{"record":{"id":"3515ac139b2cc322","repo":"apache/dolphinscheduler","slug":"user-no-operation-perm-3515ac","errorCode":"USER_NO_OPERATION_PERM","errorMessage":"USER_NO_OPERATION_PERM","messagePattern":"USER_NO_OPERATION_PERM","errorType":"error_code","errorClass":"ServiceException","httpStatus":null,"severity":"error","filePath":"dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/AlertPluginInstanceServiceImpl.java","lineNumber":101,"sourceCode":"    @Autowired\n    private RegistryClient registryClient;\n\n    /**\n     * creat alert plugin instance\n     *\n     * @param loginUser            login user\n     * @param pluginDefineId       plugin define id\n     * @param instanceName         instance name\n     * @param pluginInstanceParams plugin instance params\n     */\n    @Override\n    public AlertPluginInstance create(User loginUser,\n                                      int pluginDefineId,\n                                      String instanceName,\n                                      String pluginInstanceParams) {\n\n        if (!canOperatorPermissions(loginUser, null, AuthorizationType.ALERT_PLUGIN_INSTANCE, ALERT_INSTANCE_CREATE)) {\n            throw new ServiceException(Status.USER_NO_OPERATION_PERM);\n        }\n\n        AlertPluginInstance alertPluginInstance = new AlertPluginInstance();\n        String paramsMapJson = parsePluginParamsMap(pluginInstanceParams);\n        alertPluginInstance.setPluginInstanceParams(paramsMapJson);\n        alertPluginInstance.setInstanceName(instanceName);\n        alertPluginInstance.setPluginDefineId(pluginDefineId);\n\n        if (alertPluginInstanceMapper.existInstanceName(alertPluginInstance.getInstanceName()) == Boolean.TRUE) {\n            throw new ServiceException(Status.PLUGIN_INSTANCE_ALREADY_EXISTS);\n        }\n\n        int i = alertPluginInstanceMapper.insert(alertPluginInstance);\n        if (i > 0) {\n            log.info(\"Create alert plugin instance complete, name:{}\", alertPluginInstance.getInstanceName());\n            return alertPluginInstance;\n        }\n        throw new ServiceException(Status.SAVE_ERROR);","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/AlertPluginInstanceServiceImpl.java#L83-L119","documentation":"Thrown by AlertPluginInstanceServiceImpl.create when the calling user lacks create permission for alert plugin instances (canOperatorPermissions with AuthorizationType.ALERT_PLUGIN_INSTANCE and ALERT_INSTANCE_CREATE fails). Alert plugin instance management is admin/authorized-only.","triggerScenarios":"Calling POST /alert-plugin-instances (AlertPluginInstanceService.create) with a loginUser who has no ALERT_PLUGIN_INSTANCE create permission.","commonSituations":"Non-admin users attempting to configure alert channels via API; automation using a low-privilege token; permission revocations unnoticed by long-running scripts.","solutions":["Use an admin account (or one authorized for alert plugin instances)","Have an admin grant ALERT_PLUGIN_INSTANCE authorization to the user","Verify user permissions before invoking create"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"boolean canCreate = permissionService.hasPermission(loginUser, null, AuthorizationType.ALERT_PLUGIN_INSTANCE, ALERT_INSTANCE_CREATE);\nif (!canCreate) throw new IllegalStateException(\"no permission to create alert plugin instance\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use admin accounts for alert plugin instance provisioning","Grant ALERT_PLUGIN_INSTANCE authorization where needed","Rotate tokens after permission changes and re-verify"],"tags":["permissions","authorization","api"],"backgroundTag":"permission-denied","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}