{"record":{"id":"82dd9893afc15077","repo":"apache/dolphinscheduler","slug":"30001-82dd98","errorCode":"30001","errorMessage":"user has no operation privilege","messagePattern":"user has no operation privilege","errorType":"error_code","errorClass":"ServiceException","httpStatus":null,"severity":"error","filePath":"dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/DataSourceServiceImpl.java","lineNumber":92,"sourceCode":"\n    @Autowired\n    private DataSourceDao dataSourceDao;\n\n    @Autowired\n    private DataSourceUserDao datasourceUserDao;\n\n    private static final String TABLE = \"TABLE\";\n    private static final String VIEW = \"VIEW\";\n    private static final String[] TABLE_TYPES = new String[]{TABLE, VIEW};\n    private static final String TABLE_NAME = \"TABLE_NAME\";\n    private static final String COLUMN_NAME = \"COLUMN_NAME\";\n\n    @Override\n    public DataSource createDataSource(User loginUser, BaseDataSourceParamDTO datasourceParam) {\n        DataSourceUtils.checkDatasourceParam(datasourceParam);\n        if (!canOperatorPermissions(loginUser, null, AuthorizationType.DATASOURCE,\n                ApiFuncIdentificationConstant.DATASOURCE_CREATE_DATASOURCE)) {\n            throw new ServiceException(Status.USER_NO_OPERATION_PERM);\n        }\n        // check name can use or not\n        if (checkName(datasourceParam.getName())) {\n            throw new ServiceException(Status.DATASOURCE_EXIST);\n        }\n        if (checkDescriptionLength(datasourceParam.getNote())) {\n            throw new ServiceException(Status.DESCRIPTION_TOO_LONG_ERROR);\n        }\n        ConnectionParam connectionParam = DataSourceUtils.buildConnectionParams(datasourceParam);\n\n        // build datasource\n        DataSource dataSource = new DataSource();\n        Date now = new Date();\n\n        dataSource.setName(datasourceParam.getName().trim());\n        dataSource.setNote(datasourceParam.getNote());\n        dataSource.setUserId(loginUser.getId());\n        dataSource.setUserName(loginUser.getUserName());","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/DataSourceServiceImpl.java#L74-L110","documentation":"createDataSource first checks authorization via canOperatorPermissions for AuthorizationType.DATASOURCE and the DATASOURCE_CREATE_DATASOURCE function tag. If the login user lacks permission (admin, or authorized datasource-level grants), Status.USER_NO_OPERATION_PERM (code 30001) is thrown.","triggerScenarios":"POST /datasources with a user token whose roles/grants do not include datasource creation rights (non-admin user with no DATASOURCE authorization).","commonSituations":"CI jobs using a read-only service account; users added to a project without datasource permissions; token of a revoked/deactivated admin.","solutions":["Log in as an admin or use an account granted DATASOURCE authorization.","In the security UI, grant the user datasource permissions (or the relevant function tag).","Verify the Authorization/token header actually belongs to the intended privileged user."],"exampleFix":"// before\ncurl -H \"X-Token: <readonlyUserToken>\" -X POST .../datasources -d '{...}'\n// after\ncurl -H \"X-Token: <adminOrDatasourceGrantedUserToken>\" -X POST .../datasources -d '{...}'","handlingStrategy":"try-catch","validationCode":"// verify user's datasource permissions before calling\nboolean canCreate = user.isAdmin() || user.getAuthorizedDatasources() != null;","typeGuard":null,"tryCatchPattern":"try { api.createDataSource(user, param); } catch (ServiceException e) { if (e.getCode() == 30001) { throw new SecurityException(\"user lacks datasource create permission\", e); } throw e; }","preventionTips":["Use admin or properly granted accounts in automation","Audit token ownership in CI secrets","Grant DATASOURCE authorization before onboarding users to create datasources"],"tags":["datasource","authorization","rbac"],"backgroundTag":"permission-denied","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}