{"record":{"id":"2fff03aeb0ef5c3a","repo":"iflytek/astron-agent","slug":"exceed-authority-2fff03","errorCode":"EXCEED_AUTHORITY","errorMessage":"EXCEED_AUTHORITY","messagePattern":"EXCEED_AUTHORITY","errorType":"error_code","errorClass":"BusinessException","httpStatus":null,"severity":"warning","filePath":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/DataPermissionCheckTool.java","lineNumber":131,"sourceCode":"        return ownerUid != null && ownerUid.equals(bizConfig.getAdminUid());\n    }\n\n    /**\n     * Throw access denied exception when resource is not visible (and print necessary context).\n     *\n     * @param action the action being performed\n     * @param resource the resource being accessed\n     * @throws BusinessException with EXCEED_AUTHORITY error\n     */\n    private void deny(String action, Object resource) {\n        String uid = UserInfoManagerHandler.getUserId();\n        log.warn(\n                \"Permission check failed: action={}, uid={}, currentSpaceId={}, resourceType={}\",\n                action,\n                uid,\n                currentSpaceId(),\n                resource == null ? null : resource.getClass().getSimpleName());\n        throw new BusinessException(ResponseEnum.EXCEED_AUTHORITY);\n    }\n\n    // ===================== Repo / Tool / File =====================\n\n    /**\n     * Check repository ownership.\n     *\n     * @param repo the repository to check\n     * @throws BusinessException if access denied or data not exists\n     */\n    public void checkRepoBelong(Repo repo) {\n        if (repo == null)\n            throw new BusinessException(ResponseEnum.DATA_NOT_EXIST);\n        String uid = getThreadLocalUidNoNull();\n        Long spaceId = currentSpaceId();\n\n        boolean noPermission = spaceId != null\n                ? !Objects.equals(repo.getSpaceId(), spaceId)","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/DataPermissionCheckTool.java#L113-L149","documentation":"DataPermissionCheckTool.deny(action, resource) is the central access-denied exit for all ownership/visibility checks (checkRepoBelong, checkRepoVisible, checkToolBelong, checkFileBelong, checkToolVisible, checkBotBelong, ...). When the resource's spaceId/owner uid does not match the current Space context or current user (and the user is not public-visible or admin), it logs a warn with action, uid, spaceId and resource type, then throws BusinessException(EXCEED_AUTHORITY). This is the platform's 'you are not allowed to touch this resource' signal, not a bug in the calling code per se.","triggerScenarios":"Accessing (read/update/delete) a repo, tool, file, bot, workflow, DB or eval resource owned by another user when no Space context is set (SpaceInfoUtil.getSpaceId()==null and resource.getUserId() != current uid), or accessing a resource whose spaceId differs from the current space header; also when the resource is not public and the caller is not the configured admin uid.","commonSituations":"User A trying to edit/delete User B's bot, tool or knowledge repo via forged or stale IDs; a member operating in the wrong space (space header/X-Space-Id pointing to another space than the resource's); sharing/visibility rules changed so a formerly group-visible resource is now private; automation scripts reusing another account's resources.","solutions":["Confirm from the warn log ('Permission check failed: action=..., uid=..., currentSpaceId=..., resourceType=...') whether the mismatch is user-based or space-based.","Operate within the correct space: send the request with the space context matching the resource's spaceId, or switch spaces in the console.","Use resources owned by the authenticated uid, or have the owner/grantor publish the resource (isPublic=true) or add proper group visibility so the check passes legitimately.","If access should genuinely be granted, have an administrator perform the operation or adjust the visibility/ownership data in the corresponding tables — do not bypass the check in code."],"exampleFix":"// before — caller uses whatever repo id arrives\nRepo repo = repoMapper.selectById(repoId);\ndataPermissionCheckTool.checkRepoBelong(repo);\n// after — return a clean 403 to the client instead of leaking a raw 500\ntry {\n    dataPermissionCheckTool.checkRepoBelong(repo);\n} catch (BusinessException e) {\n    if (ResponseEnum.EXCEED_AUTHORITY.equals(e.getEnum())) {\n        throw new BusinessException(ResponseEnum.EXCEED_AUTHORITY, \"repo \" + repoId + \" is not accessible in current space\");\n    }\n    throw e;\n}","handlingStrategy":"validation","validationCode":"// caller-side pre-check mirroring the tool's rule\nString uid = UserInfoManagerHandler.getUserId();\nLong spaceId = SpaceInfoUtil.getSpaceId();\nboolean allowed = spaceId != null\n        ? Objects.equals(repo.getSpaceId(), spaceId)\n        : Objects.equals(repo.getUserId(), String.valueOf(uid));\nif (!allowed && !Boolean.TRUE.equals(repo.getIsPublic())) {\n    throw new BusinessException(ResponseEnum.EXCEED_AUTHORITY);\n}","typeGuard":null,"tryCatchPattern":"try {\n    dataPermissionCheckTool.checkRepoVisible(repo);\n} catch (BusinessException e) {\n    if (ResponseEnum.EXCEED_AUTHORITY.equals(e.getEnum())) {\n        log.warn(\"access denied by permission check, resource={}, space={}\", repo.getId(), SpaceInfoUtil.getSpaceId());\n        throw new BusinessException(ResponseEnum.EXCEED_AUTHORITY, \"resource not accessible in current space\");\n    }\n    throw e;\n}","preventionTips":["Always send the correct space header so SpaceInfoUtil context matches the resource being accessed.","Check the warn log 'Permission check failed: action=..., uid=..., currentSpaceId=...' to diagnose ownership vs space mismatches.","Verify resource visibility (isPublic / group visibility) before sharing links to other users' repos, tools or bots.","Use the owning account or an admin for administrative operations instead of retrying a denied request."],"tags":["authorization","permission","multi-tenant","space","ownership"],"backgroundTag":"permission-denied","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}