{"record":{"id":"8940e7669f0b8e31","repo":"alibaba/nacos","slug":"parameter-validate-error-8940e7","errorCode":"PARAMETER_VALIDATE_ERROR","errorMessage":"user '{username}' not found","messagePattern":"user '(.+?)' not found","errorType":"validation","errorClass":"NacosApiException","httpStatus":400,"severity":"warning","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/visibility/DefaultVisibilityGrantService.java","lineNumber":253,"sourceCode":"                \"resourceType is blank\");\n        }\n        if (StringUtils.isBlank(resourceName)) {\n            throw new NacosApiException(NacosException.INVALID_PARAM, ErrorCode.PARAMETER_MISSING,\n                \"resourceName is blank\");\n        }\n    }\n    \n    private void validateUsername(String username) throws NacosException {\n        if (StringUtils.isBlank(username)) {\n            throw new NacosApiException(NacosException.INVALID_PARAM, ErrorCode.PARAMETER_MISSING,\n                \"username is blank\");\n        }\n    }\n    \n    private void validateGranteeExists(String username) throws NacosException {\n        User grantee = userService.getUser(username);\n        if (grantee == null) {\n            throw new NacosApiException(NacosException.INVALID_PARAM,\n                ErrorCode.PARAMETER_VALIDATE_ERROR,\n                \"user '\" + username + \"' not found\");\n        }\n    }\n    \n    private String normalizeGrantAction(String action) throws NacosException {\n        try {\n            // Persist write grants as \"rw\" so write authorization can imply read visibility.\n            return VisibilityGrantRoleHelper.normalizeStoredAction(action);\n        } catch (IllegalArgumentException e) {\n            throw new NacosApiException(NacosException.INVALID_PARAM,\n                ErrorCode.PARAMETER_VALIDATE_ERROR, e.getMessage());\n        }\n    }\n    \n    private boolean userHasRole(String username, String roleName) {\n        List<RoleInfo> roles = roleService.getRoles(username);\n        if (CollectionUtils.isEmpty(roles)) {","sourceCodeStart":235,"sourceCodeEnd":271,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/visibility/DefaultVisibilityGrantService.java#L235-L271","documentation":"Thrown by DefaultVisibilityGrantService.validateGranteeExists() when the grantee username does not correspond to any existing user in the user service (userService.getUser(username) returns null). This ensures visibility grants are only created for real users. The error code is INVALID_PARAM with ErrorCode.PARAMETER_VALIDATE_ERROR.","triggerScenarios":"Calling grant() or revoke() with a username that doesn't exist in the Nacos user database — e.g. a typo in the username, a previously-deleted user, or a username from a different identity provider that isn't synced.","commonSituations":"The grantee was deleted between the time the client loaded the user list and submitted the grant; a typo in the username; a username from an external IdP that hasn't been provisioned in Nacos; the user exists in a different namespace or auth realm.","solutions":["Verify the username exists by calling userService.getUser(username) before submitting the grant/revoke request.","Check for typos or case sensitivity issues in the username.","If the user was recently deleted, inform the client and cancel the grant operation.","Ensure user provisioning is complete before attempting to assign visibility grants."],"exampleFix":"// Check user existence before calling grant:\nif (userService.getUser(username) == null) {\n    return Result.failure(\"User '\" + username + \"' does not exist\");\n}\nservice.grant(namespaceId, resourceType, resourceName, username, action);","handlingStrategy":"validation","validationCode":"// Verify the grantee user exists before granting\nUser grantee = userService.getUser(username);\nif (grantee == null) {\n    return Result.failure(\"User '\" + username + \"' does not exist\");\n}","typeGuard":"public static boolean userExists(NacosUserService userService, String username) {\n    return StringUtils.isNotBlank(username) && userService.getUser(username) != null;\n}","tryCatchPattern":"try {\n    service.grant(namespaceId, resourceType, resourceName, username, action);\n} catch (NacosApiException e) {\n    if (e.getDetailErrCode() == ErrorCode.PARAMETER_VALIDATE_ERROR.getCode()) {\n        return Result.failure(e.getMessage()); // \"user 'xxx' not found\"\n    }\n    throw e;\n}","preventionTips":["Verify the grantee user exists before calling grant/revoke.","Use a user picker UI backed by a fresh user list to avoid stale usernames.","Handle race conditions where a user is deleted between validation and grant execution."],"tags":["auth","visibility","validation","user-not-found"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}