{"record":{"id":"4bf6ca8e30da7ea2","repo":"alibaba/nacos","slug":"server-error-4bf6ca","errorCode":"SERVER_ERROR","errorMessage":"visibility grant management is unsupported in current runtime","messagePattern":"visibility grant management is unsupported in current runtime","errorType":"exception","errorClass":"NacosApiException","httpStatus":500,"severity":"critical","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/visibility/DefaultVisibilityGrantService.java","lineNumber":202,"sourceCode":"                || !normalizedResourceType.equals(parsed.getResourceType())) {\n                continue;\n            }\n            if (VisibilityGrantRoleHelper.matchesRequestedAction(permission.getAction(),\n                action)) {\n                names.add(parsed.getResourceName());\n            }\n        }\n        return new ArrayList<>(names);\n    }\n    \n    private VisibilityResource requireManagedResource(String namespaceId, String resourceType,\n        String resourceName) throws NacosException {\n        validateResourceTypeAndName(resourceType, resourceName);\n        AtomicReference<VisibilityResourceLocator> locatorRef = new AtomicReference<>();\n        ApplicationUtils.getBeanIfExist(VisibilityResourceLocator.class, locatorRef::set);\n        VisibilityResourceLocator locator = locatorRef.get();\n        if (locator == null) {\n            throw new NacosApiException(NacosException.SERVER_ERROR, ErrorCode.SERVER_ERROR,\n                \"visibility grant management is unsupported in current runtime\");\n        }\n        Optional<VisibilityResource> resource =\n            locator.findResource(VisibilityGrantRoleHelper.normalizeNamespaceId(namespaceId),\n                VisibilityGrantRoleHelper.normalizeResourceType(resourceType), resourceName);\n        return resource.orElseThrow(() -> new NacosApiException(NacosException.NOT_FOUND,\n            ErrorCode.RESOURCE_NOT_FOUND,\n            \"resource not found: \" + resourceName));\n    }\n    \n    private void checkManageGrantAuthority(VisibilityResource resource) throws NacosException {\n        // Allow access rules: 1. Authentication not enabled; 2. Global administrator; 3. Resource owner.\n        if (!NacosAuthConfigHolder.getInstance().isAnyAuthEnabled()) {\n            return;\n        }\n        String currentUsername = AuthIdentityUtils.resolveCurrentUsername();\n        if (AuthIdentityUtils.isCurrentIdentityGlobalAdmin(currentUsername)) {\n            return;","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/visibility/DefaultVisibilityGrantService.java#L184-L220","documentation":"Thrown by DefaultVisibilityGrantService.requireManagedResource() when no VisibilityResourceLocator SPI bean is found in the Spring application context. The locator is responsible for finding resources (configs, services, etc.) that visibility grants can be attached to. Its absence means the current runtime mode does not support visibility grant management — typically because the server is running in a mode or module that doesn't register a locator.","triggerScenarios":"Calling grant(), revoke(), or findAuthorizedResourceNames() on DefaultVisibilityGrantService when the Spring context has no VisibilityResourceLocator bean registered. This happens when the visibility feature is not fully initialized or the server is in a deployment mode that doesn't include resource locator SPI implementations.","commonSituations":"Running a minimal/embedded Nacos server without the full console module; a plugin or module that should register VisibilityResourceLocator failed to load; Spring context refresh ordering issue where the locator bean hasn't been created yet; running in a test or development mode without the full plugin stack.","solutions":["Verify that the appropriate module (e.g. console or the resource-owning module) is included in the deployment and registers a VisibilityResourceLocator bean.","Check Spring bean initialization logs for VisibilityResourceLocator — if it failed to construct, fix the underlying bean creation error.","Ensure the server is running in a deployment mode that supports visibility features (not a stripped-down or test mode).","If using a custom plugin architecture, confirm your VisibilityResourceLocator SPI implementation is on the classpath and properly annotated/configured."],"exampleFix":"// Ensure a VisibilityResourceLocator bean is registered, e.g. via @Component or @Bean:\n@Component\npublic class MyResourceLocator implements VisibilityResourceLocator {\n    @Override\n    public Optional<VisibilityResource> findResource(String namespaceId,\n        String resourceType, String resourceName) {\n        // lookup logic\n    }\n}","handlingStrategy":"validation","validationCode":"// Check for locator availability before calling visibility operations\nVisibilityResourceLocator locator = ApplicationUtils.getBean(VisibilityResourceLocator.class);\nif (locator == null) {\n    throw new IllegalStateException(\n        \"Visibility grant management is not available — no VisibilityResourceLocator registered\");\n}","typeGuard":"public static boolean isVisibilityGrantSupported() {\n    try {\n        return ApplicationUtils.getBean(VisibilityResourceLocator.class) != null;\n    } catch (Exception e) {\n        return false;\n    }\n}","tryCatchPattern":"try {\n    service.grant(namespaceId, resourceType, resourceName, username, action);\n} catch (NacosApiException e) {\n    if (e.getErrCode() == NacosException.SERVER_ERROR\n        && e.getMessage().contains(\"unsupported in current runtime\")) {\n        // visibility feature not available in this deployment\n        log.error(\"Visibility grants are not supported in this runtime mode\");\n    }\n    throw e;\n}","preventionTips":["Ensure the full console/server module stack is deployed so VisibilityResourceLocator beans are registered.","Check Spring context startup logs for VisibilityResourceLocator bean creation.","In custom deployments, verify all required SPI implementations are on the classpath."],"tags":["auth","visibility","spi","spring-context","feature-unavailable"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}