{"record":{"id":"aa7f5847e6b75592","repo":"iflytek/astron-agent","slug":"insufficient-permissions-aa7f58","errorCode":"INSUFFICIENT_PERMISSIONS","errorMessage":"INSUFFICIENT_PERMISSIONS","messagePattern":"INSUFFICIENT_PERMISSIONS","errorType":"error_code","errorClass":"BusinessException","httpStatus":null,"severity":"error","filePath":"console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/publish/impl/PublishApprovalServiceImpl.java","lineNumber":73,"sourceCode":"    private final SpaceService spaceService;\n    private final SpaceUserService spaceUserService;\n    private final ChatBotBaseMapper chatBotBaseMapper;\n    private final WorkflowMapper workflowMapper;\n    private final AppMstService appMstService;\n    private final List<PublishApprovalExecutor> publishApprovalExecutors;\n\n    @Override\n    public PublishApprovalDecisionDto submitIfRequired(PublishApprovalSubmitDto submitDto) {\n        Long effectiveSpaceId = resolveEffectiveSpaceId(submitDto);\n        submitDto.setSpaceId(effectiveSpaceId);\n        normalizePublishSnapshotSpaceId(submitDto);\n        if (effectiveSpaceId == null) {\n            return directDecision();\n        }\n\n        SpaceRoleEnum currentRole = spaceUserService.getRole(effectiveSpaceId, submitDto.getRequesterUid());\n        if (currentRole == null) {\n            throw new BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS);\n        }\n        if (isOwnerOrAdmin(currentRole)) {\n            return directDecision();\n        }\n\n        if (PublishApprovalActionEnum.OFFLINE == submitDto.getPublishAction()) {\n            throw new BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS);\n        }\n\n        if (!isApprovalEnabledPublishType(submitDto.getPublishType())) {\n            return directDecision();\n        }\n\n        SpaceTypeEnum spaceType = resolveSpaceType(effectiveSpaceId);\n        validateApprovalTarget(submitDto);\n        PublishApproval approval = buildApproval(submitDto, spaceType);\n        PublishApproval existing = findActiveApproval(approval);\n        if (existing != null) {","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/publish/impl/PublishApprovalServiceImpl.java#L55-L91","documentation":"INSUFFICIENT_PERMISSIONS in submitIfRequired is thrown when the requester's space role resolves to null, i.e. the user is not a member of the effective space. Without a role the service cannot authorize the publish submission and fails closed.","triggerScenarios":"Submitting a publish approval where spaceUserService.getRole(effectiveSpaceId, requesterUid) returns null (non-member of that space).","commonSituations":"User removed from the space before submitting; request carries a spaceId the user was never added to; UI sends the wrong spaceId after a space switch.","solutions":["Add the user to the space with an appropriate role.","Verify the correct effectiveSpaceId is resolved and sent.","Ensure the requester uid matches the authenticated user.","Re-submit once membership is granted."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"SpaceRoleEnum role = spaceUserService.getRole(effectiveSpaceId, requesterUid);\nif (role == null) {\n    // requester not a member of this space; join space or fix spaceId\n    return;\n}\npublishApprovalService.submitIfRequired(submitDto);","typeGuard":null,"tryCatchPattern":"try {\n    publishApprovalService.submitIfRequired(submitDto);\n} catch (BusinessException e) {\n    if (\"INSUFFICIENT_PERMISSIONS\".equals(String.valueOf(e.getCode()))) {\n        // verify space membership, show access error\n    }\n}","preventionTips":["Resolve and send the correct effectiveSpaceId.","Confirm space membership before submitting approvals.","Keep auth uid consistent with the requester field."],"tags":["permissions","space","publish-approval"],"backgroundTag":"insufficient-permissions","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}