{"record":{"id":"23f25b9e4650c228","repo":"OtterMind/Chat2DB","slug":"common-permissiondenied","errorCode":"common.permissionDenied","errorMessage":"common.permissionDenied","messagePattern":"common\\.permissionDenied","errorType":"exception","errorClass":"PermissionDeniedBusinessException","httpStatus":null,"severity":"error","filePath":"chat2db-community-server/chat2db-community-domain/chat2db-community-domain-core/src/main/java/ai/chat2db/community/domain/core/impl/task/TaskRecordServiceImpl.java","lineNumber":75,"sourceCode":"                    task.getTaskStatus(), \"FINISHED\", STATUS_STOP, \"ERROR\")) {\n                return;\n            }\n        }\n        TaskRecordUpdateRequest request = new TaskRecordUpdateRequest();\n        request.setId(id);\n        request.setTaskStatus(STATUS_STOP);\n        request.setDownloadUrl(\"\");\n        updateTask(request);\n    }\n\n    @Override\n    public TaskDownload resolveDownload(Long id, Long userId) {\n        Task task = getTask(id);\n        if (task == null || StringUtils.isBlank(task.getDownloadUrl())) {\n            throw new DataNotFoundException();\n        }\n        if (!Objects.equals(userId, task.getUserId())) {\n            throw new PermissionDeniedBusinessException();\n        }\n\n        File file = new File(task.getDownloadUrl());\n        if (!file.exists() || !file.canRead()) {\n            throw new DataNotFoundException();\n        }\n        return TaskDownload.builder()\n                .fileName(file.getName())\n                .fileUri(file.toURI().toString())\n                .build();\n    }\n}\n","sourceCodeStart":57,"sourceCodeEnd":88,"githubUrl":"https://github.com/OtterMind/Chat2DB/blob/5ee1e990e73fbcae1969dc554be254fedb3ab888/chat2db-community-server/chat2db-community-domain/chat2db-community-domain-core/src/main/java/ai/chat2db/community/domain/core/impl/task/TaskRecordServiceImpl.java#L57-L88","documentation":"PermissionDeniedBusinessException ('common.permissionDenied') from resolveDownload when the task exists and has a URL, but task.userId does not equal the requesting userId — cross-user access attempt.","triggerScenarios":"User A calls resolveDownload(id, userIdB) for a task owned by another user; the passed userId does not match the task owner recorded at creation.","commonSituations":"Sharing a download link across accounts; client sending the wrong userId; session user switched; id enumeration attempt.","solutions":["Resolve the download using the authenticated user's own id; do not pass another user's id.","Ensure the caller's session userId is propagated correctly into resolveDownload.","If cross-user sharing is intended, add an explicit ownership/share model rather than relying on this guard."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"Task t = getTask(id);\nif (t == null) throw new DataNotFoundException();\nif (!Objects.equals(userId, t.getUserId())) throw new PermissionDeniedBusinessException();","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass the authenticated session user's id.","Do not share raw download links across accounts.","Add an explicit share/ownership model if cross-user access is required."],"tags":["auth","authorization","task","download"],"backgroundTag":null,"analyzedSha":"5ee1e990e73fbcae1969dc554be254fedb3ab888","analyzedAt":"2026-08-14T07:05:03.077Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}