{"record":{"id":"da52cfd7cd07febb","repo":"SonarSource/sonarqube","slug":"user-doesn-t-have-rights-to-requested-resource-any","errorCode":null,"errorMessage":"User doesn't have rights to requested resource anymore.","messagePattern":"User doesn't have rights to requested resource anymore\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"server/sonar-webserver-pushapi/src/main/java/org/sonar/server/pushapi/sonarlint/SonarLintClientPermissionsValidator.java","lineNumber":79,"sourceCode":"    }\n    UserSession userSession = userSessionFactory.create(userDto, false);\n    List<ProjectDto> projectDtos;\n    try (DbSession dbSession = dbClient.openSession(false)) {\n      projectDtos = dbClient.projectDao().selectByUuids(dbSession, projectUuids);\n    }\n    validateProjectPermissions(userSession, projectDtos);\n  }\n\n  private static void validateProjectPermissions(UserSession userSession, List<ProjectDto> projectDtos) {\n    validateUsersDeactivationStatus(userSession);\n    for (ProjectDto projectDto : projectDtos) {\n      userSession.checkEntityPermission(ProjectPermission.USER, projectDto);\n    }\n  }\n\n  private static void validateUsersDeactivationStatus(UserSession userSession) {\n    if (!userSession.isActive()) {\n      throw new ForbiddenException(\"User doesn't have rights to requested resource anymore.\");\n    }\n  }\n}\n","sourceCodeStart":61,"sourceCodeEnd":83,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-pushapi/src/main/java/org/sonar/server/pushapi/sonarlint/SonarLintClientPermissionsValidator.java#L61-L83","documentation":"validateUsersDeactivationStatus checks userSession.isActive() after permissions have been validated and throws ForbiddenException 'User doesn't have rights to requested resource anymore.' when the user session is inactive (deactivated user). It ensures deactivated accounts cannot keep consuming push events even if stale permission grants exist.","triggerScenarios":"A push-event request from a user whose account has been deactivated in SonarQube but whose SonarLint client still holds a session/token.","commonSituations":"Offboarding: an employee is deactivated while their IDE keeps polling SonarLint push events; automated clients using service accounts that were disabled.","solutions":["Reactivate the user in SonarQube (Administration > Users) if access should continue.","Stop/disconnect the SonarLint client or rotate its credentials after deactivation.","Use an active dedicated service account for automated push-event consumers."],"exampleFix":"// before\n// automated job runs with deactivated user 'old-bot'\n// after\n// provision an active service account and use it\nsonarClient.login(\"svc-sonarlint-bot\", activeToken);","handlingStrategy":"try-catch","validationCode":"// check the account is active before use: GET api/users/search?q=<login> and verify 'active': true","typeGuard":null,"tryCatchPattern":"try { pushClient.poll(); } catch (ForbiddenException e) { if (e.getMessage().contains(\"anymore\")) { stopPolling(); alertOperator(\"account deactivated\"); } }","preventionTips":["Audit that service accounts used by clients remain active","Disconnect IDE clients during offboarding","Rotate credentials when users are deactivated"],"tags":["push-api","sonarlint","forbidden","deactivated-user","java"],"backgroundTag":"permission-denied","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}