{"record":{"id":"e73e2c650fa2e606","repo":"abpframework/abp","slug":"volo-authorization-010004","errorCode":"Volo.Authorization:010004","errorMessage":"Authorization failed! Given requirement has not granted for given resource: {ResourceName}","messagePattern":"Authorization failed! Given requirement has not granted for given resource: (.+?)","errorType":"exception","errorClass":"AbpAuthorizationException","httpStatus":403,"severity":"error","filePath":"framework/src/Volo.Abp.Authorization/Microsoft/AspNetCore/Authorization/AbpAuthorizationServiceExtensions.cs","lineNumber":135,"sourceCode":"    {\n        if (!await authorizationService.IsGrantedAsync(policyName))\n        {\n            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenPolicyHasNotGrantedWithPolicyName)\n                .WithData(\"PolicyName\", policyName);\n        }\n    }\n\n    /// <summary>\n    /// Checks if CurrentPrincipal meets a specific requirement for the specified resource, throwing an <see cref=\"AbpAuthorizationException\"/> if not.\n    /// </summary>\n    /// <param name=\"authorizationService\">The <see cref=\"IAuthorizationService\"/> providing authorization.</param>\n    /// <param name=\"resource\">The resource to evaluate the policy against.</param>\n    /// <param name=\"requirement\">The requirement to evaluate the policy against.</param>\n    public static async Task CheckAsync(this IAuthorizationService authorizationService, object resource, IAuthorizationRequirement requirement)\n    {\n        if (!await authorizationService.IsGrantedAsync(resource, requirement))\n        {\n            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenRequirementHasNotGrantedForGivenResource)\n                .WithData(\"ResourceName\", resource);\n        }\n    }\n\n    /// <summary>\n    /// Checks if CurrentPrincipal meets a specific authorization policy against the specified resource, throwing an <see cref=\"AbpAuthorizationException\"/> if not.\n    /// </summary>\n    /// <param name=\"authorizationService\">The <see cref=\"IAuthorizationService\"/> providing authorization.</param>\n    /// <param name=\"resource\">The resource to evaluate the policy against.</param>\n    /// <param name=\"policy\">The policy to evaluate.</param>\n    public static async Task CheckAsync(this IAuthorizationService authorizationService, object resource, AuthorizationPolicy policy)\n    {\n        if (!await authorizationService.IsGrantedAsync(resource, policy))\n        {\n            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenPolicyHasNotGrantedForGivenResource)\n                .WithData(\"ResourceName\", resource);\n        }\n    }","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/abpframework/abp/blob/7ed43b1931b9df46a50c0c59148a18645641d0df/framework/src/Volo.Abp.Authorization/Microsoft/AspNetCore/Authorization/AbpAuthorizationServiceExtensions.cs#L117-L153","documentation":"Thrown by CheckAsync(this IAuthorizationService, object resource, IAuthorizationRequirement requirement) when IsGrantedAsync(resource, requirement) is false. Error code Volo.Authorization:010004 (GivenRequirementHasNotGrantedForGivenResource), with ResourceName (the resource object) attached as data. This is the resource+requirement variant used for instance-level authorization (e.g. 'can edit THIS document').","triggerScenarios":"Calling authorizationService.CheckAsync(document, new EditRequirement()) where the registered AuthorizationHandler for that requirement+resource type denies the current user for that specific resource instance.","commonSituations":"Resource belongs to another user/tenant; requirement handler enforces ownership or status that the current principal fails; handler not registered or mis-scoped; resource passed is null/wrong type so the handler falls through to deny.","solutions":["Ensure the current user actually satisfies the requirement (e.g. owns the resource, has the needed role for that instance).","Confirm the AuthorizationHandler<TRequirement, TResource> is registered and evaluates the resource correctly.","Pass the correct, non-null resource instance of the expected type.","If instance-level access is genuinely denied, surface a 403 to the caller."],"exampleFix":"// before\nawait AuthorizationService.CheckAsync(doc, Requirements.Edit); // throws 010004\n// after: ensure handler grants for owners\npublic class EditHandler : AuthorizationHandler<EditRequirement, Document> {\n  protected override Task HandleRequirementAsync(\n      AuthorizationHandlerContext ctx, EditRequirement req, Document doc) {\n    if (doc.OwnerId == ctx.User.GetId()) ctx.Succeed(req);\n    return Task.CompletedTask;\n  }\n}","handlingStrategy":"validation","validationCode":"if (!await authorizationService.IsGrantedAsync(resource, requirement))\n{\n    // return 403 for this resource instead of throwing\n}","typeGuard":"null","tryCatchPattern":"try { await authorizationService.CheckAsync(resource, requirement); }\ncatch (AbpAuthorizationException ex) when (ex.Code == \"Volo.Authorization:010004\")\n{ /* handle forbidden for this resource instance */ }","preventionTips":["Register a resource-aware AuthorizationHandler<TRequirement, TResource> for each pair.","Pass the concrete, non-null resource instance of the expected type.","Use IsGrantedAsync to gate UI actions per resource.","Make instance ownership/status checks explicit in the handler."],"tags":["authorization","abp","security","resource","requirement"],"backgroundTag":null,"analyzedSha":"7ed43b1931b9df46a50c0c59148a18645641d0df","analyzedAt":"2026-08-13T16:26:11.351Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}