What causes "Only the session owner can embed this session" in forem/forem?

Publish the AgentSession first (session.update!(published: true) or the publishing UI), then embed.

forem/forem · error · StandardError

Only the session owner can embed this session

Error message

Only the session owner can embed this session

What it means

StandardError raised by AgentSessionTag#find_session when the referenced AgentSession exists but is not published and the embedding context is not the session's owner (@embedding_user nil or a different user). Owner-only visibility applies only to unpublished sessions; published ones embed anywhere.

Source

Thrown at app/liquid_tags/agent_session_tag.rb:89

      partial: PARTIAL,
      locals: { agent_session: @agent_session, message_range: @range, slice_name: @slice_name },
    )
  end

  private

  def find_session(id_or_slug)
    session = if id_or_slug.match?(/\A\d+\z/)
                AgentSession.find_by(id: id_or_slug)
              else
                AgentSession.find_by(slug: id_or_slug)
              end
    unless session
      raise StandardError,
            I18n.t("liquid_tags.agent_session_tag.not_found", default: "Agent session not found")
    end
    unless session.published? || (@embedding_user && @embedding_user.id == session.user_id)
      raise StandardError,
            I18n.t("liquid_tags.agent_session_tag.unpublished",
                   default: "Only the session owner can embed this session")
    end

    session
  end
end

Liquid::Template.register_tag("agent_session", AgentSessionTag)

View on GitHub (pinned to f354c376a7)

Solutions

Publish the AgentSession first (session.update!(published: true) or the publishing UI), then embed.
Embed unpublished sessions only from content authored by the session owner.
If embedding programmatically, ensure the tag receives the embedding user context (@embedding_user) matching session.user_id.
Otherwise swap the reference to a published session.

Example fix

# before
session.update!(published: false)
UserArticle.create!(body: "{% agent_session #{session.id} %}", user: other_user)

# after
session.update!(published: true)
UserArticle.create!(body: "{% agent_session #{session.id} %}", user: other_user)

Defensive patterns

Strategy: validation

Validate before calling

session = AgentSession.find_by(id: ref) || AgentSession.find_by(slug: ref)
embeddable = session&.published? || session&.user_id == current_user&.id

Try / catch

begin
  Liquid::Template.parse(body)
rescue StandardError => e
  prompt_publish_session if e.message.include?('session owner')
end

Prevention

Publish sessions before embedding them in other authors' content.
Pass @embedding_user when rendering tags programmatically so ownership checks can pass legitimately.
Re-embed or remove tags when a session's published state changes.

When it happens

Trigger: Embedding {% agent_session 42 %} while session 42 has published? == false (e.g. status 'draft') from an article whose author differs from the session's user_id; also embedding an unpublished session in system context where @embedding_user was never set.

Common situations: Collaborator embeds a teammate's draft session; author pastes the tag into a different account's article; session flipped back to draft after publication; tests rendering the tag without assigning @embedding_user.

Related errors

AI-assisted analysis of forem/forem@f354c376a7 (2026-08-21). Data as JSON: /api/errors/409484d02d9e01f2. Report an issue: GitHub.