{"record":{"id":"f1a1dbb69361c74f","repo":"alibaba/nacos","slug":"access-denied-f1a1db","errorCode":"ACCESS_DENIED","errorMessage":"No permission to manage visibility grants for resource: {resourceName}","messagePattern":"No permission to manage visibility grants for resource: (.+?)","errorType":"exception","errorClass":"NacosApiException","httpStatus":403,"severity":"error","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/visibility/DefaultVisibilityGrantService.java","lineNumber":226,"sourceCode":"        return resource.orElseThrow(() -> new NacosApiException(NacosException.NOT_FOUND,\n            ErrorCode.RESOURCE_NOT_FOUND,\n            \"resource not found: \" + resourceName));\n    }\n    \n    private void checkManageGrantAuthority(VisibilityResource resource) throws NacosException {\n        // Allow access rules: 1. Authentication not enabled; 2. Global administrator; 3. Resource owner.\n        if (!NacosAuthConfigHolder.getInstance().isAnyAuthEnabled()) {\n            return;\n        }\n        String currentUsername = AuthIdentityUtils.resolveCurrentUsername();\n        if (AuthIdentityUtils.isCurrentIdentityGlobalAdmin(currentUsername)) {\n            return;\n        }\n        if (StringUtils.isNotBlank(currentUsername)\n            && currentUsername.equals(resource.getOwner())) {\n            return;\n        }\n        throw new NacosApiException(NacosException.NO_RIGHT, ErrorCode.ACCESS_DENIED,\n            \"No permission to manage visibility grants for resource: \"\n                + resource.getResourceName());\n    }\n    \n    private void validateResourceTypeAndName(String resourceType, String resourceName)\n        throws NacosException {\n        if (StringUtils.isBlank(resourceType)) {\n            throw new NacosApiException(NacosException.INVALID_PARAM, ErrorCode.PARAMETER_MISSING,\n                \"resourceType is blank\");\n        }\n        if (StringUtils.isBlank(resourceName)) {\n            throw new NacosApiException(NacosException.INVALID_PARAM, ErrorCode.PARAMETER_MISSING,\n                \"resourceName is blank\");\n        }\n    }\n    \n    private void validateUsername(String username) throws NacosException {\n        if (StringUtils.isBlank(username)) {","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/visibility/DefaultVisibilityGrantService.java#L208-L244","documentation":"Thrown by DefaultVisibilityGrantService.checkManageGrantAuthority() when the current authenticated identity is not authorized to manage visibility grants for a resource. The method allows access only if: (1) authentication is disabled, (2) the current user is a global administrator, or (3) the current user is the resource owner. If none of these conditions hold, it throws NacosApiException with code NO_RIGHT (access denied).","triggerScenarios":"Calling grant() or revoke() when: authentication is enabled AND the current user is neither a global admin nor the owner of the target resource. The resource owner is determined by VisibilityResource.getOwner().","commonSituations":"A regular (non-admin) user attempts to manage visibility grants for a resource they don't own; a user's ownership metadata is incorrect or missing; the current username resolution fails to identify the caller (AuthIdentityUtils.resolveCurrentUsername returns blank).","solutions":["Ensure the calling user has global admin privileges, or is the owner of the target resource.","Verify that AuthIdentityUtils.resolveCurrentUsername() correctly resolves the caller's identity — check that the authentication context is properly populated.","If the resource owner is wrong, update the resource's ownership metadata in the owning module.","Use an admin account to perform visibility grant management operations."],"exampleFix":"// Before calling grant/revoke, check authority client-side:\nif (!AuthIdentityUtils.isCurrentIdentityGlobalAdmin(currentUser)\n    && !currentUser.equals(resource.getOwner())) {\n    // abort with a user-friendly message\n    return Result.failure(\"Insufficient permissions to manage visibility grants\");\n}","handlingStrategy":"validation","validationCode":"// Verify authority before calling grant/revoke\nboolean authEnabled = NacosAuthConfigHolder.getInstance().isAnyAuthEnabled();\nif (authEnabled) {\n    String currentUser = AuthIdentityUtils.resolveCurrentUsername();\n    boolean isAdmin = AuthIdentityUtils.isCurrentIdentityGlobalAdmin(currentUser);\n    boolean isOwner = currentUser != null && currentUser.equals(resource.getOwner());\n    if (!isAdmin && !isOwner) {\n        throw new AccessDeniedException(\"Insufficient permissions for visibility grant management\");\n    }\n}","typeGuard":"public static boolean canManageVisibilityGrants(VisibilityResource resource) {\n    if (!NacosAuthConfigHolder.getInstance().isAnyAuthEnabled()) return true;\n    String user = AuthIdentityUtils.resolveCurrentUsername();\n    return AuthIdentityUtils.isCurrentIdentityGlobalAdmin(user)\n        || (user != null && user.equals(resource.getOwner()));\n}","tryCatchPattern":"try {\n    service.grant(namespaceId, resourceType, resourceName, username, action);\n} catch (NacosApiException e) {\n    if (e.getErrCode() == NacosException.NO_RIGHT) {\n        return Result.failure(\"Access denied: you must be an admin or the resource owner\");\n    }\n    throw e;\n}","preventionTips":["Use an admin account for visibility grant management operations.","Verify the current user's role and the resource owner before calling grant/revoke.","Ensure AuthIdentityUtils.resolveCurrentUsername() returns a correct value in the auth context."],"tags":["auth","visibility","authorization","access-denied","rbac"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}