phacility/phabricator · error · Exception

You can not query subscriptions for a merchant you do not co

Error message

You can not query subscriptions for a merchant you do not control.

What it means

Thrown by PhortuneSubscriptionSearchEngine when the query is scoped to a merchant the viewer cannot edit. Merchant-scoped subscription listings expose billing data for every customer of the merchant, so Phortune requires the CAN_EDIT capability on the merchant (manager level), verified with PhabricatorPolicyFilter::hasCapability. This is an authorization guard, not a generic policy exception.

Source

Thrown at src/applications/phortune/query/PhortuneSubscriptionSearchEngine.php:59

    $saved = new PhabricatorSavedQuery();

    return $saved;
  }

  public function buildQueryFromSavedQuery(PhabricatorSavedQuery $saved) {
    $query = id(new PhortuneSubscriptionQuery());

    $viewer = $this->requireViewer();

    $merchant = $this->getMerchant();
    $account = $this->getAccount();
    if ($merchant) {
      $can_edit = PhabricatorPolicyFilter::hasCapability(
        $viewer,
        $merchant,
        PhabricatorPolicyCapability::CAN_EDIT);
      if (!$can_edit) {
        throw new Exception(
          pht(
            'You can not query subscriptions for a merchant you do not '.
            'control.'));
      }
      $query->withMerchantPHIDs(array($merchant->getPHID()));
    } else if ($account) {
      $can_edit = PhabricatorPolicyFilter::hasCapability(
        $viewer,
        $account,
        PhabricatorPolicyCapability::CAN_EDIT);
      if (!$can_edit) {
        throw new Exception(
          pht(
            'You can not query subscriptions for an account you are not '.
            'a member of.'));
      }
      $query->withAccountPHIDs(array($account->getPHID()));
    } else {

View on GitHub (pinned to 5720a38cfe)

Solutions

1. View subscriptions from the account context instead (the subscriptions on your own Phortune account).
2. Have the merchant owner add the user as a merchant manager so CAN_EDIT is granted.
3. In custom UI, gate the merchant link with PhabricatorPolicyFilter::hasCapability(..., PhabricatorPolicyCapability::CAN_EDIT) before rendering it.

Example fix

// before
$engine = id(new PhortuneSubscriptionSearchEngine())
  ->setViewer($viewer)
  ->setMerchant($merchant);
$response = $engine->buildResponse($request, $saved_query); // throws for non-managers

// after
$can_edit = PhabricatorPolicyFilter::hasCapability(
  $viewer,
  $merchant,
  PhabricatorPolicyCapability::CAN_EDIT);
if (!$can_edit) {
  return new Aphront403Response();
}
$response = $engine->buildResponse($request, $saved_query);

$can_edit = PhabricatorPolicyFilter::hasCapability(
  $viewer,
  $merchant,
  PhabricatorPolicyCapability::CAN_EDIT);
if (!$can_edit) {
  return new Aphront403Response(); // or fall back to account-scoped view
}
// now safe to scope the engine to this merchant

When it happens

Trigger: Requesting a merchant-scoped subscription list (e.g. /phortune/subscription/?merchant=...) or calling the engine with a merchant set, as a user for whom PhabricatorPolicyFilter::hasCapability($viewer, $merchant, CAN_EDIT) returns false.

Common situations: A paying customer bookmarking the merchant billing screen instead of their account screen; a former manager whose merchant edit permission was revoked; custom application controllers linking merchant subscription lists for ordinary account members.

Related errors

• You can not query subscriptions for an account you are not a
• No valid object provided for object rule!
• You do not have permission to push to this repository.
• This transcript has an invalid or inaccessible adapter.
• err:policy

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/1dfea439f2246a94. Report an issue: GitHub.