{"record":{"id":"5a9f677605626207","repo":"apache/dolphinscheduler","slug":"user-no-operation-project-perm","errorCode":"USER_NO_OPERATION_PROJECT_PERM","errorMessage":"USER_NO_OPERATION_PROJECT_PERM","messagePattern":"USER_NO_OPERATION_PROJECT_PERM","errorType":"error_code","errorClass":"ServiceException","httpStatus":null,"severity":"error","filePath":"dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ProjectServiceImpl.java","lineNumber":188,"sourceCode":"        putMsg(result, Status.SUCCESS);\n        return result;\n    }\n\n    @Override\n    public Project queryByName(User loginUser, String projectName) {\n        Project project = projectDao.queryByName(projectName);\n        checkProjectAndAuthThrowException(loginUser, project, PROJECT);\n        return project;\n    }\n\n    @Override\n    public void checkProjectAndAuthThrowException(@NonNull User loginUser, @Nullable Project project,\n                                                  String permission) {\n        if (project == null) {\n            throw new ServiceException(Status.PROJECT_NOT_EXIST);\n        }\n        if (!canOperatorPermissions(loginUser, new Object[]{project.getId()}, AuthorizationType.PROJECTS, permission)) {\n            throw new ServiceException(Status.USER_NO_OPERATION_PROJECT_PERM, loginUser.getUserName(),\n                    project.getCode());\n        }\n    }\n\n    @Override\n    public void checkProjectAndAuthThrowException(User loginUser, Long projectCode, String permission) {\n        if (projectCode == null) {\n            throw new ServiceException(Status.PROJECT_NOT_EXIST);\n        }\n        Project project = projectDao.queryByCode(projectCode);\n        checkProjectAndAuthThrowException(loginUser, project, permission);\n    }\n\n    @Override\n    public void checkHasProjectWritePermissionThrowException(User loginUser, long projectCode) {\n        Project project = projectDao.queryByCode(projectCode);\n        checkHasProjectWritePermissionThrowException(loginUser, project);\n    }","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ProjectServiceImpl.java#L170-L206","documentation":"Thrown by checkProjectAndAuthThrowException when canOperatorPermissions reports the login user lacks the requested permission on the project (AuthorizationType.PROJECTS). The message includes the user name and project code. The project exists but the user may not perform the operation.","triggerScenarios":"A non-admin user calls queryByCode/queryByName/deleteProject/queryAuthorizedUser (or any path that goes through this check) for a project they are not authorized on with the given permission string.","commonSituations":"Sharing a project code with a teammate who has no grant; user was removed from the project's authorized users; role downgraded after a permission revocation; front-end caching an old permission level.","solutions":["Grant the user permission on the project (project manage -> add authorized user, or POST /users/grant-project)","Log in as the project owner or an admin user","Use the projectCode overload to confirm the correct project is being targeted; verify grants via queryAuthorizedProject","Check the permission string passed matches the intended operation"],"exampleFix":"// before\nprojectService.checkProjectAndAuthThrowException(loginUser, project, Permissions.WRITE);\n// after\nProjectUser relation = projectUserDao.queryProjectRelation(project.getId(), loginUser.getId());\nif (loginUser.getUserType() != UserType.ADMIN_USER\n        && !project.getUserId().equals(loginUser.getId())\n        && (relation == null || relation.getPerm() != Constants.DEFAULT_ADMIN_PERMISSION)) {\n    putMsg(result, Status.USER_NO_OPERATION_PROJECT_PERM, loginUser.getUserName(), project.getCode());\n    return result;\n}\nprojectService.checkProjectAndAuthThrowException(loginUser, project, Permissions.WRITE);","handlingStrategy":"try-catch","validationCode":"Project project = projectDao.queryByCode(projectCode);\nboolean canOp = loginUser.getUserType() == UserType.ADMIN_USER\n        || project.getUserId().equals(loginUser.getId())\n        || (projectUserDao.queryProjectRelation(project.getId(), loginUser.getId()) != null);","typeGuard":"boolean isAuthorized = loginUser != null\n        && (loginUser.getUserType() == UserType.ADMIN_USER\n            || loginUser.getId().equals(project.getUserId()));","tryCatchPattern":"try {\n    service.checkProjectAndAuthThrowException(loginUser, project, Permissions.WRITE);\n} catch (ServiceException e) {\n    if (e.getCode() == Status.USER_NO_OPERATION_PROJECT_PERM) {\n        putMsg(result, e.getCode(), loginUser.getUserName(), projectCode);\n        return result;\n    }\n    throw e;\n}","preventionTips":["Grant project permissions to collaborators up front","Verify permissions via queryAuthorizedProject before write operations","Use admin/owner accounts for cross-project maintenance"],"tags":["api","project","authorization"],"backgroundTag":"permission-denied","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}