What causes "user {userName} is not has project {projectCode} permission" in apache/dolphinscheduler?

Grant the user permission on the project (Project page -> Permission, or t_ds_relation_project_user insert via admin).

apache/dolphinscheduler · error · ServiceException

30002

30002

Error message

user {userName} is not has project {projectCode} permission

What it means

Thrown by requireProjectPerm when the project exists but the current non-admin user has no relation in t_ds_relation_project_user (projectUser == null): the user neither owns the project nor was granted any permission on it. Reported as Status.USER_NO_OPERATION_PROJECT_PERM (code 30002) with userName and projectCode interpolated.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/TaskGroupServiceImpl.java:292

    }

    private void requireProjectPerm(User loginUser, long projectCode, boolean writePermission) {
        if (loginUser.getUserType() == UserType.ADMIN_USER) {
            return;
        }
        Project project = projectDao.queryByCode(projectCode);
        if (project == null) {
            log.warn("Project does not exist, projectCode:{}.", projectCode);
            throw new ServiceException(Status.PROJECT_NOT_FOUND, projectCode);
        }
        if (project.getUserId().equals(loginUser.getId())) {
            return;
        }
        ProjectUser projectUser = projectUserDao.queryProjectRelation(project.getId(), loginUser.getId());
        if (projectUser == null) {
            log.warn("User {} does not have operation permission for project {}", loginUser.getUserName(),
                    project.getCode());
            throw new ServiceException(Status.USER_NO_OPERATION_PROJECT_PERM, loginUser.getUserName(),
                    project.getCode());
        }
        if (writePermission && projectUser.getPerm() != Constants.DEFAULT_ADMIN_PERMISSION) {
            log.warn("User {} does not have write permission for project {}", loginUser.getUserName(),
                    project.getCode());
            throw new ServiceException(Status.USER_NO_WRITE_PROJECT_PERM, loginUser.getUserName(),
                    project.getCode());
        }
    }
}

View on GitHub (pinned to 02eac45a1b)

Solutions

Grant the user permission on the project (Project page -> Permission, or t_ds_relation_project_user insert via admin).
Use the project owner's or an admin account for the call.
Verify the projectCode actually refers to the intended project.
Re-run after re-adding the user to the project if access was recently revoked.

Example fix

// before
// caller assumes any authenticated user may manage task groups
taskGroupService.createTaskGroup(loginUser, name, desc, total, projectCode);
// after
ProjectUser rel = projectUserDao.queryProjectRelation(project.getId(), loginUser.getId());
if (loginUser.getUserType() != UserType.ADMIN_USER
        && !project.getUserId().equals(loginUser.getId())
        && rel == null) {
    throw new ServiceException(Status.USER_NO_OPERATION_PROJECT_PERM,
            loginUser.getUserName(), project.getCode());
}

Defensive patterns

Strategy: validation

Validate before calling

// Java: verify the user has some project relation before calling
Project project = projectDao.queryByCode(projectCode);
ProjectUser rel = projectUserDao.queryProjectRelation(project.getId(), loginUser.getId());
boolean allowed = loginUser.getUserType() == UserType.ADMIN_USER
        || project.getUserId().equals(loginUser.getId()) || rel != null;
if (!allowed) throw new ServiceException(Status.USER_NO_OPERATION_PROJECT_PERM,
        loginUser.getUserName(), project.getCode());

Type guard

boolean hasProjectAccess(User loginUser, Project project) {
    return loginUser.getUserType() == UserType.ADMIN_USER
            || project.getUserId().equals(loginUser.getId())
            || projectUserDao.queryProjectRelation(project.getId(), loginUser.getId()) != null;
}

Try / catch

try {
    taskGroupService.updateTaskGroup(loginUser, id, name, desc);
} catch (ServiceException e) {
    if (e.getCode() == 30002) {
        // request project authorization from the project owner/admin
    }
    throw e;
}

Prevention

Grant project permission to every account that runs task group automation.
Re-check access after users are removed from projects.
Use project owner or admin accounts for cross-project operations.
Keep an inventory of project-user grants used by service accounts.

When it happens

Trigger: createTaskGroup, updateTaskGroup, or queryTaskGroupByProjectCode invoked by a user who is not the project owner and has no project-user grant; calling with another user's project code; revoked project access while old tokens/scripts still run.

Common situations: Team member removed from the project but automation still uses their account; new service account never granted project permission; wrong project code pointing at someone else's project.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/73e7ad1076d5d1c6. Report an issue: GitHub.