phalcon/cphalcon · error · Phalcon\Auth\Exceptions\ActiveAccessRequired

No active access - call access() first

Error message

No active access - call access() first

What it means

The Auth Manager's access-check methods (allows/denies-style calls on the manager) internally require that an access component has been selected first; requireActiveAccess() throws ActiveAccessRequired when activeAccess is null. activeAccess is only set by a successful Manager::access(name) call, so invoking an access check before that - or after a failed/never-made access() call - produces this error.

Source

Thrown at phalcon/Auth/Manager.zep:219

    {
        return this->guard()->user();
    }

    /**
     * @phpstan-param AuthCredentials $credentials
     */
    public function validate(array credentials = []) -> bool
    {
        return this->guard()->validate(credentials);
    }

    /**
     * @throws Exception
     */
    private function requireActiveAccess() -> <Access>
    {
        if (this->activeAccess === null) {
            throw new ActiveAccessRequired();
        }

        return this->activeAccess;
    }

    /**
     * @throws Exception
     */
    private function requireStatefulGuard() -> <GuardStateful>
    {
        var guard;

        let guard = this->guard();

        DoesNotImplement::assert(
            guard,
            GuardStateful::class,
            "Default guard",

View on GitHub (pinned to b7419de9cd)

Solutions

1. Chain from access(): $auth->access('acl')->allows('admin.area') so the active access is set first
2. If you centralize checks, keep a single entry point that calls access() once before any allows/denies call
3. Verify 'acl' (or your access name) is registered - if access() throws, activeAccess stays null and the next call fails with this error

Example fix

// before
$auth->allows('admin.area');

// after
$auth->access('acl')->allows('admin.area');

try {
    $allowed = $auth->access('acl')->allows('admin.area');
} catch (\Phalcon\Auth\Exceptions\ActiveAccessRequired $e) {
    // access() was never called (or failed); select the access component then retry once
}

When it happens

Trigger: $auth->allows('resource') without a preceding $auth->access('acl'); calling an access method after access() threw AccessNotRegistered (so activeAccess stayed null); helper/base-controller code that calls the manager's access methods assuming a global access was pre-selected elsewhere.

Common situations: Middleware that calls an access check directly without selecting the access backend; refactoring where the access('acl') call moved into a branch that does not run; copy-pasted controller code missing the fluent access() prefix.

Related errors

• Access '{accessName}' is not registered
• Malformed ACL snapshot structure
• Access denied for {type} '{name}'
• The Acl access gate requires the 'handler' context key to de
• Authenticated user does not implement 'Phalcon\Acl\RoleAware

AI-assisted analysis of phalcon/cphalcon@b7419de9cd (2026-08-21). Data as JSON: /api/errors/ee56e0296e4feaa8. Report an issue: GitHub.