phacility/phabricator · error · Exception

You do not have permission to access the Diffusion applicati

Error message

You do not have permission to access the Diffusion application, so you can not interact with repositories over SSH.

What it means

Every repository SSH workflow starts by checking that the Diffusion application is installed and visible to the authenticated SSH user (PhabricatorApplication::isClassInstalledForViewer). If the user's policies hide Diffusion, the request is refused before any repository is resolved.

Source

Thrown at src/applications/diffusion/ssh/DiffusionSSHWorkflow.php:172

      'ssh %Ls -l %s -i %s -p %s %s -- %s %Ls',
      $options,
      $username,
      $key_path,
      $port,
      $host,
      '@'.$this->getSSHUser()->getUsername(),
      $this->getOriginalArguments());
  }

  final public function execute(PhutilArgumentParser $args) {
    $this->args = $args;

    $viewer = $this->getSSHUser();
    $have_diffusion = PhabricatorApplication::isClassInstalledForViewer(
      'PhabricatorDiffusionApplication',
      $viewer);
    if (!$have_diffusion) {
      throw new Exception(
        pht(
          'You do not have permission to access the Diffusion application, '.
          'so you can not interact with repositories over SSH.'));
    }

    $repository = $this->identifyRepository();
    $this->setRepository($repository);

    // NOTE: Here, we're just figuring out if this is a proxyable request to
    // a clusterized repository or not. We don't (and can't) use the URI we get
    // back directly.

    // For example, we may get a read-only URI here but be handling a write
    // request. We only care if we get back `null` (which means we should
    // handle the request locally) or anything else (which means we should
    // proxy it to an appropriate device).

    $is_cluster_request = $this->getIsClusterRequest();

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Check Applications -> Diffusion -> Policy and the default application policy settings
2. Add the user to whatever project or role the Diffusion policy requires
3. Confirm the same user can browse Diffusion in the web UI, then retry the SSH operation

// Check application visibility before invoking an SSH workflow
$viewer = $this->getSSHUser();
if (!PhabricatorApplication::isClassInstalledForViewer(
      'PhabricatorDiffusionApplication',
      $viewer)) {
  // refuse early with a policy explanation
}

When it happens

Trigger: Connecting over SSH as a user who cannot see the Diffusion application: its policy is restricted to a project the user is not in, prototypes are disabled for their roles, or the application is uninstalled.

Common situations: Installs with tightened application policies; bot or machine accounts not added to the permitted project; policy audits that accidentally lock users out.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• You do not have permission to push to this repository.
• The clone of this repository ("%s") on the local machine ("%
• Failed to generate an intracluster proxy URI even though thi
• No repository "%s" exists!
• This request is authenticated as a cluster device, but is pe

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/c5065f9c5e37d83d. Report an issue: GitHub.