iflytek/astron-agent · warning · CustomException

APP_TENANT_PLATFORM_UNAUTHORIZED_ERROR

APP_TENANT_PLATFORM_UNAUTHORIZED_ERROR

Error message

Current app_id does not have permission to publish to {SOURCE_MAPPING[plat]}

What it means

APP_TENANT_PLATFORM_UNAUTHORIZED_ERROR raised in publish_service._check_permissions when the app's plat_release_auth bitmask ANDed with the target platform flag plat is 0 — the tenant app was never granted permission to publish to that platform.

Solutions

  1. Request that an admin set the platform bit in the app's plat_release_auth
  2. Publish only to platforms present in the app's current plat_release_auth
  3. Verify the plat constant used in the request matches the intended platform
  4. Re-provision/update the tenant app's platform authorizations

Example fix

// before
plat_release_auth = 0b0001  # only platform 1
publish(plat=PLATFORM_2)    # denied
// after
plat_release_auth = 0b0011  # grant platform 2
publish(plat=PLATFORM_2)    # allowed
Defensive patterns

Strategy: validation

Validate before calling

if (db_app.plat_release_auth & target_plat) == 0:
    raise ValueError(f'app {db_app.id} lacks publish permission for platform {target_plat}')

Try / catch

try:
    publish_service.handle(...)
except CustomException as e:
    if e.err_code == CodeEnum.APP_TENANT_PLATFORM_UNAUTHORIZED_ERROR:
        return error_response(403, 'Request platform permission from your tenant admin')
    raise

Prevention

When it happens

Trigger: Calling the publish flow (handle → _check_permissions) with a plat whose bit is not set in db_app.plat_release_auth, e.g., publishing to a web/app platform the tenant isn't authorized for.

Common situations: Tenant provisioned without the target platform in its release-auth bitmask, admin hasn't granted the platform permission, targeting the wrong platform in the publish request.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/92ff182d1ef87f3e. Report an issue: GitHub.

Appendix: source

Thrown at core/workflow/service/publish_service.py:87


async def _check_permissions(db_app: App, db_flow: Flow, plat: int, span: Span) -> None:
    """
    Validate tenant application permissions for platform publishing.

    Checks if the tenant application has the necessary permissions to publish
    workflows to the target platform and if the workflow's source platform
    is authorized for the tenant.

    :param db_app: The tenant application object
    :param db_flow: The workflow object to be published
    :param plat: Target platform identifier
    :param span: Tracing span for observability
    :raises CustomException: If tenant lacks platform publishing permissions
    """
    # Check if tenant has permission to publish to target platform
    if db_app.plat_release_auth & plat == 0:
        await span.add_info_event_async(
            f"App platform release auth: {db_app.plat_release_auth}"
        )
        raise CustomException(
            CodeEnum.APP_TENANT_PLATFORM_UNAUTHORIZED_ERROR,
            err_msg=f"Current app_id does not have permission "
            f"to publish to {SOURCE_MAPPING[plat]}",
        )
    # Check if tenant has permission for workflow's source platform
    if db_app.plat_release_auth & db_flow.source == 0:
        await span.add_info_event_async(
            f"App platform release auth: {db_app.plat_release_auth}"
        )
        raise CustomException(
            CodeEnum.APP_TENANT_PLATFORM_UNAUTHORIZED_ERROR,
            err_msg=f"Current flow is on platform {SOURCE_MAPPING[db_flow.source]}, "
            f"but current app_id does not have permission for "
            f"{SOURCE_MAPPING[db_flow.source]}",
        )

View on GitHub (pinned to 5e758547a8)