fullstackhero/dotnet-starter-kit · warning · ForbiddenException

not allowed to delete this file

Error message

not allowed to delete this file

What it means

The policy's CanDeleteAsync returned false for the acting user and file context, so the handler throws ForbiddenException before soft-deleting. Delete permission is decided per OwnerType policy (creator/admin checks), independent of authentication — the user is authenticated but not authorized for this specific file.

Solutions

1. Verify the acting user is the file creator or holds the role the OwnerType policy requires for deletion.
2. Review CanDeleteAsync for the relevant OwnerType to understand the exact condition.
3. Request the elevated role/permission if deletion is legitimate, or have the owner perform the delete.
4. Adjust the policy implementation if the business rule itself is wrong.

Example fix

// before
await client.DeleteFileAsync(otherUsersFileId); // 403
// after
if (file.CreatedByUserId == currentUserId || isAdmin) await client.DeleteFileAsync(file.Id);

var file = await client.GetFileAsync(id);
if (file.CreatedByUserId != currentUserId && !userIsAdmin) throw new UnauthorizedAccessException("Only the creator or an admin may delete this file.");

catch (ForbiddenException e) when (e.Message.Contains("delete")) {
    notify("You are not allowed to delete this file.");
}

When it happens

Trigger: User calls the delete endpoint for a file they did not create and do not administrate; policy requires an owner/admin role the user lacks; file belongs to a different owner within the same tenant.

Common situations: Shared-tenant setups where users assume any tenant file is deletable; UI hiding delete buttons only for the owner while API is called directly; role downgrades leaving users with stale UI; scripting bulk deletes over files owned by others.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• not allowed to change this file's visibility
• Only the author or a moderator can delete.
• Channel admin role required.
• no policy
• file not found

AI-assisted analysis of fullstackhero/dotnet-starter-kit@3f2959e683 (2026-09-15). Data as JSON: /api/errors/75623b204181491b. Report an issue: GitHub.

Appendix: source

Thrown at src/Modules/Files/Modules.Files/Features/v1/DeleteFile/DeleteFileCommandHandler.cs:33

    ICurrentUser currentUser)
    : ICommandHandler<DeleteFileCommand, Unit>
{
    public async ValueTask<Unit> Handle(DeleteFileCommand cmd, CancellationToken cancellationToken)
    {
        ArgumentNullException.ThrowIfNull(cmd);

        var f = await db.FileAssets
            .FirstOrDefaultAsync(x => x.Id == cmd.FileAssetId, cancellationToken)
            .ConfigureAwait(false)
            ?? throw new NotFoundException("file not found");

        var userId = currentUser.GetUserId().ToString();
        var policy = policies.Resolve(f.OwnerType)
            ?? throw new ForbiddenException("no policy");
        var ctx = new FileAccessContext(f.Id, f.OwnerType, f.OwnerId, f.CreatedByUserId, (int)f.Visibility);
        if (!await policy.CanDeleteAsync(ctx, userId, cancellationToken).ConfigureAwait(false))
        {
            throw new ForbiddenException("not allowed to delete this file");
        }

        // Soft-delete: AuditableEntitySaveChangesInterceptor sets IsDeleted/DeletedOnUtc/DeletedBy on
        // Remove() for ISoftDeletable; byte purge runs later via PurgeDeletedFilesJob post-retention.
        db.FileAssets.Remove(f);
        await db.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
        return Unit.Value;
    }
}

View on GitHub (pinned to 3f2959e683)