{"record":{"id":"364ec4324172da77","repo":"apache/dolphinscheduler","slug":"30001-364ec4","errorCode":"30001","errorMessage":"user has no operation privilege","messagePattern":"user has no operation privilege","errorType":"exception","errorClass":"ServiceException","httpStatus":null,"severity":"error","filePath":"dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/WorkerGroupServiceImpl.java","lineNumber":118,"sourceCode":"\n    /**\n     * create or update a worker group\n     *\n     * @param loginUser login user\n     * @param id        worker group id\n     * @param name      worker group name\n     * @param addrList  addr list\n     * @return create or update result code\n     */\n    @Override\n    public WorkerGroup saveWorkerGroup(User loginUser,\n                                       int id,\n                                       String name,\n                                       String addrList,\n                                       String description) {\n        if (!canOperatorPermissions(loginUser, null, AuthorizationType.WORKER_GROUP, WORKER_GROUP_CREATE)) {\n            // todo: add permission exception\n            throw new ServiceException(Status.USER_NO_OPERATION_PERM);\n        }\n        if (StringUtils.isEmpty(name)) {\n            throw new ServiceException(Status.NAME_NULL);\n        }\n        checkWorkerGroupAddrList(addrList);\n        final Date now = new Date();\n        final WorkerGroup workerGroup;\n        try {\n            if (id == 0) {\n                // insert\n                workerGroup = new WorkerGroup();\n                workerGroup.setCreateTime(now);\n                workerGroup.setName(name);\n                workerGroup.setAddrList(addrList);\n                workerGroup.setUpdateTime(now);\n                workerGroup.setDescription(description);\n                workerGroupDao.insert(workerGroup);\n            } else {","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/WorkerGroupServiceImpl.java#L100-L136","documentation":"Status.USER_NO_OPERATION_PERM (30001) in WorkerGroupServiceImpl.saveWorkerGroup is thrown when the login user lacks WORKER_GROUP create/update permission (canOperatorPermissions with AuthorizationType.WORKER_GROUP and WORKER_GROUP_CREATE fails). Only authorized admins/managers may create or modify worker groups.","triggerScenarios":"Calling the worker-group save endpoint (create or update) with a user whose permissions do not include worker-group management; permission is checked before name validation, so it fires first for unauthorized users.","commonSituations":"Non-admin UI users opening the worker-group page and submitting; automation tokens scoped to a project without worker-group authorization; role changes that removed WORKER_GROUP grant.","solutions":["Use an account with worker-group management authorization (typically admin).","Grant the user WORKER_GROUP authorization via the security/permission management APIs.","Verify the session/token is for the intended (privileged) user, not a stale or wrong one.","In client code, hide/disable worker-group edit UI unless the user has the permission."],"exampleFix":"// before\nworkerGroupService.saveWorkerGroup(devUser, 0, \"grp\", \"ip:1234\", \"\"); // 30001\n// after\nif (isAdmin(loginUser)) {\n    workerGroupService.saveWorkerGroup(loginUser, 0, \"grp\", \"ip:1234\", \"\");\n}","handlingStrategy":"validation","validationCode":"boolean allowed = loginUser.getUserType() == UserType.ADMIN_USER;\nif (!allowed) { throw new SecurityException(\"WORKER_GROUP_CREATE permission required\"); }","typeGuard":null,"tryCatchPattern":"try {\n    workerGroupService.saveWorkerGroup(loginUser, id, name, addrList, desc);\n} catch (ServiceException e) {\n    if (e.getCode() == 30001) { /* no worker-group permission */ }\n}","preventionTips":["Grant WORKER_GROUP authorization to accounts that manage worker groups","Use admin sessions for worker-group administration endpoints","Hide worker-group edit controls for unauthorized UI users","After role changes, re-authenticate to refresh the session's permissions"],"tags":["permissions","worker-group","authorization"],"backgroundTag":"permission-denied","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}