vxcontrol/pentagi · error

permission 'resources.view' required to use resource IDs

Error message

permission 'resources.view' required to use resource IDs

What it means

validateServiceResources rejects requests that attach resource IDs to an assistant or flow when the caller's privilege set contains neither 'resources.admin' nor 'resources.view'. Only admins may bypass the view permission; regular users must hold 'resources.view' to reference any resource IDs at all. This is an authorization gate before any database lookup happens.

Source

Thrown at backend/pkg/server/services/assistants.go:657

		UpdatedAt:          database.TimeToNullTime(assistant.UpdatedAt),
		DeletedAt:          database.PtrTimeToNullTime(assistant.DeletedAt),
		ModelProviderType:  database.ProviderType(assistant.ModelProviderType),
		ToolCallIDTemplate: assistant.ToolCallIDTemplate,
	}, nil
}

// validateServiceResources fetches and validates user resource ownership for REST handlers.
// It mirrors the logic in validateUserResources from the graph package but works with *gorm.DB.
// privs must contain at least "resources.view" or "resources.admin"; otherwise permission is denied.
// "resources.admin" bypasses the user_id ownership check.
func validateServiceResources(db *gorm.DB, uid uint64, privs []string, ids []uint64) ([]database.UserResource, error) {
	if len(ids) == 0 {
		return nil, nil
	}

	isAdmin := slices.Contains(privs, "resources.admin")
	if !isAdmin && !slices.Contains(privs, "resources.view") && len(ids) > 0 {
		return nil, fmt.Errorf("permission 'resources.view' required to use resource IDs")
	}

	var recs []models.UserResource
	if err := db.Model(&models.UserResource{}).Where("id IN (?)", ids).Find(&recs).Error; err != nil {
		return nil, fmt.Errorf("failed to fetch resources: %w", err)
	}

	found := make(map[uint64]models.UserResource, len(recs))
	for _, r := range recs {
		found[r.ID] = r
	}

	result := make([]database.UserResource, 0, len(ids))
	for _, id := range ids {
		r, ok := found[id]
		if !ok {
			return nil, fmt.Errorf("resource %d not found", id)
		}

View on GitHub (pinned to ea665308ba)

Solutions

1. Grant the 'resources.view' privilege to the user's role (insert into privileges for that role_id).
2. Use a role with 'resources.admin' if the integration must reference any user's resources.
3. Remove resource IDs from the request payload if they are not needed.
4. If only visibility is required for the flow, restructure the request so resources are attached later by a privileged user.
5. Audit the effective privileges endpoint to confirm which privileges the caller's role actually carries.

Example fix

-- grant view privilege to role 2
INSERT INTO privileges (role_id, name) VALUES (2, 'resources.view')
ON CONFLICT DO NOTHING;

func canUseResources(privs []string, ids []int64) error {
    if len(ids) == 0 {
        return nil
    }
    if !slices.Contains(privs, "resources.admin") && !slices.Contains(privs, "resources.view") {
        return fmt.Errorf("caller lacks 'resources.view' — required to attach resource IDs")
    }
    return nil
}

func hasResourceAccess(privs []string) bool {
    return slices.Contains(privs, "resources.admin") || slices.Contains(privs, "resources.view")
}

ids, err := validateServiceResources(ctx, uid, privs, rawIDs)
if err != nil {
    if strings.Contains(err.Error(), "permission 'resources.view' required") {
        return nil, fmt.Errorf("your role cannot attach resources; request the 'resources.view' privilege")
    }
    return nil, err
}

When it happens

Trigger: Calling CreateFlowAssistant, PatchAssistant, CreateFlow, or PatchFlow with a non-empty resource ID list while the authenticated user's privileges (from their role) lack both 'resources.admin' and 'resources.view'.

Common situations: Deploying a flow via API with a token/role that wasn't granted resources.view; reduced-privilege service accounts created for automation; after an admin tightened role privileges and existing integrations started failing.

Related errors

• resource %d not accessible
• Token.Unauthorized
• You do not have permission to execute the api.
• user has been blocked
• knowledge: get user document %s: %w

AI-assisted analysis of vxcontrol/pentagi@ea665308ba (2026-09-01). Data as JSON: /api/errors/dc00d4dda39453d4. Report an issue: GitHub.