{"record":{"id":"4906a83bd293b0c0","repo":"flowable/flowable-engine","slug":"candidate-user-is-null-4906a8","errorCode":null,"errorMessage":"Candidate user is null","messagePattern":"Candidate user is null","errorType":"validation","errorClass":"ActivitiIllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/flowable5-engine/src/main/java/org/activiti/engine/impl/TaskQueryImpl.java","lineNumber":486,"sourceCode":"            if (delegationState == null) {\n                currentOrQueryObject.noDelegationState = true;\n            } else {\n                currentOrQueryObject.delegationState = delegationState;\n            }\n        } else {\n            if (delegationState == null) {\n                this.noDelegationState = true;\n            } else {\n                this.delegationState = delegationState;\n            }\n        }\n        return this;\n    }\n\n    @Override\n    public TaskQueryImpl taskCandidateUser(String candidateUser) {\n        if (candidateUser == null) {\n            throw new ActivitiIllegalArgumentException(\"Candidate user is null\");\n        }\n\n        if (orActive) {\n            currentOrQueryObject.candidateUser = candidateUser;\n        } else {\n            this.candidateUser = candidateUser;\n        }\n\n        return this;\n    }\n\n    @Override\n    public TaskQueryImpl taskInvolvedUser(String involvedUser) {\n        if (involvedUser == null) {\n            throw new ActivitiIllegalArgumentException(\"Involved user is null\");\n        }\n        if (orActive) {\n            currentOrQueryObject.involvedUser = involvedUser;","sourceCodeStart":468,"sourceCodeEnd":504,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable5-engine/src/main/java/org/activiti/engine/impl/TaskQueryImpl.java#L468-L504","documentation":"taskCandidateUser(String candidateUser) throws ActivitiIllegalArgumentException(\"Candidate user is null\") when the candidate user id is null. The candidate-user filter drives the identity-link based candidate resolution, which requires an actual user id. Call it with a valid non-null user id or omit the filter.","triggerScenarios":"Calling taskQuery.taskCandidateUser(null), typically when the current user was not resolvable (e.g. no authenticated principal, or a lookup returned null).","commonSituations":"Security context empty in a background job; userId extracted from a token/variable that was absent; task lists rendered for anonymous users without special handling.","solutions":["Resolve the current user before building the query and skip the candidate filter if absent","Return an empty result deliberately for unauthenticated contexts instead of building a query","Fix the identity/lookup service so it never yields null for expected users"],"exampleFix":"// before\nquery.taskCandidateUser(SecurityUtils.getCurrentUserId()); // null in background job\n// after\nString userId = SecurityUtils.getCurrentUserId();\nif (userId != null) { query.taskCandidateUser(userId); }","handlingStrategy":"validation","validationCode":"if (candidateUser == null) {\n    return Collections.emptyList(); // or skip the filter\n}\nquery.taskCandidateUser(candidateUser);","typeGuard":"boolean isAuthenticatedUser(String userId) { return userId != null && !userId.trim().isEmpty(); }","tryCatchPattern":"try {\n    query.taskCandidateUser(userId);\n} catch (ActivitiIllegalArgumentException e) {\n    log.warn(\"No candidate user resolved: {}\", e.getMessage());\n    return Collections.emptyList();\n}","preventionTips":["Resolve the authenticated user before query building; fail early in the auth layer","Handle background/anonymous contexts explicitly instead of passing null userIds","Centralize current-user resolution in one utility that throws a meaningful domain exception"],"tags":["task-query","null-argument","candidate-user","activiti"],"backgroundTag":"null-argument","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}