{"record":{"id":"03056ad1fc5de245","repo":"apache/dolphinscheduler","slug":"user-no-operation-perm-03056a","errorCode":"USER_NO_OPERATION_PERM","errorMessage":"Status.USER_NO_OPERATION_PERM","messagePattern":"Status\\.USER_NO_OPERATION_PERM","errorType":"error_code","errorClass":"ServiceException","httpStatus":null,"severity":"warning","filePath":"dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/EnvironmentServiceImpl.java","lineNumber":102,"sourceCode":"\n    /**\n     * create environment\n     *\n     * @param loginUser login user\n     * @param name environment name\n     * @param config environment config\n     * @param desc environment desc\n     * @param workerGroups worker groups\n     */\n    @Override\n    @Transactional\n    public Long createEnvironment(User loginUser,\n                                  String name,\n                                  String config,\n                                  String desc,\n                                  String workerGroups) {\n        if (!canOperatorPermissions(loginUser, null, AuthorizationType.ENVIRONMENT, ENVIRONMENT_CREATE)) {\n            throw new ServiceException(Status.USER_NO_OPERATION_PERM);\n        }\n        if (checkDescriptionLength(desc)) {\n            throw new ServiceException(Status.DESCRIPTION_TOO_LONG_ERROR);\n        }\n        checkParams(name, config, workerGroups);\n\n        Environment environment = environmentMapper.queryByEnvironmentName(name);\n        if (environment != null) {\n            throw new ServiceException(Status.ENVIRONMENT_NAME_EXISTS, name);\n        }\n\n        Environment env = new Environment();\n        env.setName(name);\n        env.setConfig(config);\n        env.setDescription(desc);\n        env.setOperator(loginUser.getId());\n        env.setCreateTime(new Date());\n        env.setUpdateTime(new Date());","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/EnvironmentServiceImpl.java#L84-L120","documentation":"USER_NO_OPERATION_PERM is thrown by createEnvironment when canOperatorPermissions denies the calling user ENVIRONMENT authorization for the ENVIRONMENT_CREATE function. Only users with environment-management permission (typically ADMIN, or users explicitly granted ENVIRONMENT auth) may create environments. The request fails authorization before any parameter validation.","triggerScenarios":"POST /dolphinscheduler/environments (createEnvironment) with a non-admin user or a service token lacking ENVIRONMENT authorization; SECURITY settings require admin role for environment creation and the caller is a regular/tenant user.","commonSituations":"Regular users attempting to create environments via API/UI; CI scripts running with a non-admin token; after an upgrade where environment management became admin-only and old automation broke.","solutions":["Use an admin account, or ask an admin to grant the user ENVIRONMENT authorization.","Update automation/CI credentials to an account with environment-management permission.","Check which user the sessionId/token actually belongs to — reused sessions often run as the wrong account.","If environments should be user-creatable, adjust the deployment's permission policy/grants accordingly."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"if (loginUser == null || loginUser.getUserType() != UserType.ADMIN_USER) {\n    throw new SecurityException(\"environment creation requires ENVIRONMENT authorization / admin role\");\n}","typeGuard":"boolean canCreateEnvironment(User u) {\n    return u != null && u.getUserType() == UserType.ADMIN_USER;\n}","tryCatchPattern":"try {\n    envService.createEnvironment(user, name, config, desc, workerGroups);\n} catch (ServiceException e) {\n    if (e.getCode() == Status.USER_NO_OPERATION_PERM) {\n        // do not retry: escalate to an admin or use an authorized service account\n    }\n}","preventionTips":["Provision automation accounts with ENVIRONMENT authorization up front.","Check the caller's role in UI/API clients before offering environment-creation actions.","Avoid reusing admin sessions for non-admin flows and vice versa.","After upgrades that change permission scope, re-audit service-account grants."],"tags":["environment","authorization","permissions"],"backgroundTag":"permission-denied","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}