iflytek/astron-agent · error · BusinessException

60004

60004

Error message

error.insufficient.permissions

What it means

VersionService.assertWorkflowExecutionScope throws INSUFFICIENT_PERMISSIONS (code 60004) when executionUid is blank. Version creation/deletion/update always requires an identified acting user; an anonymous or unauthenticated execution context cannot be authorized.

Solutions

1. Ensure the caller is authenticated so executionUid is populated before invoking the service
2. Pass the acting user's uid explicitly when invoking from internal jobs
3. Fix the auth filter/interceptor that is dropping the uid from the context

Example fix

// before
versionService.logicDelete(workflowId, null, spaceId);
// after
versionService.logicDelete(workflowId, currentUser.getUid(), spaceId);

if (uid == null || uid.isBlank()) { throw new IllegalStateException("executionUid is required before calling VersionService"); }

boolean hasUid(String uid) { return uid != null && !uid.isBlank(); }

try { versionService.restore(id, uid, spaceId); } catch (BusinessException e) { if (e.getCode() == 60004) { /* redirect to login / fix identity propagation */ } else throw e; }

When it happens

Trigger: Calling createForSpace, createForBoundBotPublish, restore, logicDelete, updateChannelResult (or its bound-bot variant) with a null/empty executionUid in the security context or request.

Common situations: Calls from background jobs or webhooks that never propagate the user identity; unauthenticated test calls; a broken auth filter that fails to populate the uid.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• WORKFLOW_NOT_PUBLIC
• WORKFLOW_NOT_PUBLISH
• CREATE_BOT_FAILED
• UPDATE_BOT_FAILED
• BOT_CHAIN_SUBMIT_ERROR

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/488971f32cdc3f98. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/VersionService.java:199

    }

    @Transactional
    public ApiResult<JSONObject> createForBoundBotPublish(
            WorkflowVersion createDto, String executionUid, Long executionSpaceId) {
        log.info(
                "Starting to add workflow version for bound bot publish, flowId={}, botId={}, publishChannel={}",
                createDto.getFlowId(),
                createDto.getBotId(),
                createDto.getPublishChannel());
        Workflow workflow = requireWorkflow(createDto.getFlowId());
        assertWorkflowExecutionScope(workflow, executionUid, executionSpaceId);
        return createVersion(createDto, workflow, executionUid, executionSpaceId);
    }

    private void assertWorkflowExecutionScope(
            Workflow workflow, String executionUid, Long executionSpaceId) {
        if (StringUtils.isBlank(executionUid)) {
            throw new BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS);
        }
        if (executionSpaceId == null) {
            if (workflow.getSpaceId() != null
                    || !Objects.equals(workflow.getUid(), executionUid)) {
                throw new BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS);
            }
            return;
        }
        if (!Objects.equals(workflow.getSpaceId(), executionSpaceId)
                || spaceUserService == null
                || spaceUserService.getRole(executionSpaceId, executionUid) == null) {
            throw new BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS);
        }
    }

    private ApiResult<JSONObject> createVersion(
            WorkflowVersion createDto, Workflow workflow, String executionUid, Long executionSpaceId) {
        try {

View on GitHub (pinned to 5e758547a8)