What causes "USER_NO_OPERATION_PROJECT_PERM" in apache/dolphinscheduler?

Grant the user permission on the project (project manage -> add authorized user, or POST /users/grant-project)

apache/dolphinscheduler · error · ServiceException

USER_NO_OPERATION_PROJECT_PERM

USER_NO_OPERATION_PROJECT_PERM

Error message

USER_NO_OPERATION_PROJECT_PERM

What it means

Thrown by checkProjectAndAuthThrowException when canOperatorPermissions reports the login user lacks the requested permission on the project (AuthorizationType.PROJECTS). The message includes the user name and project code. The project exists but the user may not perform the operation.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ProjectServiceImpl.java:188

        putMsg(result, Status.SUCCESS);
        return result;
    }

    @Override
    public Project queryByName(User loginUser, String projectName) {
        Project project = projectDao.queryByName(projectName);
        checkProjectAndAuthThrowException(loginUser, project, PROJECT);
        return project;
    }

    @Override
    public void checkProjectAndAuthThrowException(@NonNull User loginUser, @Nullable Project project,
                                                  String permission) {
        if (project == null) {
            throw new ServiceException(Status.PROJECT_NOT_EXIST);
        }
        if (!canOperatorPermissions(loginUser, new Object[]{project.getId()}, AuthorizationType.PROJECTS, permission)) {
            throw new ServiceException(Status.USER_NO_OPERATION_PROJECT_PERM, loginUser.getUserName(),
                    project.getCode());
        }
    }

    @Override
    public void checkProjectAndAuthThrowException(User loginUser, Long projectCode, String permission) {
        if (projectCode == null) {
            throw new ServiceException(Status.PROJECT_NOT_EXIST);
        }
        Project project = projectDao.queryByCode(projectCode);
        checkProjectAndAuthThrowException(loginUser, project, permission);
    }

    @Override
    public void checkHasProjectWritePermissionThrowException(User loginUser, long projectCode) {
        Project project = projectDao.queryByCode(projectCode);
        checkHasProjectWritePermissionThrowException(loginUser, project);
    }

View on GitHub (pinned to 02eac45a1b)

Solutions

Grant the user permission on the project (project manage -> add authorized user, or POST /users/grant-project)
Log in as the project owner or an admin user
Use the projectCode overload to confirm the correct project is being targeted; verify grants via queryAuthorizedProject
Check the permission string passed matches the intended operation

Example fix

// before
projectService.checkProjectAndAuthThrowException(loginUser, project, Permissions.WRITE);
// after
ProjectUser relation = projectUserDao.queryProjectRelation(project.getId(), loginUser.getId());
if (loginUser.getUserType() != UserType.ADMIN_USER
        && !project.getUserId().equals(loginUser.getId())
        && (relation == null || relation.getPerm() != Constants.DEFAULT_ADMIN_PERMISSION)) {
    putMsg(result, Status.USER_NO_OPERATION_PROJECT_PERM, loginUser.getUserName(), project.getCode());
    return result;
}
projectService.checkProjectAndAuthThrowException(loginUser, project, Permissions.WRITE);

Defensive patterns

Strategy: try-catch

Validate before calling

Project project = projectDao.queryByCode(projectCode);
boolean canOp = loginUser.getUserType() == UserType.ADMIN_USER
        || project.getUserId().equals(loginUser.getId())
        || (projectUserDao.queryProjectRelation(project.getId(), loginUser.getId()) != null);

Type guard

boolean isAuthorized = loginUser != null
        && (loginUser.getUserType() == UserType.ADMIN_USER
            || loginUser.getId().equals(project.getUserId()));

Try / catch

try {
    service.checkProjectAndAuthThrowException(loginUser, project, Permissions.WRITE);
} catch (ServiceException e) {
    if (e.getCode() == Status.USER_NO_OPERATION_PROJECT_PERM) {
        putMsg(result, e.getCode(), loginUser.getUserName(), projectCode);
        return result;
    }
    throw e;
}

Prevention

Grant project permissions to collaborators up front
Verify permissions via queryAuthorizedProject before write operations
Use admin/owner accounts for cross-project maintenance

When it happens

Trigger: A non-admin user calls queryByCode/queryByName/deleteProject/queryAuthorizedUser (or any path that goes through this check) for a project they are not authorized on with the given permission string.

Common situations: Sharing a project code with a teammate who has no grant; user was removed from the project's authorized users; role downgraded after a permission revocation; front-end caching an old permission level.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/5a9f677605626207. Report an issue: GitHub.