octobercms/october · error · ApplicationException

You don't have permission to manage the document type: :doct

Error message

You don't have permission to manage the document type: :doctype

What it means

assertDocumentTypePermissions() resolves the backend user and delegates to EditorExtension::hasAccessToDocType(). Both tailor document types require the 'editor.tailor_blueprints' permission; a user whose roles lack it triggers an ApplicationException whose localized message is shown in the editor UI.

Source

Thrown at modules/tailor/classes/editorextension/HasExtensionCrud.php:443

        $documentType = ApiHelpers::assertGetKey($metadata, 'type');
        $templatePath = trim(ApiHelpers::assertGetKey($metadata, 'path'));

        return [
            $this->loadTemplate($documentType, $templatePath),
            $documentType
        ];
    }

    /**
     * assertDocumentTypePermissions
     */
    private function assertDocumentTypePermissions($documentType)
    {
        $user = BackendAuth::getUser();

        if (!EditorExtension::hasAccessToDocType($user, $documentType)) {
            throw new ApplicationException(Lang::get(
                'editor::lang.editor.error_no_doctype_permissions',
                ['doctype' => $documentType]
            ));
        }
    }

    /**
     * assertBlueprintPermissions checks permissions for blueprint file operations,
     * resolving the document type from the request.
     */
    private function assertBlueprintPermissions()
    {
        $type = post('documentType', post('documentMetadata[documentType]'));

        if (!$type) {
            $type = EditorExtension::DOCUMENT_TYPE_BLUEPRINT;
        }

View on GitHub (pinned to b608633a7e)

Solutions

1. Grant the role the Tailor blueprint permission (editor.tailor_blueprints) under Users → Roles → Permissions.
2. In custom UIs, check EditorExtension::hasAccessToDocType($user, $type) first and hide tailor document types for users without access.

Example fix

// before: assuming access
$this->assertDocumentTypePermissions($documentType);

// after: gate the feature
$user = BackendAuth::getUser();
if (!EditorExtension::hasAccessToDocType($user, $documentType)) {
    return response('No access to this document type', 403);
}

$user = \BackendAuth::getUser();
if (!$user || !\Tailor\Classes\EditorExtension::hasAccessToDocType($user, $documentType)) {
    return response()->make('Forbidden', 403);
}

function canManageTailorBlueprints($user): bool
{
    return $user && $user->hasAnyAccess(['editor.tailor_blueprints']);
}

try {
    $this->assertDocumentTypePermissions($documentType);
} catch (\October\Rain\Exception\ApplicationException $e) {
    // show a friendly 'no permission' notice and hide tailor document types from this user
}

When it happens

Trigger: A backend user whose role does not include the tailor blueprints permission opens or saves a blueprint (or theme blueprint) via the editor extension; also any custom handler calling assertDocumentTypePermissions() for such a user.

Common situations: Custom author/editor roles created without the Tailor permission; permission regrouping after an upgrade; shared accounts provisioned before Tailor was installed.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Unknown document type: %s
• Document data is not provided
• Blueprint not found
• Unknown template type.
• Document type name is not defined: %s

AI-assisted analysis of octobercms/october@b608633a7e (2026-08-21). Data as JSON: /api/errors/0df9ba6efc4eb749. Report an issue: GitHub.