{"record":{"id":"591364211636415a","repo":"apolloconfig/apollo","slug":"current-user-not-found","errorCode":null,"errorMessage":"Current user not found","messagePattern":"Current user not found","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/AppController.java","lineNumber":270,"sourceCode":"    }\n    if (UserIdentityConstants.CONSUMER.equals(authType)\n        && unifiedPermissionValidator.hasCreateApplicationPermission()) {\n      return;\n    }\n    if (UserIdentityConstants.USER_TOKEN.equals(authType)\n        && unifiedPermissionValidator.hasCreateApplicationPermission()) {\n      return;\n    }\n    throw new AccessDeniedException(\"Create application permission is required\");\n  }\n\n  private String resolveOperator(String operator) {\n    String authType = UserIdentityContextHolder.getAuthType();\n    if (UserIdentityConstants.USER.equals(authType)\n        || UserIdentityConstants.USER_TOKEN.equals(authType)) {\n      UserInfo loginUser = userInfoHolder.getUser();\n      if (loginUser == null || !StringUtils.hasText(loginUser.getUserId())) {\n        throw new BadRequestException(\"Current user not found\");\n      }\n      return loginUser.getUserId();\n    }\n\n    if (UserIdentityConstants.CONSUMER.equals(authType)) {\n      if (!StringUtils.hasText(operator)) {\n        throw new BadRequestException(\"operator should not be null or empty\");\n      }\n      if (userService.findByUserId(operator) == null) {\n        throw BadRequestException.userNotExists(operator);\n      }\n      return operator;\n    }\n\n    throw new BadRequestException(\"Unsupported auth type: %s\", authType);\n  }\n\n  private void validatePortalApp(OpenAppDTO app) {","sourceCodeStart":252,"sourceCodeEnd":288,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/AppController.java#L252-L288","documentation":"Thrown by AppController.resolveOperator for USER or USER_TOKEN auth types when userInfoHolder.getUser() returns null, or the returned UserInfo has a blank userId. The operator resolver tries to extract the logged-in user's identity to use as the audit operator. If the user context is not populated (session missing, auth filter not running, or userId blank), this fires. Results in HTTP 400.","triggerScenarios":"An API request authenticated as USER or USER_TOKEN reaches a controller method that calls resolveOperator, but the UserInfoHolder has no user (null) or a UserInfo with an empty userId. This typically means the Spring Security context or a custom auth filter failed to populate the UserInfoHolder.","commonSituations":"A security filter or interceptor that populates UserInfoHolder was skipped (wrong filter order, or the endpoint is not behind the expected security chain). A user-token is technically valid but the user record was deleted from the user service, so getUser() returns null. A misconfigured integration where resolveOperator is called outside a properly authenticated request.","solutions":["Ensure the request goes through the proper authentication filter that populates UserInfoHolder with a valid UserInfo.","Verify the user account still exists in the user service (e.g., LDAP/DB) and has a non-blank userId.","Check Spring Security filter chain ordering — the UserInfoHolder must be set before the controller method executes.","For testing, mock userInfoHolder.getUser() to return a UserInfo with a valid userId."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify user context is populated before calling resolveOperator-dependent methods\nString authType = UserIdentityContextHolder.getAuthType();\nif (UserIdentityConstants.USER.equals(authType) || UserIdentityConstants.USER_TOKEN.equals(authType)) {\n    UserInfo user = userInfoHolder.getUser();\n    if (user == null || !StringUtils.hasText(user.getUserId())) {\n        throw new IllegalStateException(\n            \"User context not populated. Ensure the auth filter ran for this request.\");\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Ensure the auth filter/interceptor runs before controller methods and populates UserInfoHolder.","Verify the user account exists in the user service before relying on userInfoHolder.getUser().","For tests, always set up UserInfoHolder with a valid mock user."],"tags":["openapi","authentication","apollo-portal","user-context","operator","session"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}