goharbor/harbor · error · errors.Error

DENIED

DENIED

Error message

permission scope is invalid. It must be equal to or more restrictive than the creator robot's permissions: %s

What it means

Error "permission scope is invalid. It must be equal to or more restrictive than the creator robot's permissions: %s" thrown in goharbor/harbor.

Source

Thrown at src/server/v2.0/handler/robot.go:92

		},
		Level:           params.Robot.Level,
		ProjectNameOrID: params.Robot.Permissions[0].Namespace,
	}

	if err := rAPI.requireAccess(ctx, r, rbac.ActionCreate); err != nil {
		return rAPI.SendError(ctx, err)
	}

	var creatorRef int64
	switch s := sc.(type) {
	case *local.SecurityContext:
		creatorRef = int64(s.User().UserID)
	case *robotSc.SecurityContext:
		if s.User() == nil {
			return rAPI.SendError(ctx, errors.New(nil).WithMessage("invalid security context: empty robot account"))
		}
		if !isValidPermissionScope(params.Robot.Permissions, s.User().Permissions) {
			return rAPI.SendError(ctx, errors.New(nil).WithMessagef("permission scope is invalid. It must be equal to or more restrictive than the creator robot's permissions: %s", s.User().Name).WithCode(errors.DENIED))
		}
		creatorRef = s.User().ID
	default:
		return rAPI.SendError(ctx, errors.New(nil).WithMessage("invalid security context"))
	}
	r.CreatorType = sc.Name()
	r.CreatorRef = creatorRef

	if err := lib.JSONCopy(&r.Permissions, params.Robot.Permissions); err != nil {
		log.Warningf("failed to call JSONCopy on robot permission when CreateRobot, error: %v", err)
	}

	if err := robot.SetProject(ctx, r); err != nil {
		return rAPI.SendError(ctx, err)
	}

	rid, pwd, err := rAPI.robotCtl.Create(ctx, r)
	if err != nil {

View on GitHub (pinned to 7b2fd08cc5)

When it happens

Trigger: Thrown at src/server/v2.0/handler/robot.go:92 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/3f8f922e75234bb6. Report an issue: GitHub.