apolloconfig/apollo · error · BadRequestException

Current user not found

Error message

Current user not found

What it means

HTTP 400 (BadRequestException). Thrown by OpenApiOperatorResolver.resolve: auth type USER or USER_TOKEN but UserInfoHolder.getUser() is null or its userId has no text. This is the shared operator-resolution helper used across multiple OpenAPI controllers; it centralizes the same principal-missing failure seen in errors 84/92.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/OpenApiOperatorResolver.java:48

 */
@Component
public class OpenApiOperatorResolver {

  private final UserInfoHolder userInfoHolder;
  private final UserService userService;

  public OpenApiOperatorResolver(UserInfoHolder userInfoHolder, UserService userService) {
    this.userInfoHolder = userInfoHolder;
    this.userService = userService;
  }

  public String resolve(String operator) {
    String authType = UserIdentityContextHolder.getAuthType();
    if (UserIdentityConstants.USER.equals(authType)
        || UserIdentityConstants.USER_TOKEN.equals(authType)) {
      UserInfo loginUser = userInfoHolder.getUser();
      if (loginUser == null || !StringUtils.hasText(loginUser.getUserId())) {
        throw new BadRequestException("Current user not found");
      }
      return loginUser.getUserId();
    }

    if (UserIdentityConstants.CONSUMER.equals(authType)) {
      if (!StringUtils.hasText(operator)) {
        throw new BadRequestException("operator should not be null or empty");
      }
      if (userService.findByUserId(operator) == null) {
        throw BadRequestException.userNotExists(operator);
      }
      return operator;
    }

    throw new BadRequestException("Unsupported auth type: %s", authType);
  }
}

View on GitHub (pinned to d95fc18d11)

Solutions

  1. Re-authenticate (fresh portal session or user-token) and retry.
  2. Ensure the auth filter populates UserInfoHolder with a non-blank userId for USER/USER_TOKEN requests.
  3. Use CONSUMER auth and pass an explicit operator if calling via OpenAPI token.
  4. Add a pre-controller guard that rejects requests with a missing principal.

Example fix

// before: USER_TOKEN principal missing -> 400
String op = resolver.resolve(null);

// after: ensure principal populated, or use CONSUMER
client.withConsumerToken(token).someWrite(op="svcacct");
Defensive patterns

Strategy: try-catch

Validate before calling

// For USER/USER_TOKEN: confirm principal present before resolving operator.
UserInfo u = userInfoHolder.getUser();
if (u == null || !StringUtils.hasText(u.getUserId())) { /* re-authenticate */ }

Type guard

null

Try / catch

try {
  client.someWrite(appId, payload);
} catch (HttpClientErrorException.BadRequest e) {
  if (e.getResponseBodyAsString().contains("Current user not found")) {
    refreshToken(); client.someWrite(appId, payload);
  }
}

Prevention

When it happens

Trigger: Any OpenAPI write endpoint that delegates to OpenApiOperatorResolver.resolve() under USER/USER_TOKEN auth when the Spring Security principal is absent or has a blank userId.

Common situations: Expired portal session; user-token authenticated without resolving to a UserInfo; custom auth filter sets authType but not UserInfoHolder; gateway/proxy stripped auth context.

Related errors

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/c09db1fff89cee72. Report an issue: GitHub.