{"record":{"id":"a4f1b1e022ea89f4","repo":"apache/dolphinscheduler","slug":"1400001-a4f1b1","errorCode":"1400001","errorMessage":"The current user does not have this permission.","messagePattern":"The current user does not have this permission\\.","errorType":"error_code","errorClass":"ServiceException","httpStatus":null,"severity":"error","filePath":"dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java","lineNumber":501,"sourceCode":"                // 4. delete the relationship between project and user\n                this.projectUserDao.deleteProjectRelation(project.getId(), user.getId());\n            }\n        });\n    }\n\n    /**\n     * grant project with read permission\n     *\n     * @param loginUser  login user\n     * @param userId     user id\n     * @param projectIds project id array\n     * @return grant result code\n     */\n    @Override\n    @Transactional(rollbackFor = RuntimeException.class)\n    public void grantProjectWithReadPerm(User loginUser, int userId, String projectIds) {\n        if (!isAdmin(loginUser)) {\n            throw new ServiceException(Status.NO_CURRENT_OPERATING_PERMISSION);\n        }\n\n        // check exist\n        User tempUser = userDao.queryById(userId);\n        if (tempUser == null) {\n            throw new ServiceException(Status.USER_NOT_EXIST, userId);\n        }\n\n        if (StringUtils.isEmpty(projectIds)) {\n            return;\n        }\n        Arrays.stream(projectIds.split(Constants.COMMA)).distinct().forEach(projectId -> {\n            ProjectUser projectUserOld = projectUserDao.queryProjectRelation(Integer.parseInt(projectId), userId);\n            if (projectUserOld != null) {\n                projectUserDao.deleteProjectRelation(Integer.parseInt(projectId), userId);\n            }\n            Date now = new Date();\n            ProjectUser projectUser = new ProjectUser();","sourceCodeStart":483,"sourceCodeEnd":519,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java#L483-L519","documentation":"ServiceException(Status.NO_CURRENT_OPERATING_PERMISSION, code 1400001) is thrown in grantProjectWithReadPerm when the login user is not an administrator. Only admins may grant read permission on projects to other users; the isAdmin(loginUser) check fails before any lookup or grant happens. It is an authorization failure on the caller's identity, independent of the target user or projects.","triggerScenarios":"Calling grantProjectWithReadPerm(loginUser, userId, projectIds) while loginUser has USER_TYPE.GENERAL_USER instead of ADMIN_USER.","commonSituations":"A regular user's session/token is used to call the admin-only grant REST endpoint; role downgraded after token issued; service account lacks admin role in a CI script.","solutions":["Log in as (or use a token of) an admin user before calling this API.","Grant the ADMIN_USER user type to the account in Users management if it legitimately needs this duty.","Change the workflow so regular users request grants through an admin-approved path instead of calling the admin endpoint.","Check the caller's role in your client code and fail fast with a clear message."],"exampleFix":"// before\nusersService.grantProjectWithReadPerm(currentUser, userId, projectIds); // throws if currentUser is not admin\n// after\nif (!LoginUserTypeChecker.isAdmin(currentUser)) {\n    throw new SecurityException(\"Admin privileges required to grant project read permission\");\n}\nusersService.grantProjectWithReadPerm(currentUser, userId, projectIds);","handlingStrategy":"validation","validationCode":"if (loginUser == null || loginUser.getUserType() != UserType.ADMIN_USER) {\n    throw new SecurityException(\"grantProjectWithReadPerm requires an admin user\");\n}","typeGuard":"boolean isAdminUser(User u) { return u != null && u.getUserType() == UserType.ADMIN_USER; }","tryCatchPattern":"try {\n    usersService.grantProjectWithReadPerm(loginUser, userId, projectIds);\n} catch (ServiceException e) {\n    if (e.getCode() == 1400001) { /* not admin: switch to admin credentials */ }\n    else throw e;\n}","preventionTips":["Keep a dedicated admin service account for grant/revoke automation.","Check userType before calling admin-only endpoints instead of discovering via 1400001.","Detect token/role downgrades after re-authentication and refresh credentials."],"tags":["authorization","admin-only","role-based-access"],"backgroundTag":"insufficient-permissions","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}