apolloconfig/apollo · error · BadRequestException

Current user not found

Error message

Current user not found

What it means

Thrown by ClusterController.resolveOperator when authType is USER or USER_TOKEN but userInfoHolder.getUser() returns null or a UserInfo with a blank userId. The resolveOperator method determines who is performing the write operation; for interactive or user-token identities, it expects a valid logged-in user in the session context. Maps to HTTP 400 BadRequestException.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/ClusterController.java:152

      throw new AccessDeniedException("Access is denied");
    }
  }

  private void requireCreateClusterPermissionForUserToken(String appId, String env,
      String clusterName) {
    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())
        && !unifiedPermissionValidator.hasCreateClusterPermission(appId, env, clusterName)) {
      throw new AccessDeniedException("Create cluster permission is required");
    }
  }

  private String resolveOperator(String operator) {
    String authType = UserIdentityContextHolder.getAuthType();
    if (UserIdentityConstants.USER.equals(authType)
        || UserIdentityConstants.USER_TOKEN.equals(authType)) {
      UserInfo loginUser = userInfoHolder.getUser();
      if (loginUser == null || StringUtils.isBlank(loginUser.getUserId())) {
        throw new BadRequestException("Current user not found");
      }
      return loginUser.getUserId();
    }

    RequestPrecondition.checkArguments(!StringUtils.isContainEmpty(operator),
        "operator should not be null or empty");

    if (userService.findByUserId(operator) == null) {
      throw BadRequestException.userNotExists(operator);
    }
    return operator;
  }

}

View on GitHub (pinned to d95fc18d11)

Solutions

  1. For USER auth: re-authenticate through the Portal login flow to establish a fresh session.
  2. For USER_TOKEN: verify the token's associated user account still exists and is active in the Portal.
  3. In tests: ensure userInfoHolder.getUser() returns a UserInfo with a non-blank userId before invoking the controller method.

Example fix

// before — test/mock returns null user
when(userInfoHolder.getUser()).thenReturn(null);
controller.createCluster("appA", "DEV", clusterDTO); // throws

// after — provide a valid UserInfo
UserInfo user = new UserInfo();
user.setUserId("testUser");
when(userInfoHolder.getUser()).thenReturn(user);
Defensive patterns

Strategy: try-catch

Validate before calling

// Before calling cluster write, verify user session is valid (for USER/USER_TOKEN auth)
UserInfo user = userInfoHolder.getUser();
if (user == null || StringUtils.isBlank(user.getUserId())) {
    // Re-authenticate or surface a login-required message
    throw new IllegalStateException("No active user session. Please re-authenticate.");
}

Try / catch

try {
    controller.createCluster(appId, env, clusterDTO);
} catch (BadRequestException e) {
    if ("Current user not found".equals(e.getMessage())) {
        // Session expired — redirect to login or refresh the token
        redirectToLogin();
    } else {
        throw e;
    }
}

Prevention

When it happens

Trigger: Any cluster write endpoint (createCluster, deleteCluster) called with USER or USER_TOKEN auth where the user session has expired, is not populated, or the UserInfoHolder returns a UserInfo object with a null/blank userId field.

Common situations: A Portal session expired mid-operation (USER path), or a USER_TOKEN was issued for an account that was subsequently deleted/deactivated. Can also occur in integration tests where the UserInfoHolder mock is not properly configured, or after a Spring Security context is cleared by a concurrent request in the same thread.

Related errors

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/4add449140acda74. Report an issue: GitHub.