{"record":{"id":"ee56e0296e4feaa8","repo":"phalcon/cphalcon","slug":"no-active-access-call-access-first","errorCode":null,"errorMessage":"No active access - call access() first","messagePattern":"No active access - call access\\(\\) first","errorType":"exception","errorClass":"Phalcon\\Auth\\Exceptions\\ActiveAccessRequired","httpStatus":null,"severity":"error","filePath":"phalcon/Auth/Manager.zep","lineNumber":219,"sourceCode":"    {\n        return this->guard()->user();\n    }\n\n    /**\n     * @phpstan-param AuthCredentials $credentials\n     */\n    public function validate(array credentials = []) -> bool\n    {\n        return this->guard()->validate(credentials);\n    }\n\n    /**\n     * @throws Exception\n     */\n    private function requireActiveAccess() -> <Access>\n    {\n        if (this->activeAccess === null) {\n            throw new ActiveAccessRequired();\n        }\n\n        return this->activeAccess;\n    }\n\n    /**\n     * @throws Exception\n     */\n    private function requireStatefulGuard() -> <GuardStateful>\n    {\n        var guard;\n\n        let guard = this->guard();\n\n        DoesNotImplement::assert(\n            guard,\n            GuardStateful::class,\n            \"Default guard\",","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Auth/Manager.zep#L201-L237","documentation":"The Auth Manager's access-check methods (allows/denies-style calls on the manager) internally require that an access component has been selected first; requireActiveAccess() throws ActiveAccessRequired when activeAccess is null. activeAccess is only set by a successful Manager::access(name) call, so invoking an access check before that - or after a failed/never-made access() call - produces this error.","triggerScenarios":"$auth->allows('resource') without a preceding $auth->access('acl'); calling an access method after access() threw AccessNotRegistered (so activeAccess stayed null); helper/base-controller code that calls the manager's access methods assuming a global access was pre-selected elsewhere.","commonSituations":"Middleware that calls an access check directly without selecting the access backend; refactoring where the access('acl') call moved into a branch that does not run; copy-pasted controller code missing the fluent access() prefix.","solutions":["Chain from access(): $auth->access('acl')->allows('admin.area') so the active access is set first","If you centralize checks, keep a single entry point that calls access() once before any allows/denies call","Verify 'acl' (or your access name) is registered - if access() throws, activeAccess stays null and the next call fails with this error"],"exampleFix":"// before\n$auth->allows('admin.area');\n\n// after\n$auth->access('acl')->allows('admin.area');","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    $allowed = $auth->access('acl')->allows('admin.area');\n} catch (\\Phalcon\\Auth\\Exceptions\\ActiveAccessRequired $e) {\n    // access() was never called (or failed); select the access component then retry once\n}","preventionTips":["Always chain access checks from access(): one fluent expression per check","Wrap the manager in your own AuthorizationService that calls access() internally","Treat an AccessNotRegistered during bootstrap as fatal so later calls never see ActiveAccessRequired"],"tags":["auth","access-control","ordering","fluent-api"],"backgroundTag":"authorization-not-configured","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}