apache/dolphinscheduler · error · ServiceException

1400001

1400001

Error message

The current user does not have this permission.

What it means

ServiceException(Status.NO_CURRENT_OPERATING_PERMISSION, code 1400001) is thrown in grantProjectWithReadPerm when the login user is not an administrator. Only admins may grant read permission on projects to other users; the isAdmin(loginUser) check fails before any lookup or grant happens. It is an authorization failure on the caller's identity, independent of the target user or projects.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java:501

                // 4. delete the relationship between project and user
                this.projectUserDao.deleteProjectRelation(project.getId(), user.getId());
            }
        });
    }

    /**
     * grant project with read permission
     *
     * @param loginUser  login user
     * @param userId     user id
     * @param projectIds project id array
     * @return grant result code
     */
    @Override
    @Transactional(rollbackFor = RuntimeException.class)
    public void grantProjectWithReadPerm(User loginUser, int userId, String projectIds) {
        if (!isAdmin(loginUser)) {
            throw new ServiceException(Status.NO_CURRENT_OPERATING_PERMISSION);
        }

        // check exist
        User tempUser = userDao.queryById(userId);
        if (tempUser == null) {
            throw new ServiceException(Status.USER_NOT_EXIST, userId);
        }

        if (StringUtils.isEmpty(projectIds)) {
            return;
        }
        Arrays.stream(projectIds.split(Constants.COMMA)).distinct().forEach(projectId -> {
            ProjectUser projectUserOld = projectUserDao.queryProjectRelation(Integer.parseInt(projectId), userId);
            if (projectUserOld != null) {
                projectUserDao.deleteProjectRelation(Integer.parseInt(projectId), userId);
            }
            Date now = new Date();
            ProjectUser projectUser = new ProjectUser();

View on GitHub (pinned to 02eac45a1b)

Solutions

  1. Log in as (or use a token of) an admin user before calling this API.
  2. Grant the ADMIN_USER user type to the account in Users management if it legitimately needs this duty.
  3. Change the workflow so regular users request grants through an admin-approved path instead of calling the admin endpoint.
  4. Check the caller's role in your client code and fail fast with a clear message.

Example fix

// before
usersService.grantProjectWithReadPerm(currentUser, userId, projectIds); // throws if currentUser is not admin
// after
if (!LoginUserTypeChecker.isAdmin(currentUser)) {
    throw new SecurityException("Admin privileges required to grant project read permission");
}
usersService.grantProjectWithReadPerm(currentUser, userId, projectIds);
Defensive patterns

Strategy: validation

Validate before calling

if (loginUser == null || loginUser.getUserType() != UserType.ADMIN_USER) {
    throw new SecurityException("grantProjectWithReadPerm requires an admin user");
}

Type guard

boolean isAdminUser(User u) { return u != null && u.getUserType() == UserType.ADMIN_USER; }

Try / catch

try {
    usersService.grantProjectWithReadPerm(loginUser, userId, projectIds);
} catch (ServiceException e) {
    if (e.getCode() == 1400001) { /* not admin: switch to admin credentials */ }
    else throw e;
}

Prevention

When it happens

Trigger: Calling grantProjectWithReadPerm(loginUser, userId, projectIds) while loginUser has USER_TYPE.GENERAL_USER instead of ADMIN_USER.

Common situations: A regular user's session/token is used to call the admin-only grant REST endpoint; role downgraded after token issued; service account lacks admin role in a CI script.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/a4f1b1e022ea89f4. Report an issue: GitHub.