{"record":{"id":"cf3e6c55ec95d3fb","repo":"apolloconfig/apollo","slug":"operator-should-not-be-null-or-empty-cf3e6c","errorCode":null,"errorMessage":"operator should not be null or empty","messagePattern":"operator should not be null or empty","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/OpenApiOperatorResolver.java","lineNumber":55,"sourceCode":"  public OpenApiOperatorResolver(UserInfoHolder userInfoHolder, UserService userService) {\n    this.userInfoHolder = userInfoHolder;\n    this.userService = userService;\n  }\n\n  public String resolve(String operator) {\n    String authType = UserIdentityContextHolder.getAuthType();\n    if (UserIdentityConstants.USER.equals(authType)\n        || UserIdentityConstants.USER_TOKEN.equals(authType)) {\n      UserInfo loginUser = userInfoHolder.getUser();\n      if (loginUser == null || !StringUtils.hasText(loginUser.getUserId())) {\n        throw new BadRequestException(\"Current user not found\");\n      }\n      return loginUser.getUserId();\n    }\n\n    if (UserIdentityConstants.CONSUMER.equals(authType)) {\n      if (!StringUtils.hasText(operator)) {\n        throw new BadRequestException(\"operator should not be null or empty\");\n      }\n      if (userService.findByUserId(operator) == null) {\n        throw BadRequestException.userNotExists(operator);\n      }\n      return operator;\n    }\n\n    throw new BadRequestException(\"Unsupported auth type: %s\", authType);\n  }\n}\n","sourceCodeStart":37,"sourceCodeEnd":66,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/OpenApiOperatorResolver.java#L37-L66","documentation":"HTTP 400 (BadRequestException). Thrown by OpenApiOperatorResolver.resolve when auth type is CONSUMER and the supplied operator string is blank/null. For OpenAPI consumer tokens Apollo does NOT infer the operator from the principal; the client must pass an explicit operator identifying the user on whose behalf the action is performed.","triggerScenarios":"Any OpenAPI write call authenticated with a CONSUMER (OpenAPI) token where no operator query param/body field is provided, or it is empty/whitespace.","commonSituations":"OpenAPI client omitted the operator query parameter; SDK was upgraded to require operator and the call was not updated; operator field name mismatch between query param and body; trailing whitespace only.","solutions":["Pass a non-blank operator (the userId of the acting user) as a query param or in the request body for CONSUMER-auth requests.","Ensure the operator value is a real user id — it is also validated against UserService.findByUserId (a follow-up check throws userNotExists otherwise).","Keep the operator consistent with the user the automation acts on behalf of.","Add a client-side assertion that operator is non-blank before the call."],"exampleFix":"// before: CONSUMER token, no operator\nclient.withConsumerToken(token).updateItem(appId, env, cluster, ns, item); // 400\n\n// after: pass explicit operator\nclient.withConsumerToken(token)\n      .updateItem(appId, env, cluster, ns, item, operator=\"alice\");","handlingStrategy":"validation","validationCode":"// For CONSUMER auth: ensure operator is non-blank and a real user.\nif (StringUtils.isBlank(operator)) {\n  throw new IllegalStateException(\"operator required for CONSUMER token\");\n}\n// optionally confirm the user exists via a user lookup before the call","typeGuard":"null","tryCatchPattern":"try {\n  client.withConsumerToken(token).someWrite(payload, operator);\n} catch (HttpClientErrorException.BadRequest e) {\n  if (e.getResponseBodyAsString().contains(\"operator should not be null or empty\")) {\n    operator = resolveDefaultOperator(); client.withConsumerToken(token).someWrite(payload, operator);\n  }\n}","preventionTips":["Always pass an explicit, non-blank operator for CONSUMER-auth writes.","Make the operator a valid userId; a follow-up check rejects unknown users.","Add a client-side non-blank assertion for operator."],"tags":["apollo-portal","openapi","bad-request","operator","consumer","validation"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}