phacility/phabricator · error · Exception

You do not have permission to push to this repository.

Error message

You do not have permission to push to this repository.

What it means

Policy denial from requireWriteAccess(): PhabricatorPolicyFilter::hasCapability() returned false for DiffusionPushCapability, so the SSH-authenticated viewer does not satisfy the repository's Push policy. The check only runs after the read-only and protocol checks pass, so at this point the repository is writable over SSH but not by this user.

Source

Thrown at src/applications/diffusion/ssh/DiffusionSSHWorkflow.php:283

      throw new Exception(
        pht(
          'This request is authenticated as a cluster device, but is '.
          'performing a write. Writes must be performed with a real '.
          'user account.'));
    }

    if ($repository->isReadOnly()) {
      throw new Exception($repository->getReadOnlyMessageForDisplay());
    }

    $protocol = PhabricatorRepositoryURI::BUILTIN_PROTOCOL_SSH;
    if ($repository->canServeProtocol($protocol, true)) {
      $can_push = PhabricatorPolicyFilter::hasCapability(
        $viewer,
        $repository,
        DiffusionPushCapability::CAPABILITY);
      if (!$can_push) {
        throw new Exception(
          pht('You do not have permission to push to this repository.'));
      }
    } else {
      if ($protocol_command !== null) {
        throw new Exception(
          pht(
            'This repository is read-only over SSH (tried to execute '.
            'protocol command "%s").',
            $protocol_command));
      } else {
        throw new Exception(
          pht('This repository is read-only over SSH.'));
      }
    }

    $this->hasWriteAccess = true;
    return $this->hasWriteAccess;
  }

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Ask a repository editor to widen the Push policy (Repository -> Edit Policies -> Push) or add the user to the project/group it names
2. Verify which account the SSH key maps to (ssh user@host whoami) - a key attached to the wrong account is a common cause
3. As admin, review the effective policy on the repository's Manage page and test it for the affected user

$can_push = PhabricatorPolicyFilter::hasCapability(
  $viewer,
  $repository,
  DiffusionPushCapability::CAPABILITY);
if (!$can_push) {
  // deny early with a policy explanation
}

When it happens

Trigger: git push / hg push / svn commit over SSH by a user whose account is not allowed by the repository's Push policy (e.g. policy is 'Project Members' and the viewer is not a member), or whose SSH key authenticates as a different, unprivileged account.

Common situations: New developers not added to the pushing project; pushes using a service account that lost access; push policy tightened from 'All Users' to a restricted policy during a lockdown.

Related errors

• You do not have permission to access the Diffusion applicati
• This repository is currently in read-only maintenance mode.
• This repository is read-only over SSH (tried to execute prot
• This repository is read-only over SSH.
• You can not accept this commit because you are the commit au

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/55a4f0dd0d4f631a. Report an issue: GitHub.