{"record":{"id":"ff46c1b3d177689b","repo":"apolloconfig/apollo","slug":"not-supported-operation","errorCode":null,"errorMessage":"Not supported operation","messagePattern":"Not supported operation","errorType":"http","errorClass":"UnsupportedOperationException","httpStatus":500,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/auth/ConsumerPermissionValidator.java","lineNumber":65,"sourceCode":"      String namespaceName) {\n    if (hasCreateNamespacePermission(appId)) {\n      return true;\n    }\n    return super.hasModifyNamespacePermission(appId, env, clusterName, namespaceName);\n  }\n\n  @Override\n  public boolean hasReleaseNamespacePermission(String appId, String env, String clusterName,\n      String namespaceName) {\n    if (hasCreateNamespacePermission(appId)) {\n      return true;\n    }\n    return super.hasReleaseNamespacePermission(appId, env, clusterName, namespaceName);\n  }\n\n  @Override\n  public boolean hasCreateAppNamespacePermission(String appId, AppNamespace appNamespace) {\n    throw new UnsupportedOperationException(\"Not supported operation\");\n  }\n\n  @Override\n  public boolean isSuperAdmin() {\n    // openapi shouldn't be\n    return false;\n  }\n\n  @Override\n  public boolean shouldHideConfigToCurrentUser(String appId, String env, String clusterName,\n      String namespaceName) {\n    throw new UnsupportedOperationException(\"Not supported operation\");\n  }\n\n  @Override\n  public boolean hasCreateApplicationPermission() {\n    long consumerId = consumerAuthUtil.retrieveConsumerIdFromCtx();\n    return permissionService.consumerHasPermission(consumerId, PermissionType.CREATE_APPLICATION,","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/auth/ConsumerPermissionValidator.java#L47-L83","documentation":"Thrown as UnsupportedOperationException by ConsumerPermissionValidator.hasCreateAppNamespacePermission. ConsumerPermissionValidator is the OpenAPI (third-party token/consumer) permission validator and intentionally rejects operations that only the interactive portal can perform. Creating AppNamespaces is not exposed through the consumer/OpenAPI permission model.","triggerScenarios":"An OpenAPI request authenticated as a Consumer (token) reaches code that calls hasCreateAppNamespacePermission(appId, appNamespace) on the consumer validator.","commonSituations":"Routing a portal-only admin action through the OpenAPI consumer path; misconfigured permission validator bean selected for an openapi request; calling a portal endpoint with a consumer token.","solutions":["Use the portal UI / admin service (interactive user auth) to create AppNamespaces, not the OpenAPI consumer flow.","Ensure the request path selects the correct permission validator (user vs consumer).","Avoid invoking hasCreateAppNamespacePermission from OpenAPI-consumer-authenticated controllers."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Do not invoke create-appnamespace permission via the consumer/openapi path.\n// Route AppNamespace creation through portal admin (user principal) instead.","typeGuard":"boolean isConsumerPrincipal = SecurityContextHolder.getContext().getAuthentication()\n    .getPrincipal() instanceof ConsumerAuthenticationToken;\n// guard: skip hasCreateAppNamespacePermission when isConsumerPrincipal is true","tryCatchPattern":null,"preventionTips":["Select the permission validator by principal type.","Keep AppNamespace creation on portal-user endpoints, not openapi consumer endpoints."],"tags":["permissions","openapi","unsupported","apollo-portal","consumer"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}