toeverything/AFFiNE · error · ToolError

DOC_ACCESS_DENIED

DOC_ACCESS_DENIED

Error message

Document access denied.

What it means

The copilot Doc Read tool performs an ACL check (Doc.Read) for the user on the target doc; when access is denied it does not throw but returns a structured toolError payload 'Doc Read Failed' with code DOC_ACCESS_DENIED and retryable: false, after logging a warning.

Source

Thrown at packages/backend/server/src/plugins/copilot/tools/doc-read.ts:69

        }
      );
    }

    const workspace = await models.workspace.get(options.workspace);
    if (!workspace) {
      return workspaceSyncRequiredError();
    }

    const canAccess = await ac
      .user(options.user)
      .workspace(options.workspace)
      .doc(docId)
      .can('Doc.Read');
    if (!canAccess) {
      logger.warn(
        `User ${options.user} does not have access to doc ${docId} in workspace ${options.workspace}`
      );
      return toolError('Doc Read Failed', 'Document access denied.', {
        code: 'DOC_ACCESS_DENIED',
        retryable: false,
        locator: { doc_id: docId },
      });
    }

    const docMeta = await models.doc.getAuthors(options.workspace, docId);
    if (!docMeta) {
      return documentSyncPendingError(docId);
    }

    const content = await docReader.getDocMarkdown(
      options.workspace,
      docId,
      true
    );
    if (!content) {
      return documentSyncPendingError(docId);

View on GitHub (pinned to b4c8548c09)

Solutions

1. Obtain read permission for the document.
2. Use a document accessible to the user.

When it happens

Trigger: Returned as DOC_ACCESS_DENIED by doc_read when the Doc.Read permission check on the document fails.

Common situations: The user cannot read this page due to workspace permissions. Obtain read access from the document owner or admin.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of toeverything/AFFiNE@b4c8548c09 (2026-08-18). Data as JSON: /api/errors/d5fdb729619377c3. Report an issue: GitHub.