apache/dolphinscheduler · error · ServiceException

30001

30001

Error message

user has no operation privilege

What it means

Raised in AlertPluginInstanceServiceImpl.getById when canOperatorPermissions denies the user access to the alert plugin instance. Only admins or users granted the relevant alert-plugin permission may view the instance; the guard protects plugin configuration details.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/AlertPluginInstanceServiceImpl.java:185

        boolean hasAssociatedAlertGroup = checkHasAssociatedAlertGroup(String.valueOf(alertPluginInstanceId));
        if (hasAssociatedAlertGroup) {
            throw new ServiceException(Status.DELETE_ALERT_PLUGIN_INSTANCE_ERROR_HAS_ALERT_GROUP_ASSOCIATED);
        }

        alertPluginInstanceMapper.deleteById(alertPluginInstanceId);
    }

    /**
     * get alert plugin instance
     *
     * @param loginUser login user
     * @param id get id
     * @return alert plugin
     */
    @Override
    public AlertPluginInstance getById(User loginUser, int id) {
        if (!canOperatorPermissions(loginUser, null, AuthorizationType.ALERT_PLUGIN_INSTANCE, ALARM_INSTANCE_MANAGE)) {
            throw new ServiceException(Status.USER_NO_OPERATION_PERM);
        }
        return alertPluginInstanceMapper.selectById(id);
    }

    @Override
    public List<AlertPluginInstanceVO> queryAll(User loginUser) {
        checkAlertPluginInstanceViewPermission(loginUser);
        List<AlertPluginInstance> alertPluginInstances = alertPluginInstanceMapper.queryAllAlertPluginInstanceList();
        return buildPluginInstanceVOList(alertPluginInstances);
    }

    @Override
    public boolean checkExistPluginInstanceName(User loginUser, String pluginInstanceName) {
        checkAlertPluginInstanceViewPermission(loginUser);
        return alertPluginInstanceMapper.existInstanceName(pluginInstanceName) == Boolean.TRUE;
    }

    @Override

View on GitHub (pinned to 02eac45a1b)

Solutions

  1. Grant the user alert-plugin-instance manage permission in the Security Center.
  2. Fetch the instance as an admin user.
  3. Check the user's permission grants for AuthorizationType.ALERT_PLUGIN_INSTANCE.
Defensive patterns

Strategy: validation

Validate before calling

if (!permissionCheck.userHasAuthorization(loginUser, AuthorizationType.ALERT_PLUGIN_INSTANCE)) {
    throw new SecurityException("user lacks ALARM_INSTANCE_MANAGE permission");
}

Try / catch

try { AlertPluginInstance inst = alertPluginInstanceService.getById(loginUser, id); } catch (ServiceException e) { if (e.getCode() == Status.USER_NO_OPERATION_PERM.getCode()) { /* redirect to permission request flow */ } throw e; }

Prevention

When it happens

Trigger: Calling the query alert-plugin-instance-by-id API with a user who has no alert-plugin-instance manage permission.

Common situations: Non-admin users inspecting alert instance details; automated dashboards using restricted service accounts.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/d1c40bf1d2dba493. Report an issue: GitHub.