phacility/phabricator · error · Exception

You are not the revision owner, and this is not a draft comm

Error message

You are not the revision owner, and this is not a draft comment you authored.

What it means

Marking an inline comment 'Done' is reserved for the revision owner (for any comment on their revision) or for the comment's author while the comment is still a draft. Anyone else gets this permission error before the inline is returned.

Source

Thrown at src/applications/differential/controller/DifferentialInlineCommentEditController.php:112

      ->setViewer($viewer)
      ->withIDs(array($diff->getRevisionID()))
      ->executeOne();
    if (!$revision) {
      throw new Exception(pht('Unable to load revision.'));
    }

    $viewer_phid = $viewer->getPHID();
    $is_owner = ($viewer_phid == $revision->getAuthorPHID());
    $is_author = ($viewer_phid == $inline->getAuthorPHID());
    $is_draft = ($inline->isDraft());

    if ($is_owner) {
      // You own the revision, so you can mark the comment as "Done".
    } else if ($is_author && $is_draft) {
      // You made this comment and it's still a draft, so you can mark
      // it as "Done".
    } else {
      throw new Exception(
        pht(
          'You are not the revision owner, and this is not a draft comment '.
          'you authored.'));
    }

    return $inline;
  }

  protected function canEditInlineComment(
    PhabricatorUser $viewer,
    DifferentialInlineComment $inline) {

    // Only the author may edit a comment.
    if ($inline->getAuthorPHID() != $viewer->getPHID()) {
      return false;
    }

    // Saved comments may not be edited, for now, although the schema now

View on GitHub (pinned to 5720a38cfe)

Solutions

Let the revision owner perform 'Done', or have the comment author do it while the comment is still a draft.
As a reviewer, reply to the comment instead of marking it done.
For automation, act with the revision author's credentials.

Defensive patterns

Strategy: validation

Validate before calling

$can_mark_done = ($viewer_phid === $revision->getAuthorPHID()) ||
  ($viewer_phid === $inline->getAuthorPHID() && $inline->isDraft());
if (!$can_mark_done) {
  // do not attempt the 'Done' action; reply instead
}

Try / catch

try {
  // mark the inline comment done
} catch (Exception $ex) {
  if (preg_match('/not the revision owner/', $ex->getMessage())) {
    // downgrade to a normal reply; only the owner may mark done
  } else {
    throw $ex;
  }
}

Prevention

Only the revision owner marks comments 'Done'.
Comment authors may do it only while the comment is still a draft.
Run automation with the revision author's credentials, not a shared account.

When it happens

Trigger: A reviewer who is not the owner clicking 'Done' on someone else's non-draft comment; scripts that perform the done-action as a third user.

Common situations: Multiple reviewers on a revision assuming anyone can check off comments; automation tokens running as a shared or wrong account.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/fbdcb1d4e36ac329. Report an issue: GitHub.