{"record":{"id":"df3b64608bdfe71a","repo":"apache/dolphinscheduler","slug":"user-s-doesn-t-have-permission-of-s-s","errorCode":null,"errorMessage":"user %s doesn't have permission of %s %s","messagePattern":"user (.+?) doesn't have permission of (.+?) (.+?)","errorType":"exception","errorClass":"ServiceException","httpStatus":null,"severity":"error","filePath":"dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/permission/PermissionCheck.java","lineNumber":86,"sourceCode":"     *\n     * @throws ServiceException exception\n     */\n    public void checkPermission() throws ServiceException {\n        if (this.needChecks.length > 0) {\n\n            // get user type in order to judge whether the user is admin\n            User user = processService.getUserById(userId);\n            if (user == null) {\n                logger.error(\"User does not exist, userId:{}.\", userId);\n                throw new ServiceException(String.format(\"user %s doesn't exist\", userId));\n            }\n            if (user.getUserType() != UserType.ADMIN_USER) {\n                List<T> unauthorizedList = processService.listUnauthorized(userId, needChecks, authorizationType);\n                // if exist unauthorized resource\n                if (CollectionUtils.isNotEmpty(unauthorizedList)) {\n                    logger.error(\"User does not have {} permission for {}, userName:{}.\",\n                            authorizationType.getDescp(), unauthorizedList, user.getUserName());\n                    throw new ServiceException(String.format(\"user %s doesn't have permission of %s %s\",\n                            user.getUserName(), authorizationType.getDescp(), unauthorizedList.get(0)));\n                }\n            }\n        }\n    }\n\n}\n","sourceCodeStart":68,"sourceCodeEnd":94,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/permission/PermissionCheck.java#L68-L94","documentation":"PermissionCheck.checkPermission, for non-admin users, asks processService.listUnauthorized which of the checked resources (by authorizationType) the user does NOT own. If any are unauthorized it throws a ServiceException naming the user, the resource type description, and the first unauthorized resource. This is the generic resource-ownership guard on APIs like task definition release.","triggerScenarios":"A non-admin user calls an operation (e.g. releaseTaskDefinition) on a resource (task definition, project, datasource...) whose owner is another user, and the id/code is in needChecks.","commonSituations":"Sharing a task URL between colleagues without granting project permission; a user renamed/transferred resources; automation using a service account that doesn't own the resources.","solutions":["Grant the user access to the resource (project authorization: grant project/task-definition permission in the UI or via grant APIs)","Perform the operation as the resource owner or as an admin","Check the log line 'User does not have ... permission for ...' to see the exact unauthorized resource","If ownership is wrong, transfer the resource to the intended owner"],"exampleFix":"// before: direct call fails for non-owner\npermissionCheck.checkPermission(userId, AuthorizationType.TASK_DEFINITION, taskCode);\n// after: ensure grant exists first\nprojectService.checkProjectAndAuth(loginUser, project, projectName);\npermissionCheck.checkPermission(userId, AuthorizationType.TASK_DEFINITION, taskCode);","handlingStrategy":"try-catch","validationCode":"// caller-side pre-check\nList<T> unauthorized = processService.listUnauthorized(userId, needChecks, authorizationType);\nif (!unauthorized.isEmpty()) {\n    throw new ServiceException(\"no permission on \" + unauthorized.get(0));\n}","typeGuard":"boolean hasAllPermissions(User user, Object... resourceIds) {\n    if (user == null || user.getUserType() == UserType.ADMIN_USER) return true;\n    return processService.listUnauthorized(user.getId(), resourceIds, authorizationType).isEmpty();\n}","tryCatchPattern":"try {\n    permissionCheck.checkPermission(userId, taskCode, AuthorizationType.TASK_DEFINITION);\n} catch (ServiceException e) {\n    if (e.getMessage().contains(\"doesn't have permission of\")) {\n        log.warn(\"grant required: {}\", e.getMessage());\n        throw new ServiceStatusHttpException(Status.USER_NO_OPERATION_PERM, e);\n    }\n    throw e;\n}","preventionTips":["Grant project/resource permissions before sharing tasks across teams","Use the resource-owner or admin account for administrative operations","Read the error's unauthorized resource list to request exactly the right grant","Regularly audit ownership transfers after team member changes"],"tags":["authorization","permission","rbac"],"backgroundTag":"permission-denied","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}