{"record":{"id":"6c8beaf94187f85a","repo":"iflytek/astron-agent","slug":"unauthorized-6c8bea","errorCode":"UNAUTHORIZED","errorMessage":"ResponseEnum.UNAUTHORIZED","messagePattern":"ResponseEnum\\.UNAUTHORIZED","errorType":"error_code","errorClass":"BusinessException","httpStatus":null,"severity":"error","filePath":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowService.java","lineNumber":2534,"sourceCode":"    }\n\n    /** Imported drafts remain editable, but unresolved external dependencies must never execute. */\n    void ensureNoUnresolvedImportDependencies(BizWorkflowData workflowData) {\n        if (workflowData == null || workflowData.getNodes() == null) {\n            return;\n        }\n        ensureNoUnresolvedImportDependencies(\n                workflowData,\n                UserInfoManagerHandler.getUserId(),\n                SpaceInfoUtil.getSpaceId());\n    }\n\n    void ensureNoUnresolvedImportDependencies(BizWorkflowData workflowData, String uid, Long spaceId) {\n        if (workflowData == null || workflowData.getNodes() == null) {\n            return;\n        }\n        if (StringUtils.isBlank(uid)) {\n            throw new BusinessException(ResponseEnum.UNAUTHORIZED);\n        }\n        ExecutionScope scope = loadExecutionScope(uid, spaceId);\n        ImportDependencyResources resources = loadImportDependencyResources(workflowData, scope);\n        boolean unresolved = workflowData.getNodes()\n                .stream()\n                .anyMatch(node -> hasActiveImportIssue(node, resources)\n                        || hasInvalidPluginBinding(node, resources)\n                        || hasInvalidResourceBinding(node, resources));\n        if (unresolved) {\n            throw new BusinessException(ResponseEnum.WORKFLOW_IMPORT_DEPENDENCY_UNRESOLVED);\n        }\n    }\n\n    /** Load every bound external resource in bounded authoritative batch queries. */\n    private ImportDependencyResources loadImportDependencyResources(\n            BizWorkflowData workflowData, ExecutionScope scope) {\n        Map<String, List<ToolBox>> executableTools = loadExecutableTools(workflowData);\n        Set<Long> databaseIds = new LinkedHashSet<>();","sourceCodeStart":2516,"sourceCodeEnd":2552,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowService.java#L2516-L2552","documentation":"Thrown in ensureNoUnresolvedImportDependencies when the caller's uid is blank while validating imported workflow dependencies. Resolving which plugins/models/databases the imported flow may use requires the current user's identity; without it the service cannot authorize the check and rejects with UNAUTHORIZED.","triggerScenarios":"Importing a workflow when the request context has no authenticated user id (uid blank/null) — e.g. calls outside a logged-in session, missing auth header, or internal calls that dropped the user context.","commonSituations":"Batch import scripts calling service methods directly without setting the security context; auth token expired so uid resolution returned blank; misconfigured gateway stripping user headers.","solutions":["Ensure the import API is called with a valid authenticated session (Authorization header/token)","Re-login if the token expired and uid resolution became blank","Fix internal callers to propagate the current user context (uid, spaceId)","Check gateway/auth filter config so user identity headers reach the service"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (uid == null || uid.isBlank()) { throw new IllegalStateException(\"must be called with an authenticated user\"); }","typeGuard":null,"tryCatchPattern":"try { workflowService.importWorkflow(req); } catch (BusinessException e) { if (\"UNAUTHORIZED\".equals(e.getCode().name())) { /* re-authenticate */ } throw e; }","preventionTips":["Only call import through authenticated API paths","Propagate security context in internal calls","Detect expired sessions before long import operations"],"tags":["authentication","import","session"],"backgroundTag":"authentication-required","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}