{"record":{"id":"2554a5897d125d14","repo":"iflytek/astron-agent","slug":"exceed-authority-2554a5","errorCode":"EXCEED_AUTHORITY","errorMessage":"EXCEED_AUTHORITY","messagePattern":"EXCEED_AUTHORITY","errorType":"error_code","errorClass":"BusinessException","httpStatus":null,"severity":"error","filePath":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowAutomationService.java","lineNumber":263,"sourceCode":"        if (!isPublished(workflow)) {\n            throw new BusinessException(ResponseEnum.WORKFLOW_NOT_PUBLISH);\n        }\n        dataPermissionCheckTool.checkWorkflowBelong(workflow, SpaceInfoUtil.getSpaceId());\n        return workflow;\n    }\n\n    private WorkflowAutomationTask requireTask(Long id) {\n        WorkflowAutomationTask task = getById(id);\n        if (task == null || Boolean.TRUE.equals(task.getDeleted())) {\n            throw new BusinessException(ResponseEnum.DATA_NOT_EXIST);\n        }\n        Long spaceId = SpaceInfoUtil.getSpaceId();\n        String uid = UserInfoManagerHandler.getUserId();\n        boolean denied = spaceId == null\n                ? !Objects.equals(task.getUid(), uid)\n                : !Objects.equals(task.getSpaceId(), spaceId);\n        if (denied) {\n            throw new BusinessException(ResponseEnum.EXCEED_AUTHORITY);\n        }\n        return task;\n    }\n\n    private LambdaQueryWrapper<WorkflowAutomationTask> scopedTaskQuery() {\n        LambdaQueryWrapper<WorkflowAutomationTask> wrapper = Wrappers.lambdaQuery(WorkflowAutomationTask.class);\n        Long spaceId = SpaceInfoUtil.getSpaceId();\n        if (spaceId == null) {\n            wrapper.eq(WorkflowAutomationTask::getUid, UserInfoManagerHandler.getUserId());\n        } else {\n            wrapper.eq(WorkflowAutomationTask::getSpaceId, spaceId);\n        }\n        return wrapper;\n    }\n\n    private String normalizeInputParams(String inputParams) {\n        String normalized = StringUtils.defaultIfBlank(inputParams, \"{}\");\n        try {","sourceCodeStart":245,"sourceCodeEnd":281,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowAutomationService.java#L245-L281","documentation":"WorkflowAutomationService.requireTask() enforces per-task access control before returning a WorkflowAutomationTask. When the current request has a spaceId context, the task's spaceId must match it; otherwise the task's owner uid must match the current user. If neither matches, EXCEED_AUTHORITY is thrown, meaning the caller is not allowed to operate on this automation task.","triggerScenarios":"Calling task(id) or pageRuns(...) for an automation task owned by a different user, or from a different space than the one resolved via SpaceInfoUtil.getSpaceId(); also hitting a task after switching spaces or after the task was moved/reassigned to another owner.","commonSituations":"A user shares a workflow URL/id with a colleague who tries to view its runs; an admin operating without a space context inspects another tenant's task; a stale frontend session still points at the old space after the user switched workspaces.","solutions":["Verify the task id belongs to the current user (uid equals task.getUid()) or to the current space (task.getSpaceId() equals SpaceInfoUtil.getSpaceId()).","Log in as the task owner, or switch your console session to the space the task lives in.","If the task should be shared, recreate it in the target space or update task.spaceId/uid via an administrator operation.","Check SpaceInfoUtil.getSpaceId() is correctly populated by the auth filter; a wrong/null space context can cause false denials."],"exampleFix":"// before (caller guesses task id)\nWorkflowAutomationTask task = automationService.task(otherUsersTaskId);\n// after (caller lists only its own scoped tasks first)\nList<WorkflowAutomationTask> mine = automationService\n    .pageTasks(scopedTaskQuery())\n    .getRecords();\nWorkflowAutomationTask task = automationService.task(mine.get(0).getId());","handlingStrategy":"validation","validationCode":"boolean canAccess = Objects.equals(task.getUid(), currentUid)\n    || (currentSpaceId != null && Objects.equals(task.getSpaceId(), currentSpaceId));\nif (!canAccess) throw new AccessDeniedException(task.getId());","typeGuard":"static boolean isOwnTask(WorkflowAutomationTask t, String uid, Long spaceId) {\n    return spaceId != null\n        ? Objects.equals(t.getSpaceId(), spaceId)\n        : Objects.equals(t.getUid(), uid);\n}","tryCatchPattern":null,"preventionTips":["Always resolve tasks through the space-scoped query (scopedTaskQuery) instead of by raw id.","Keep the frontend space context in sync with the session; refetch task lists after switching spaces.","Avoid copying task ids between users/environments.","Log task id + uid + spaceId on access failures to speed diagnosis."],"tags":["authorization","access-control","multi-tenancy"],"backgroundTag":"permission-denied","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}