langgenius/dify · error · Forbidden

You don't have the permission to access the requested resour

Error message

You don't have the permission to access the requested resource. It is either read-protected or not readable by the server.

What it means

werkzeug.exceptions.Forbidden (HTTP 403) with the default message 'You don't have the permission to access the requested resource...'. It is raised by the `plugin_permission_required(install_required=True)` decorator (api/controllers/console/workspace/__init__.py:44) when the tenant's `TenantPluginPermission.install_permission` is `NOBODY`. The decorator only runs when `dify_config.RBAC_ENABLED` is false (RBAC enabled short-circuits at line 22) and a permission row exists for the tenant (no row means open access at line 39). `NOBODY` blocks every account, including the workspace owner, because the matched case raises unconditionally.

Source

Thrown at api/controllers/console/workspace/__init__.py:44

            tenant_id = current_tenant_id

            with sessionmaker(db.engine).begin() as session:
                permission = session.scalar(
                    select(TenantPluginPermission)
                    .where(
                        TenantPluginPermission.tenant_id == tenant_id,
                    )
                    .limit(1)
                )

                if not permission:
                    # no permission set, allow access for everyone
                    return view(*args, **kwargs)

                if install_required:
                    match permission.install_permission:
                        case TenantPluginInstallPermission.NOBODY:
                            raise Forbidden()
                        case TenantPluginInstallPermission.ADMINS:
                            if not user.is_admin_or_owner:
                                raise Forbidden()
                        case TenantPluginInstallPermission.EVERYONE:
                            pass

                if debug_required:
                    match permission.debug_permission:
                        case TenantPluginDebugPermission.NOBODY:
                            raise Forbidden()
                        case TenantPluginDebugPermission.ADMINS:
                            if not user.is_admin_or_owner:
                                raise Forbidden()
                        case TenantPluginDebugPermission.EVERYONE:
                            pass

            return view(*args, **kwargs)

View on GitHub (pinned to ef8544b173)

Solutions

1. Change the tenant's `install_permission` away from NOBODY (to EVERYONE or ADMINS) via the plugin-permission admin setting or by updating the `tenant_plugin_permissions` row.
2. If install must stay restricted, perform the install as a workspace admin/owner only after switching to ADMINS, since NOBODY cannot be satisfied by any role.
3. If RBAC is intended to govern access, enable `RBAC_ENABLED` so this decorator is bypassed in favor of `@rbac_permission_required`.

Example fix

// before: install_permission == NOBODY blocks all callers
case TenantPluginInstallPermission.NOBODY:
    raise Forbidden()
// after: allow admins to install when strict lockdown is not required
case TenantPluginInstallPermission.NOBODY:
    if not user.is_admin_or_owner:
        raise Forbidden()

# Before calling, check the tenant's plugin install permission
from models.account import TenantPluginInstallPermission

perm = load_tenant_plugin_permission(tenant_id)
if perm and perm.install_permission == TenantPluginInstallPermission.NOBODY:
    raise RuntimeError("plugin installs are disabled for this workspace (NOBODY)")

def install_is_allowed(perm) -> bool:
    from models.account import TenantPluginInstallPermission
    return perm is None or perm.install_permission in (
        TenantPluginInstallPermission.EVERYONE,
        TenantPluginInstallPermission.ADMINS,
    )

from werkzeug.exceptions import Forbidden
try:
    resp = client.post("/console/api/workspaces/current/plugin/install", json=body)
except Forbidden:
    # install_permission is NOBODY (or ADMINS for non-admins) — surface to user
    raise PermissionError("plugin install is not permitted in this workspace")

When it happens

Trigger: Any console endpoint decorated with `@plugin_permission_required(install_required=True)` is hit while the current tenant's `install_permission` is set to `TenantPluginInstallPermission.NOBODY` and RBAC is disabled. The request fails before the view body executes.

Common situations: A workspace owner locks down plugin installs to NOBODY in the tenant plugin-permission settings and a user (or the owner themselves) then tries to install/manage a plugin. Permission rows are usually seeded through the plugin-permission admin UI or migrated via DB scripts.

Related errors

• You don't have the permission to access the requested resour
• Forbidden
• usage_missing_arg
• Builtin RBAC role not found for tenant={tenant_id}, legacy_r
• Unsupported legacy workspace role: {legacy_role}

AI-assisted analysis of langgenius/dify@ef8544b173 (2026-08-12). Data as JSON: /api/errors/bbf5b884fff55210. Report an issue: GitHub.