{"record":{"id":"b097f183207f1737","repo":"apache/dolphinscheduler","slug":"user-no-operation-perm-b097f1","errorCode":"USER_NO_OPERATION_PERM","errorMessage":"USER_NO_OPERATION_PERM: user has no operation permission","messagePattern":"USER_NO_OPERATION_PERM: user has no operation permission","errorType":"error_code","errorClass":"ServiceException","httpStatus":null,"severity":"error","filePath":"dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/SchedulerServiceImpl.java","lineNumber":360,"sourceCode":"    /**\n     * delete schedule by id\n     *\n     * @param loginUser   login user\n     * @param scheduleId  schedule id\n     */\n    @Override\n    public void deleteSchedulesById(User loginUser, Integer scheduleId) {\n        Schedule schedule = scheduleDao.queryById(scheduleId);\n        if (schedule == null) {\n            throw new ServiceException(Status.SCHEDULE_NOT_EXISTS, scheduleId);\n        }\n        // check schedule is already online\n        if (schedule.getReleaseState() == ReleaseState.ONLINE) {\n            throw new ServiceException(Status.SCHEDULE_STATE_ONLINE, scheduleId);\n        }\n        // Determine if the login user is the owner of the schedule\n        if (loginUser.getId() != schedule.getUserId() && loginUser.getUserType() != UserType.ADMIN_USER) {\n            throw new ServiceException(Status.USER_NO_OPERATION_PERM);\n        }\n\n        this.projectPermCheckByWorkflowCode(loginUser, schedule.getWorkflowDefinitionCode());\n        boolean delete = scheduleDao.deleteById(scheduleId);\n        if (!delete) {\n            throw new ServiceException(Status.DELETE_SCHEDULE_BY_ID_ERROR);\n        }\n    }\n\n    /**\n     * preview schedule\n     *\n     * @param loginUser login user\n     * @param schedule  schedule expression\n     * @return the next five fire time\n     */\n    @Override\n    public List<String> previewSchedule(User loginUser, String schedule) {","sourceCodeStart":342,"sourceCodeEnd":378,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/SchedulerServiceImpl.java#L342-L378","documentation":"USER_NO_OPERATION_PERM is thrown by deleteSchedulesById when the login user is neither the creator of the schedule (loginUser.getId() != schedule.getUserId()) nor an admin (UserType.ADMIN_USER). Ownership plus project write permission (checked afterwards via projectPermCheckByWorkflowCode) are required to delete someone else's schedule.","triggerScenarios":"DELETE /projects/{projectCode}/schedules/{id} called by a non-admin user who did not create the schedule, e.g. a project member with view-only rights, or a service account whose token belongs to a different user than the schedule owner.","commonSituations":"Automation using a generic API account while schedules were created by individual users; offboarding scripts cleaning up schedules they don't own; team members with read permissions attempting deletions; permission model changed in an upgrade so formerly-allowed deletes now fail.","solutions":["Log in / authenticate as the schedule owner or as an admin user and retry.","Grant the user project write permission (and have an admin delete the schedule if ownership transfer is not possible).","Delete the schedule as ADMIN via the admin account, or recreate the schedule under the correct owner."],"exampleFix":"// before\ncurl -u viewer:token -X DELETE '/projects/1/schedules/42'   // viewer != owner\n// after\ncurl -u admin:token -X DELETE '/projects/1/schedules/42'","handlingStrategy":"validation","validationCode":"boolean allowed = loginUser.getUserType() == UserType.ADMIN_USER\n        || Objects.equals(loginUser.getId(), schedule.getUserId());\nif (!allowed) {\n    throw new SecurityException(\"User \" + loginUser.getUserName() + \" may not delete schedule owned by \" + schedule.getUserId());\n}","typeGuard":null,"tryCatchPattern":"try { schedulerService.deleteSchedulesById(user, scheduleId); } catch (ServiceException e) { if (e.getCode() == Status.USER_NO_OPERATION_PERM) { /* escalate to admin or re-authenticate as owner */ } }","preventionTips":["Authenticate as the schedule owner or an admin for delete operations","Avoid shared service accounts that don't own the schedules they manage","Check project write permissions before scripted deletions"],"tags":["scheduler","authorization","permission"],"backgroundTag":"permission-denied","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}