phacility/phabricator · error · Exception

You can not query subscriptions for an account you are not a

Error message

You can not query subscriptions for an account you are not a member of.

What it means

Thrown by PhortuneSubscriptionSearchEngine when the query is scoped to an account on which the viewer lacks CAN_EDIT (in practice, an account they are not a member or manager of). Account subscription listings are only for account members, so the capability check gates the query. It protects one customer from querying another customer's subscriptions.

Source

Thrown at src/applications/phortune/query/PhortuneSubscriptionSearchEngine.php:71

    if ($merchant) {
      $can_edit = PhabricatorPolicyFilter::hasCapability(
        $viewer,
        $merchant,
        PhabricatorPolicyCapability::CAN_EDIT);
      if (!$can_edit) {
        throw new Exception(
          pht(
            'You can not query subscriptions for a merchant you do not '.
            'control.'));
      }
      $query->withMerchantPHIDs(array($merchant->getPHID()));
    } else if ($account) {
      $can_edit = PhabricatorPolicyFilter::hasCapability(
        $viewer,
        $account,
        PhabricatorPolicyCapability::CAN_EDIT);
      if (!$can_edit) {
        throw new Exception(
          pht(
            'You can not query subscriptions for an account you are not '.
            'a member of.'));
      }
      $query->withAccountPHIDs(array($account->getPHID()));
    } else {
      $accounts = id(new PhortuneAccountQuery())
        ->withMemberPHIDs(array($viewer->getPHID()))
        ->execute();
      if ($accounts) {
        $query->withAccountPHIDs(mpull($accounts, 'getPHID'));
      } else {
        throw new Exception(pht('You have no accounts!'));
      }
    }

    return $query;
  }

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Use the subscription list for your own account (no account parameter).
2. Have an account manager add the user to the account.
3. In custom code, verify CAN_EDIT on the account before scoping the engine to it, and return 403 otherwise.

$can_edit = PhabricatorPolicyFilter::hasCapability(
  $viewer,
  $account,
  PhabricatorPolicyCapability::CAN_EDIT);
if (!$can_edit) {
  return new Aphront403Response();
}
// viewer is a member/manager: account-scoped query is safe

When it happens

Trigger: Calling the subscription search engine with an account set (e.g. /phortune/subscription/?account=...) for a viewer where PhabricatorPolicyFilter::hasCapability($viewer, $account, CAN_EDIT) returns false, such as a hand-edited URL pointing at someone else's account PHID.

Common situations: Users guessing or sharing account URLs; users removed from an account but keeping old links; automated tools iterating account PHIDs without membership.

Related errors

• You can not query subscriptions for a merchant you do not co
• No valid object provided for object rule!
• You do not have permission to push to this repository.
• This transcript has an invalid or inaccessible adapter.
• err:policy

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/899ed7a3144d1a1f. Report an issue: GitHub.