OtterMind/Chat2DB · error · PermissionDeniedBusinessException

common.permissionDenied

common.permissionDenied

Error message

common.permissionDenied

What it means

PermissionDeniedBusinessException ('common.permissionDenied') from resolveDownload when the task exists and has a URL, but task.userId does not equal the requesting userId — cross-user access attempt.

Source

Thrown at chat2db-community-server/chat2db-community-domain/chat2db-community-domain-core/src/main/java/ai/chat2db/community/domain/core/impl/task/TaskRecordServiceImpl.java:75

                    task.getTaskStatus(), "FINISHED", STATUS_STOP, "ERROR")) {
                return;
            }
        }
        TaskRecordUpdateRequest request = new TaskRecordUpdateRequest();
        request.setId(id);
        request.setTaskStatus(STATUS_STOP);
        request.setDownloadUrl("");
        updateTask(request);
    }

    @Override
    public TaskDownload resolveDownload(Long id, Long userId) {
        Task task = getTask(id);
        if (task == null || StringUtils.isBlank(task.getDownloadUrl())) {
            throw new DataNotFoundException();
        }
        if (!Objects.equals(userId, task.getUserId())) {
            throw new PermissionDeniedBusinessException();
        }

        File file = new File(task.getDownloadUrl());
        if (!file.exists() || !file.canRead()) {
            throw new DataNotFoundException();
        }
        return TaskDownload.builder()
                .fileName(file.getName())
                .fileUri(file.toURI().toString())
                .build();
    }
}

View on GitHub (pinned to 5ee1e990e7)

Solutions

  1. Resolve the download using the authenticated user's own id; do not pass another user's id.
  2. Ensure the caller's session userId is propagated correctly into resolveDownload.
  3. If cross-user sharing is intended, add an explicit ownership/share model rather than relying on this guard.
Defensive patterns

Strategy: validation

Validate before calling

Task t = getTask(id);
if (t == null) throw new DataNotFoundException();
if (!Objects.equals(userId, t.getUserId())) throw new PermissionDeniedBusinessException();

Prevention

When it happens

Trigger: User A calls resolveDownload(id, userIdB) for a task owned by another user; the passed userId does not match the task owner recorded at creation.

Common situations: Sharing a download link across accounts; client sending the wrong userId; session user switched; id enumeration attempt.

Related errors

AI-assisted analysis of OtterMind/Chat2DB@5ee1e990e7 (2026-08-14). Data as JSON: /api/errors/23f25b9e4650c228. Report an issue: GitHub.