{"record":{"id":"488971f32cdc3f98","repo":"iflytek/astron-agent","slug":"60004-error-insufficient-permissions","errorCode":"60004","errorMessage":"error.insufficient.permissions","messagePattern":"error\\.insufficient\\.permissions","errorType":"error_code","errorClass":"BusinessException","httpStatus":null,"severity":"error","filePath":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/VersionService.java","lineNumber":199,"sourceCode":"    }\n\n    @Transactional\n    public ApiResult<JSONObject> createForBoundBotPublish(\n            WorkflowVersion createDto, String executionUid, Long executionSpaceId) {\n        log.info(\n                \"Starting to add workflow version for bound bot publish, flowId={}, botId={}, publishChannel={}\",\n                createDto.getFlowId(),\n                createDto.getBotId(),\n                createDto.getPublishChannel());\n        Workflow workflow = requireWorkflow(createDto.getFlowId());\n        assertWorkflowExecutionScope(workflow, executionUid, executionSpaceId);\n        return createVersion(createDto, workflow, executionUid, executionSpaceId);\n    }\n\n    private void assertWorkflowExecutionScope(\n            Workflow workflow, String executionUid, Long executionSpaceId) {\n        if (StringUtils.isBlank(executionUid)) {\n            throw new BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS);\n        }\n        if (executionSpaceId == null) {\n            if (workflow.getSpaceId() != null\n                    || !Objects.equals(workflow.getUid(), executionUid)) {\n                throw new BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS);\n            }\n            return;\n        }\n        if (!Objects.equals(workflow.getSpaceId(), executionSpaceId)\n                || spaceUserService == null\n                || spaceUserService.getRole(executionSpaceId, executionUid) == null) {\n            throw new BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS);\n        }\n    }\n\n    private ApiResult<JSONObject> createVersion(\n            WorkflowVersion createDto, Workflow workflow, String executionUid, Long executionSpaceId) {\n        try {","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/VersionService.java#L181-L217","documentation":"VersionService.assertWorkflowExecutionScope throws INSUFFICIENT_PERMISSIONS (code 60004) when executionUid is blank. Version creation/deletion/update always requires an identified acting user; an anonymous or unauthenticated execution context cannot be authorized.","triggerScenarios":"Calling createForSpace, createForBoundBotPublish, restore, logicDelete, updateChannelResult (or its bound-bot variant) with a null/empty executionUid in the security context or request.","commonSituations":"Calls from background jobs or webhooks that never propagate the user identity; unauthenticated test calls; a broken auth filter that fails to populate the uid.","solutions":["Ensure the caller is authenticated so executionUid is populated before invoking the service","Pass the acting user's uid explicitly when invoking from internal jobs","Fix the auth filter/interceptor that is dropping the uid from the context"],"exampleFix":"// before\nversionService.logicDelete(workflowId, null, spaceId);\n// after\nversionService.logicDelete(workflowId, currentUser.getUid(), spaceId);","handlingStrategy":"validation","validationCode":"if (uid == null || uid.isBlank()) { throw new IllegalStateException(\"executionUid is required before calling VersionService\"); }","typeGuard":"boolean hasUid(String uid) { return uid != null && !uid.isBlank(); }","tryCatchPattern":"try { versionService.restore(id, uid, spaceId); } catch (BusinessException e) { if (e.getCode() == 60004) { /* redirect to login / fix identity propagation */ } else throw e; }","preventionTips":["Propagate the authenticated uid into all internal/background calls","Add integration tests asserting auth context is populated","Fail fast in callers when the security context is anonymous"],"tags":["java","spring-boot","workflow","authorization"],"backgroundTag":"insufficient-permissions","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}