failed', 'Missing workspace or user.', {\n        code: 'INVALID_CONTEXT',\n        retryable: false,\n      });\n    }\n    if (!isDocumentInScope(documentScope, docId)) {\n      return toolError(\n        'Doc Canvas Read Failed',\n        'The document is outside the user-selected document scope.',\n        {\n          code: 'DOC_SCOPE_DENIED',\n          retryable: false,\n          locator: { doc_id: docId },\n        }\n      );\n    }\n    if (!(await models.workspace.get(options.workspace))) {\n      return workspaceSyncRequiredError();\n    }\n    const canAccess = await ac\n      .user(options.user)\n      .workspace(options.workspace)\n      .doc(docId)\n      .can('Doc.Read');\n    if (!canAccess) {\n      return toolError('Doc Canvas Read Failed', 'Document access denied.', {\n        code: 'DOC_ACCESS_DENIED',\n        retryable: false,\n        locator: { doc_id: docId },","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/toeverything/AFFiNE/blob/b4c8548c09da21b2898443559a5b846f0ccf5dd8/packages/backend/server/src/plugins/copilot/tools/doc-canvas-read.ts#L201-L237","documentation":"isDocumentInScope rejected the requested docId: the document is outside the document scope the user attached to the conversation, so the getter refuses to read it and returns a non-retryable DOC_SCOPE_DENIED tool error with a doc_id locator.","triggerScenarios":"Returned as DOC_SCOPE_DENIED when the requested docId is not in the user-selected document scope enforced by isDocumentInScope.","commonSituations":"The copilot referenced a canvas outside the documents the user granted access to. Add the document to the chat scope to allow reading it.","solutions":["Add the document to the user-selected scope.","Choose a document inside the selected scope."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b4c8548c09da21b2898443559a5b846f0ccf5dd8","analyzedAt":"2026-08-18T21:16:52.546Z","contentChangedAt":"2026-08-18T21:16:52.546Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}