{"record":{"id":"3e1b4547b064ff10","repo":"iflytek/astron-agent","slug":"insufficient-permissions-businessexception-responseenum","errorCode":"INSUFFICIENT_PERMISSIONS","errorMessage":"BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS)","messagePattern":"BusinessException\\(ResponseEnum\\.INSUFFICIENT_PERMISSIONS\\)","errorType":"error_code","errorClass":"BusinessException","httpStatus":null,"severity":"error","filePath":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/skill/SkillSandboxConfigService.java","lineNumber":165,"sourceCode":"            assertWorkflowExecutionScope(workflow, uid, spaceId);\n            config = getActiveConfigForTrustedScope(workflow.getUid(), workflow.getSpaceId());\n        } else {\n            config = getActiveConfigForTrustedScope(uid, spaceId);\n        }\n        if (config == null) {\n            throw new BusinessException(ResponseEnum.DATA_NOT_EXIST);\n        }\n        return new SkillSandboxRuntimeCredentialDto(\n                normalizeProvider(config.getProvider()),\n                config.getApiKey(),\n                normalizeTimeout(config.getTimeoutSeconds()),\n                Boolean.TRUE.equals(config.getAllowInternetAccess()));\n    }\n\n    private void assertWorkflowExecutionScope(Workflow workflow, String uid, Long spaceId) {\n        if (workflow.getSpaceId() == null) {\n            if (spaceId != null || !StringUtils.equals(workflow.getUid(), uid)) {\n                throw new BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS);\n            }\n            return;\n        }\n        if (!java.util.Objects.equals(workflow.getSpaceId(), spaceId)) {\n            throw new BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS);\n        }\n    }\n\n    private SkillSandboxConfig getActiveConfig(String uid, Long spaceId) {\n        SkillSandboxConfig config = getScopedConfig(uid, spaceId);\n        if (config == null\n                || !Boolean.TRUE.equals(config.getEnabled())\n                || StringUtils.isBlank(config.getApiKey())) {\n            return null;\n        }\n        return config;\n    }\n","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/skill/SkillSandboxConfigService.java#L147-L183","documentation":"assertWorkflowExecutionScope enforces that the caller may only obtain credentials for workflows it owns. For personal workflows (spaceId null), the caller's spaceId must be null AND uid must equal the workflow owner; otherwise INSUFFICIENT_PERMISSIONS is thrown.","triggerScenarios":"Requesting runtime credentials with a personal workflow (workflow.spaceId == null) while passing a non-null spaceId, or passing a uid different from the workflow owner.","commonSituations":"A service or another user trying to fetch credentials for someone else's personal sandbox; a client incorrectly including the spaceId of the current UI context for a personal workflow.","solutions":["For personal workflows, omit the spaceId parameter entirely.","Use the workflow owner's uid, or act as the owning user.","If a shared/space-scoped credential is needed, move the workflow into the space or create a space-scoped sandbox config.","Verify ownership before calling (compare workflow.uid to your uid)."],"exampleFix":"// before\ngetRuntimeCredential(token, flowId, myUid, 42L); // personal workflow, wrong spaceId\n// after\ngetRuntimeCredential(token, flowId, workflow.getUid(), null);","handlingStrategy":"validation","validationCode":"if (workflow.getSpaceId() == null && (spaceId != null || !workflow.getUid().equals(uid))) {\n    throw new IllegalArgumentException(\"Personal workflow requires owner uid and no spaceId\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    cred = getRuntimeCredential(token, flowId, uid, spaceId);\n} catch (BusinessException e) {\n    if (\"INSUFFICIENT_PERMISSIONS\".equals(e.getCode())) fallBackToOwnerOwnedRequest();\n}","preventionTips":["Only request credentials for workflows you own or share via your space.","Omit spaceId for personal workflows.","Check workflow ownership in the client before issuing the request."],"tags":["java","authorization","scope","security"],"backgroundTag":"insufficient-permissions","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}