apache/dolphinscheduler · error · ServiceException

USER_NO_OPERATION_PERM

USER_NO_OPERATION_PERM

Error message

USER_NO_OPERATION_PERM

What it means

queryAccessTokenByUser enforces that a GENERAL_USER may only query their own access tokens; if loginUser.getUserType() is GENERAL_USER and loginUser.getId() != userId, it throws ServiceException(Status.USER_NO_OPERATION_PERM). Admin users bypass this check, and for admins the userId is normalized to 0 to return all tokens.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/AccessTokenServiceImpl.java:89

        }
        IPage<AccessToken> accessTokenList = accessTokenDao.queryAccessTokenPage(page, searchVal, userId);
        pageInfo.setTotal((int) accessTokenList.getTotal());
        pageInfo.setTotalList(accessTokenList.getRecords());
        return pageInfo;
    }

    /**
     * query access token for specified user
     *
     * @param loginUser login user
     * @param userId    user id
     * @return token list for specified user
     */
    @Override
    public List<AccessToken> queryAccessTokenByUser(User loginUser, Integer userId) {
        // no permission
        if (loginUser.getUserType().equals(UserType.GENERAL_USER) && loginUser.getId() != userId) {
            throw new ServiceException(Status.USER_NO_OPERATION_PERM);
        }
        userId = loginUser.getUserType().equals(UserType.ADMIN_USER) ? 0 : userId;
        // query access token for specified user
        List<AccessToken> accessTokenList = this.accessTokenDao.queryAccessTokenByUser(userId);
        return accessTokenList;
    }

    /**
     * create token
     *
     * @param loginUser loginUser
     * @param userId token for user
     * @param expireTime token expire time
     * @param token token string (if it is absent, it will be automatically generated)
     * @return create result code
     */
    @SuppressWarnings("checkstyle:WhitespaceAround")
    @Override

View on GitHub (pinned to 02eac45a1b)

Solutions

  1. Query access tokens with your own userId, or authenticate as an ADMIN_USER when querying tokens on behalf of other users.
  2. Fix the calling client to pass the id of the currently logged-in user rather than a hard-coded or stale id.
  3. If cross-user visibility is required, have an administrator perform the query.
  4. Check UI/session handling so the correct current user id is sent after login switches.

Example fix

// before: general user querying another user's tokens
accessTokenService.queryAccessTokenByUser(loginUser, otherUserId);

// after: query own tokens, or use an admin account
accessTokenService.queryAccessTokenByUser(loginUser, loginUser.getId());
Defensive patterns

Strategy: validation

Validate before calling

// client-side check before calling the API
if (loginUser.userType == GENERAL_USER && loginUser.id != targetUserId) {
    throw new SecurityException("General users may only query their own access tokens");
}

Type guard

boolean canQuery(User loginUser, Integer targetUserId) {
    return loginUser != null && targetUserId != null
        && (loginUser.getUserType() == UserType.ADMIN_USER || loginUser.getId() == targetUserId.intValue());
}

Try / catch

try {
    return accessTokenService.queryAccessTokenByUser(loginUser, userId);
} catch (ServiceException e) {
    if (e.getCode() == Status.USER_NO_OPERATION_PERM) {
        return Collections.emptyList(); // or surface 403 to caller
    }
    throw e;
}

Prevention

When it happens

Trigger: Calling the access-token query API (GET /users/{userId}/access-tokens) as a non-admin user while passing a different user's userId, e.g. tampering with the userId path/query parameter or a UI sending the wrong id.

Common situations: Frontend caching another user's id after account switching; API consumers iterating userIds to enumerate tokens; automated scripts reusing a general-user PAT to fetch other users' tokens.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/3abd61eb7ba9b303. Report an issue: GitHub.