infiniflow/ragflow · error · InsufficientPermissionsError

Insufficient permissions. Ensure web services are enabled an

Error message

Insufficient permissions. Ensure web services are enabled and permissions are correct.

What it means

An InsufficientPermissionsError raised in validate_connector_settings when the get_site_info() MoodleException text contains 'accessexception'. Moodle returns this error code when the authenticated user's role lacks the webservice/webservice:createtoken capability scope or web services are disabled at site level, so the call is rejected before any data flows.

Source

Thrown at common/data_source/moodle_connector.py:96

        except MoodleException as e:
            if "invalidtoken" in str(e).lower():
                raise CredentialExpiredError("Moodle token is invalid or expired")
            raise ConnectorMissingCredentialError(f"Failed to initialize Moodle client: {e}")

    def validate_connector_settings(self) -> None:
        if not self.moodle_client:
            raise ConnectorMissingCredentialError("Moodle client not initialized")

        try:
            site_info = self.moodle_client.core.webservice.get_site_info()
            if not site_info.sitename:
                raise InsufficientPermissionsError("Invalid Moodle API response")
        except MoodleException as e:
            msg = str(e).lower()
            if "invalidtoken" in msg:
                raise CredentialExpiredError("Moodle token is invalid or expired")
            if "accessexception" in msg:
                raise InsufficientPermissionsError("Insufficient permissions. Ensure web services are enabled and permissions are correct.")
            raise ConnectorValidationError(f"Moodle validation error: {e}")
        except Exception as e:
            raise ConnectorValidationError(f"Unexpected validation error: {e}")

    # -------------------------------------------------------------------------
    # Data loading & polling
    # -------------------------------------------------------------------------

    def load_from_state(self) -> Generator[list[Document], None, None]:
        if not self.moodle_client:
            raise ConnectorMissingCredentialError("Moodle client not initialized")

        logger.info("Starting full load from Moodle workspace")
        courses = self._get_enrolled_courses()
        if not courses:
            logger.warning("No courses found to process")
            return

View on GitHub (pinned to 554fb1133a)

Solutions

1. In Moodle: Site administration > Plugins > Web services > Overview — enable web services and the REST protocol.
2. Ensure the token user's role has the needed capabilities (webservice/webservice:use, plus the functions in the token's service such as core_course_get_courses).
3. Recreate the token selecting the correct service (or default 'all functions' for admins) and revalidate.

Example fix

# before: token bound to a limited service, validation raises InsufficientPermissionsError
connector.validate_connector_settings()

# after: admin creates token on a service that includes core_webservice_get_site_info,
# core_course_get_courses, core_course_get_contents; then
connector.load_credentials({'moodle_token': new_token})
connector.validate_connector_settings()

try:
    connector.validate_connector_settings()
except InsufficientPermissionsError as exc:
    notify_admin_to_enable_web_services(str(exc))  # actionable, config-side fix required

When it happens

Trigger: Calling validate_connector_settings() where the token's user cannot use web services — web services disabled in Site administration, user role missing required capabilities, or token created for a service the user is not enrolled in.

Common situations: Moodle admin has not enabled 'Enable web services' / 'Enable REST protocol'; token user is a student-level account; token bound to a custom service lacking functions; fresh Moodle install without web service setup.

Related errors

• Invalid Moodle API response
• Failed to fetch courses: {e}
• main() must return a value. Use null for an empty result.
• main() returned a non-JSON-serializable value.
• message.compileNotSupported

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/fc8d7fa3a4205bf2. Report an issue: GitHub.