{"record":{"id":"48cd769a5400906c","repo":"apolloconfig/apollo","slug":"access-is-denied","errorCode":null,"errorMessage":"Access is denied","messagePattern":"Access is denied","errorType":"http","errorClass":"AccessDeniedException","httpStatus":403,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/AppController.java","lineNumber":362,"sourceCode":"      return Collections.emptyList();\n    }\n    return apps.stream()\n        .filter(\n            app -> app != null && hasReadApplicationPermissionForCurrentIdentity(app.getAppId()))\n        .collect(Collectors.toList());\n  }\n\n  private boolean hasReadApplicationPermissionForCurrentIdentity(String appId) {\n    if (!UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())) {\n      return true;\n    }\n    return unifiedPermissionValidator.hasReadApplicationPermission(appId);\n  }\n\n  private void requireReadApplicationPermissionForUserToken(String appId) {\n    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())\n        && !unifiedPermissionValidator.hasReadApplicationPermission(appId)) {\n      throw new AccessDeniedException(\"Access is denied\");\n    }\n  }\n\n  private void requireReadApplicationsPermissionForUserToken(List<String> appIds) {\n    if (!UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())) {\n      return;\n    }\n    for (String appId : appIds) {\n      if (!unifiedPermissionValidator.hasReadApplicationPermission(appId)) {\n        throw new AccessDeniedException(\"Access is denied\");\n      }\n    }\n  }\n\n  private List<OpenAppDTO> page(List<OpenAppDTO> apps, Integer page, Integer size) {\n    if (apps == null || apps.isEmpty()) {\n      return Collections.emptyList();\n    }","sourceCodeStart":344,"sourceCodeEnd":380,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/AppController.java#L344-L380","documentation":"Thrown by AppController.requireReadApplicationPermissionForUserToken when the auth type is USER_TOKEN and unifiedPermissionValidator.hasReadApplicationPermission(appId) returns false. This guards read operations (getApp, getEnvClusterInfo, findMissEnvs) so that user-tokens without read access to the specific app are blocked. It is a Spring Security AccessDeniedException, resulting in HTTP 403. For non-USER_TOKEN auth types, this method returns immediately without checking.","triggerScenarios":"Calling getApp(appId), getEnvClusterInfo(appId), or findMissEnvs(appId) with a USER_TOKEN that does not have read-application permission for the specified appId. The user associated with the token is not authorized to view this app.","commonSituations":"A user-token was created for a user who lacks read access to the target app. The user was removed from the app's authorized list. The appId is from a different team's project. requireReadApplicationsPermissionForUserToken also throws this for batch findApps queries where any appId in the list lacks permission.","solutions":["Grant the user (behind the user-token) read permission for the target app via the Portal.","Switch to a Consumer token that has been assigned the app role.","Verify the appId is correct and belongs to a project the user has access to."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// For USER_TOKEN, check read permission before calling read endpoints\nif (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())) {\n    if (!unifiedPermissionValidator.hasReadApplicationPermission(appId)) {\n        throw new AccessDeniedException(\n            \"User token lacks read permission for app: \" + appId);\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pre-check hasReadApplicationPermission for user-tokens before read operations.","Use Consumer tokens with assigned app roles for automated read-heavy workflows.","For batch findApps calls, validate all appIds have read permission before the request."],"tags":["openapi","authorization","apollo-portal","user-token","permission","read-access"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}