phacility/phabricator · error · Exception

This request is authenticated as a cluster device, but is pe

Error message

This request is authenticated as a cluster device, but is performing a write. Writes must be performed with a real user account.

What it means

requireWriteAccess rejects pushes authenticated as an omnipotent identity (a cluster device). Writes must be attributed to a real user for permissions and audit, so when $viewer->isOmnipotent() and a write is requested, this exception is thrown before the push proceeds.

Source

Thrown at src/applications/diffusion/ssh/DiffusionSSHWorkflow.php:265

    }

    if ($repository->getVersionControlSystem() != $vcs) {
      $this->raiseWrongVCSException($repository);
    }

    return $repository;
  }

  protected function requireWriteAccess($protocol_command = null) {
    if ($this->hasWriteAccess === true) {
      return;
    }

    $repository = $this->getRepository();
    $viewer = $this->getSSHUser();

    if ($viewer->isOmnipotent()) {
      throw new Exception(
        pht(
          'This request is authenticated as a cluster device, but is '.
          'performing a write. Writes must be performed with a real '.
          'user account.'));
    }

    if ($repository->isReadOnly()) {
      throw new Exception($repository->getReadOnlyMessageForDisplay());
    }

    $protocol = PhabricatorRepositoryURI::BUILTIN_PROTOCOL_SSH;
    if ($repository->canServeProtocol($protocol, true)) {
      $can_push = PhabricatorPolicyFilter::hasCapability(
        $viewer,
        $repository,
        DiffusionPushCapability::CAPABILITY);
      if (!$can_push) {
        throw new Exception(

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Ensure intracluster requests proxy with the original user: correct diffusion.ssh-user plus device keys on the front node
2. Perform pushes as a real user account over SSH, never as the device
3. Review Almanac binding and protocol configuration if a legitimately proxied write is being misdetected

// Refuse writes from device identities before executing them
if ($viewer->isOmnipotent()) {
  // do not enter the write path; proxy with the real user instead
}

When it happens

Trigger: A cluster device connection performing git-receive-pack or an hg push as the device account itself instead of proxying the end user's credentials, or custom automation authenticating over SSH with device credentials.

Common situations: Misconfigured intracluster proxying (front node not forwarding the original user); scripts using device keys directly for pushes.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Leader lost: no up-to-date nodes in repository cluster are f
• Failed to generate an intracluster proxy URI even though thi
• Unable to determine the username to connect with when trying
• Unable to proxy this SSH request within the cluster: this de
• You do not have permission to access the Diffusion applicati

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/bcb93f0477d093de. Report an issue: GitHub.