apache/dolphinscheduler · error · ServiceException

USER_NO_WRITE_PROJECT_PERM

USER_NO_WRITE_PROJECT_PERM

Error message

USER_NO_WRITE_PROJECT_PERM: user ${userName} has no write permission for project ${projectCode}

What it means

Thrown by checkHasProjectWritePermissionThrowException when the user is not an admin, not the project owner, and has no PROJECT-perm-level relation with the project (or lacks DEFAULT_ADMIN_PERMISSION on that relation). Message interpolates userName and projectCode.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ProjectServiceImpl.java:224

    }

    @Override
    public void checkHasProjectWritePermissionThrowException(User loginUser, Project project) {
        if (project == null) {
            throw new ServiceException(Status.PROJECT_NOT_FOUND, null);
        }
        // case 1: user is admin
        if (loginUser.getUserType() == UserType.ADMIN_USER) {
            return;
        }
        // case 2: user is project owner
        if (project.getUserId().equals(loginUser.getId())) {
            return;
        }
        // case 3: check user permission level
        ProjectUser projectUser = projectUserDao.queryProjectRelation(project.getId(), loginUser.getId());
        if (projectUser == null || projectUser.getPerm() != Constants.DEFAULT_ADMIN_PERMISSION) {
            throw new ServiceException(Status.USER_NO_WRITE_PROJECT_PERM, loginUser.getUserName(), project.getCode());
        }
    }

    /**
     * admin can view all projects
     *
     * @param loginUser login user
     * @param searchVal search value
     * @param pageSize  page size
     * @param pageNo    page number
     * @return project list which the login user have permission to see
     */
    @Override
    public Result queryProjectListPaging(User loginUser, Integer pageSize, Integer pageNo, String searchVal) {
        Result result = new Result();
        PageInfo<Project> pageInfo = new PageInfo<>(pageNo, pageSize);
        Page<Project> page = new Page<>(pageNo, pageSize);
        Set<Integer> projectIds = resourcePermissionCheckService

View on GitHub (pinned to 02eac45a1b)

Solutions

1. Grant the user write/admin-level permission on the project (DEFAULT_ADMIN_PERMISSION in t_ds_relation_project_user)
2. Ask the project owner or an admin to perform the operation
3. Transfer project ownership if the operation should belong to this user

Example fix

// before
// no check; service call fails
projectService.checkHasProjectWritePermissionThrowException(loginUser, project);
// after
ProjectUser pu = projectUserDao.queryProjectRelation(project.getId(), loginUser.getId());
if (loginUser.getUserType() != UserType.ADMIN_USER && pu != null && pu.getPerm() != Constants.DEFAULT_ADMIN_PERMISSION) {
    pu.setPerm(Constants.DEFAULT_ADMIN_PERMISSION);
    projectUserDao.updateById(pu);
}
projectService.checkHasProjectWritePermissionThrowException(loginUser, project);

ProjectUser pu = projectUserDao.queryProjectRelation(project.getId(), loginUser.getId());
boolean canWrite = loginUser.getUserType() == UserType.ADMIN_USER
        || project.getUserId().equals(loginUser.getId())
        || (pu != null && pu.getPerm() == Constants.DEFAULT_ADMIN_PERMISSION);

boolean isOwner = loginUser != null && loginUser.getId().equals(project.getUserId());

try {
    service.checkHasProjectWritePermissionThrowException(loginUser, project);
} catch (ServiceException e) {
    if (e.getCode() == Status.USER_NO_WRITE_PROJECT_PERM) {
        putMsg(result, e.getCode(), loginUser.getUserName(), project.getCode());
        return result;
    }
    throw e;
}

When it happens

Trigger: A regular user without an adequate projectUser row calls any write operation (edit project, save workflow, etc.) guarded by this check on a project owned by someone else.

Common situations: Collaborator was granted only read access; grant was revoked; user switched accounts; project ownership transferred to another user.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• USER_NO_OPERATION_PROJECT_PERM
• USER_NO_OPERATION_PERM
• USER_NO_OPERATION_PERM
• PROJECT_NOT_EXIST
• PROJECT_NOT_FOUND

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/2cfe570e6f5f485e. Report an issue: GitHub.