{"record":{"id":"d3f83c9003070b3d","repo":"iflytek/astron-agent","slug":"exceed-authority-businessexception-responseenum","errorCode":"EXCEED_AUTHORITY","errorMessage":"BusinessException(ResponseEnum.EXCEED_AUTHORITY)","messagePattern":"BusinessException\\(ResponseEnum\\.EXCEED_AUTHORITY\\)","errorType":"error_code","errorClass":"BusinessException","httpStatus":null,"severity":"error","filePath":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/model/ModelService.java","lineNumber":1047,"sourceCode":"        ConfigInfo publicKey =\n                configInfoMapper.selectOne(\n                        new LambdaQueryWrapper<ConfigInfo>()\n                                .eq(ConfigInfo::getCategory, CAT_MODEL_SECRET_KEY)\n                                .eq(ConfigInfo::getCode, CODE_PUBLIC_KEY)\n                                .eq(ConfigInfo::getIsValid, 1));\n        return Optional.ofNullable(publicKey).map(ConfigInfo::getValue).orElse(null);\n    }\n\n    @Transactional(rollbackFor = Exception.class)\n    public ApiResult checkAndDelete(Long modelId, HttpServletRequest request) {\n        String uid = UserInfoManagerHandler.getUserId();\n        Model model = this.getById(modelId);\n        if (model == null) {\n            throw new BusinessException(ResponseEnum.MODEL_NOT_EXIST);\n        }\n        if (!model.getUid().equals(uid)) {\n            log.warn(\"Unauthorized deletion, uid={}, modelId={}\", uid, modelId);\n            throw new BusinessException(ResponseEnum.EXCEED_AUTHORITY);\n        }\n\n        checkWorkflowReference(uid, model);\n\n        Integer modelCount = sparkBotMapper.checkDomainIsUsage(uid, model.getDomain());\n        if (modelCount != null && modelCount > 0) {\n            throw new BusinessException(ResponseEnum.MODEL_DELETE_FAILED_APPLY_AGENT);\n        }\n\n        boolean result;\n        if (Objects.equals(model.getType(), 1)) {\n            result = this.removeById(modelId);\n        } else {\n            result = this.removeById(modelId) && modelHandler.deleteModel(model.getRemark());\n        }\n        return ApiResult.success(result);\n    }\n","sourceCodeStart":1029,"sourceCodeEnd":1065,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/model/ModelService.java#L1029-L1065","documentation":"Thrown by checkAndDelete after the model is found, when model.getUid() does not equal the uid resolved from the current session (UserInfoManagerHandler.getUserId()). Only the owner may delete a model; anyone else — even a space admin — receives EXCEED_AUTHORITY.","triggerScenarios":"Authenticated user A invokes the delete API for a model created by user B; session/uid header resolves to a different account than the one that created the model (e.g. after switching accounts or service-account tokens).","commonSituations":"Shared test environments where a teammate tries to delete another's model; API tokens belonging to a different user than the UI session; uid stored with different casing/format so equals() fails.","solutions":["Delete the model as the owning user (log in with or use credentials of model.getUid()).","Have the owner delete it, or add an explicit admin/transfer flow if delegation is required.","Verify the auth context (UserInfoManagerHandler) resolves the expected uid — check token/session mismatch.","Compare stored uid and session uid for format differences (whitespace, case) if ownership looks correct."],"exampleFix":"// before\n// deleting with a service account token whose uid != model owner\nawait deleteModel(modelId);\n// after\nconst model = await getModelDetail(modelId);\nif (model.uid !== currentUid) {\n  throw new Error(`Only owner ${model.uid} can delete model ${modelId}`);\n}\nawait deleteModel(modelId);","handlingStrategy":"validation","validationCode":"Model m = modelService.getById(modelId);\nboolean owned = m != null && Objects.equals(m.getUid(), UserInfoManagerHandler.getUserId());","typeGuard":"if (m == null || m.getUid() == null || !m.getUid().equals(currentUid)) { /* not owner */ }","tryCatchPattern":"try { return modelService.checkAndDelete(modelId, request); }\ncatch (BusinessException e) {\n  if (ResponseEnum.EXCEED_AUTHORITY.equals(e.getResponseEnum())) {\n    throw new BusinessException(e.getResponseEnum(), \"Only the model owner can delete this model\");\n  }\n  throw e;\n}","preventionTips":["Expose an isOwner flag in list/detail APIs so the UI can hide delete buttons","Ensure auth tokens and session uid resolve to the same account","Never assume space admin rights imply delete permission"],"tags":["java","authorization","ownership"],"backgroundTag":"permission-denied","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}