{"record":{"id":"6ca9d0b9e06a9e82","repo":"apache/dolphinscheduler","slug":"user-no-operation-perm-6ca9d0","errorCode":"USER_NO_OPERATION_PERM","errorMessage":"USER_NO_OPERATION_PERM: user has no operation privilege","messagePattern":"USER_NO_OPERATION_PERM: user has no operation privilege","errorType":"error_code","errorClass":"ServiceException","httpStatus":null,"severity":"error","filePath":"dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/WorkflowDefinitionServiceImpl.java","lineNumber":880,"sourceCode":"                workflowDefinition.getProjectCode(), workflowDefinition.getCode(), 0);\n\n        if (taskDepMsg.isPresent()) {\n            String errorMeg = \"workflow definition cannot be deleted because it has dependent, \" + taskDepMsg.get();\n            log.error(errorMeg);\n            throw new ServiceException(errorMeg);\n        }\n    }\n\n    public void deleteWorkflowDefinitionByCode(User loginUser, long code) {\n        WorkflowDefinition workflowDefinition = workflowDefinitionDao.queryByCode(code)\n                .orElseThrow(() -> new ServiceException(WORKFLOW_DEFINITION_NOT_EXIST, String.valueOf(code)));\n\n        Project project = projectDao.queryByCode(workflowDefinition.getProjectCode());\n        projectService.checkHasProjectWritePermissionThrowException(loginUser, project);\n\n        // Determine if the login user is the owner of the workflow definition\n        if (loginUser.getId() != workflowDefinition.getUserId() && loginUser.getUserType() != UserType.ADMIN_USER) {\n            throw new ServiceException(Status.USER_NO_OPERATION_PERM);\n        }\n\n        workflowDefinitionUsedInOtherTaskValid(loginUser, workflowDefinition);\n\n        // get the timing according to the workflow definition\n        Schedule scheduleObj = scheduleDao.queryByWorkflowDefinitionCode(code);\n        if (scheduleObj != null) {\n            if (scheduleObj.getReleaseState() == ReleaseState.OFFLINE) {\n                boolean delete = scheduleDao.deleteById(scheduleObj.getId());\n                if (!delete) {\n                    throw new ServiceException(Status.DELETE_SCHEDULE_BY_ID_ERROR);\n                }\n            }\n            if (scheduleObj.getReleaseState() == ReleaseState.ONLINE) {\n                throw new ServiceException(Status.SCHEDULE_STATE_ONLINE, scheduleObj.getId());\n            }\n        }\n","sourceCodeStart":862,"sourceCodeEnd":898,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/WorkflowDefinitionServiceImpl.java#L862-L898","documentation":"Thrown in deleteWorkflowDefinitionByCode when the login user is neither the owner (userId mismatch) nor an ADMIN_USER. Only the workflow's creator or an admin may delete it; project write permission alone (checked just before) is not sufficient.","triggerScenarios":"A non-admin user calling deleteWorkflowDefinitionByCode for a workflow created by another user, even with project write permission granted.","commonSituations":"Team members sharing a project but each owning their own workflows; service accounts operating under a non-admin user; scripts running as a generic user instead of the owner.","solutions":["Log in as (or run the call as) the workflow owner or an ADMIN_USER.","Have an admin delete the workflow on the user's behalf.","Reassign the workflow's user_id to the intended operator in the DB if ownership needs transfer."],"exampleFix":"// before\nUser operator = userService.getUserByName(\"analyst\"); // not owner\nservice.deleteWorkflowDefinitionByCode(operator, code);\n// after\nUser admin = userService.getUserByName(\"admin\");\nservice.deleteWorkflowDefinitionByCode(admin, code);","handlingStrategy":"validation","validationCode":"WorkflowDefinition wf = workflowDefinitionDao.queryByCode(code).orElseThrow(NoSuchElementException::new);\nboolean allowed = loginUser.getId() == wf.getUserId() || loginUser.getUserType() == UserType.ADMIN_USER;\nif (!allowed) throw new SecurityException(\"only owner or admin can delete\");","typeGuard":"boolean canDelete(User u, WorkflowDefinition wf) {\n    return u.getId() == wf.getUserId() || u.getUserType() == UserType.ADMIN_USER;\n}","tryCatchPattern":"try { service.deleteWorkflowDefinitionByCode(user, code); }\ncatch (ServiceException e) { if (e.getCode() == Status.USER_NO_OPERATION_PERM) { /* escalate to admin or reassign ownership */ } }","preventionTips":["Run automation with the owner account or an admin","Transfer ownership before offboarding users","Check ownership in UI before exposing delete buttons"],"tags":["authorization","permission","ownership"],"backgroundTag":"permission-denied","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}