{"record":{"id":"ff9a2af114f55722","repo":"SonarSource/sonarqube","slug":"nopermissionsourcemessage-projectkey-reason","errorCode":null,"errorMessage":"noPermissionSourceMessage(projectKey, reason)","messagePattern":"noPermissionSourceMessage\\(projectKey, reason\\)","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/ce/queue/ReportSubmitter.java","lineNumber":214,"sourceCode":"      return devOpsProjectCreator.createProjectAndBindToDevOpsPlatform(dbSession, SCANNER_API_DEVOPS_AUTO_CONFIG, false, projectKey, projectName, false);\n    }\n    return projectCreator.createProject(dbSession, componentKey.getKey(), defaultIfBlank(projectName, projectKey), null, SCANNER_API);\n  }\n\n  private void throwIfCurrentUserWouldNotHaveScanPermission(String projectKey, DbSession dbSession, @Nullable DevOpsProjectCreator devOpsProjectCreator) {\n    if (!wouldCurrentUserHaveScanPermission(projectKey, dbSession, devOpsProjectCreator)) {\n      throw insufficientPrivilegesException();\n    }\n  }\n\n  private boolean wouldCurrentUserHaveScanPermission(String projectKey, DbSession dbSession, @Nullable DevOpsProjectCreator devOpsProjectCreator) {\n    if (userSession.hasPermission(SCAN)) {\n      return true;\n    }\n    if (managedInstanceService.isInstanceExternallyManaged() && devOpsProjectCreator != null) {\n      devOpsProjectCreator.permissionsFromDevopsPlatformUnavailableReason()\n        .ifPresent(reason -> {\n          throw new ForbiddenException(noPermissionSourceMessage(projectKey, reason));\n        });\n      return devOpsProjectCreator.isScanAllowedUsingPermissionsFromDevopsPlatform();\n    }\n    return permissionTemplateService.wouldUserHaveScanPermissionWithDefaultTemplate(dbSession, userSession.getUuid(), projectKey);\n  }\n\n  /**\n   * The analysis cannot create the project: the token holds no global 'Execute Analysis' permission, and the DevOps platform\n   * cannot be queried to resolve the permissions of the current user either. Both conditions are reported, since knowing only\n   * one of them is not enough to fix the configuration.\n   */\n  private static String noPermissionSourceMessage(String projectKey, String devOpsPlatformUnavailableReason) {\n    return format(\"Project '%s' does not exist and cannot be created by this analysis. The token does not have the 'Execute Analysis'\"\n      + \" permission, and %s. Create and bind the project first (POST %s), or grant the 'Execute Analysis' permission.\",\n      projectKey, devOpsPlatformUnavailableReason, BOUND_PROJECTS_ENDPOINT);\n  }\n\n  private CeTask submitReport(DbSession dbSession, InputStream reportInput, ComponentDto branch, BranchDto mainBranch, Map<String, String> characteristics) {","sourceCodeStart":196,"sourceCodeEnd":232,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/ce/queue/ReportSubmitter.java#L196-L232","documentation":"ReportSubmitter.wouldCurrentUserHaveScanPermission determines whether the current user may submit a report for projectKey. If the instance is externally managed, any reason reported by the DevOps project creator why DevOps-platform permissions are unavailable is surfaced as a ForbiddenException via noPermissionSourceMessage. Otherwise it falls back to checking the default permission template.","triggerScenarios":"POST to api/ce/submit on an externally managed instance where the project creator (e.g. Azure DevOps/GitLab integration) reports it cannot fetch permissions from the DevOps platform (bad binding, expired platform token, project not linked).","commonSituations":"DevOps platform integration misconfigured or token revoked; project not provisioned/bound so the platform cannot confirm scan permission; default permission template lacking Execute Analysis for the submitting user on non-managed instances.","solutions":["Fix the DevOps platform integration: verify the project binding and that the platform token is valid","Confirm the user has Execute Analysis via the DevOps platform role mapping","On non-managed instances, add Execute Analysis in the project's default permission template","Grant explicit project Execute Analysis permission if DevOps sync is not required"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"boolean canScan = wsClient.get(\"api/permissions/search?project=\" + key + \"&permission=scan\")\n  .hasComponentFor(currentUser); if (!canScan) skipSubmit(key);","typeGuard":null,"tryCatchPattern":"try { submit(report); } catch (ForbiddenException e) { log(e.message); notifyAdmin(); }","preventionTips":["Keep DevOps platform bindings and tokens healthy on managed instances","Map CI roles to Execute Analysis in the DevOps platform","Verify default permission templates include the CI group"],"tags":["java","sonarqube","permissions","devops-integration"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}