{"record":{"id":"73e7ad1076d5d1c6","repo":"apache/dolphinscheduler","slug":"30002","errorCode":"30002","errorMessage":"user {userName} is not has project {projectCode} permission","messagePattern":"user (.+?) is not has project (.+?) permission","errorType":"error_code","errorClass":"ServiceException","httpStatus":null,"severity":"error","filePath":"dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/TaskGroupServiceImpl.java","lineNumber":292,"sourceCode":"    }\n\n    private void requireProjectPerm(User loginUser, long projectCode, boolean writePermission) {\n        if (loginUser.getUserType() == UserType.ADMIN_USER) {\n            return;\n        }\n        Project project = projectDao.queryByCode(projectCode);\n        if (project == null) {\n            log.warn(\"Project does not exist, projectCode:{}.\", projectCode);\n            throw new ServiceException(Status.PROJECT_NOT_FOUND, projectCode);\n        }\n        if (project.getUserId().equals(loginUser.getId())) {\n            return;\n        }\n        ProjectUser projectUser = projectUserDao.queryProjectRelation(project.getId(), loginUser.getId());\n        if (projectUser == null) {\n            log.warn(\"User {} does not have operation permission for project {}\", loginUser.getUserName(),\n                    project.getCode());\n            throw new ServiceException(Status.USER_NO_OPERATION_PROJECT_PERM, loginUser.getUserName(),\n                    project.getCode());\n        }\n        if (writePermission && projectUser.getPerm() != Constants.DEFAULT_ADMIN_PERMISSION) {\n            log.warn(\"User {} does not have write permission for project {}\", loginUser.getUserName(),\n                    project.getCode());\n            throw new ServiceException(Status.USER_NO_WRITE_PROJECT_PERM, loginUser.getUserName(),\n                    project.getCode());\n        }\n    }\n}\n","sourceCodeStart":274,"sourceCodeEnd":303,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/TaskGroupServiceImpl.java#L274-L303","documentation":"Thrown by requireProjectPerm when the project exists but the current non-admin user has no relation in t_ds_relation_project_user (projectUser == null): the user neither owns the project nor was granted any permission on it. Reported as Status.USER_NO_OPERATION_PROJECT_PERM (code 30002) with userName and projectCode interpolated.","triggerScenarios":"createTaskGroup, updateTaskGroup, or queryTaskGroupByProjectCode invoked by a user who is not the project owner and has no project-user grant; calling with another user's project code; revoked project access while old tokens/scripts still run.","commonSituations":"Team member removed from the project but automation still uses their account; new service account never granted project permission; wrong project code pointing at someone else's project.","solutions":["Grant the user permission on the project (Project page -> Permission, or t_ds_relation_project_user insert via admin).","Use the project owner's or an admin account for the call.","Verify the projectCode actually refers to the intended project.","Re-run after re-adding the user to the project if access was recently revoked."],"exampleFix":"// before\n// caller assumes any authenticated user may manage task groups\ntaskGroupService.createTaskGroup(loginUser, name, desc, total, projectCode);\n// after\nProjectUser rel = projectUserDao.queryProjectRelation(project.getId(), loginUser.getId());\nif (loginUser.getUserType() != UserType.ADMIN_USER\n        && !project.getUserId().equals(loginUser.getId())\n        && rel == null) {\n    throw new ServiceException(Status.USER_NO_OPERATION_PROJECT_PERM,\n            loginUser.getUserName(), project.getCode());\n}","handlingStrategy":"validation","validationCode":"// Java: verify the user has some project relation before calling\nProject project = projectDao.queryByCode(projectCode);\nProjectUser rel = projectUserDao.queryProjectRelation(project.getId(), loginUser.getId());\nboolean allowed = loginUser.getUserType() == UserType.ADMIN_USER\n        || project.getUserId().equals(loginUser.getId()) || rel != null;\nif (!allowed) throw new ServiceException(Status.USER_NO_OPERATION_PROJECT_PERM,\n        loginUser.getUserName(), project.getCode());","typeGuard":"boolean hasProjectAccess(User loginUser, Project project) {\n    return loginUser.getUserType() == UserType.ADMIN_USER\n            || project.getUserId().equals(loginUser.getId())\n            || projectUserDao.queryProjectRelation(project.getId(), loginUser.getId()) != null;\n}","tryCatchPattern":"try {\n    taskGroupService.updateTaskGroup(loginUser, id, name, desc);\n} catch (ServiceException e) {\n    if (e.getCode() == 30002) {\n        // request project authorization from the project owner/admin\n    }\n    throw e;\n}","preventionTips":["Grant project permission to every account that runs task group automation.","Re-check access after users are removed from projects.","Use project owner or admin accounts for cross-project operations.","Keep an inventory of project-user grants used by service accounts."],"tags":["permission","project","authorization"],"backgroundTag":"insufficient-permissions","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}