iflytek/astron-agent · error · BusinessException

EXCEED_AUTHORITY

EXCEED_AUTHORITY

Error message

EXCEED_AUTHORITY

What it means

WorkflowAutomationService.requireTask() enforces per-task access control before returning a WorkflowAutomationTask. When the current request has a spaceId context, the task's spaceId must match it; otherwise the task's owner uid must match the current user. If neither matches, EXCEED_AUTHORITY is thrown, meaning the caller is not allowed to operate on this automation task.

Solutions

1. Verify the task id belongs to the current user (uid equals task.getUid()) or to the current space (task.getSpaceId() equals SpaceInfoUtil.getSpaceId()).
2. Log in as the task owner, or switch your console session to the space the task lives in.
3. If the task should be shared, recreate it in the target space or update task.spaceId/uid via an administrator operation.
4. Check SpaceInfoUtil.getSpaceId() is correctly populated by the auth filter; a wrong/null space context can cause false denials.

Example fix

// before (caller guesses task id)
WorkflowAutomationTask task = automationService.task(otherUsersTaskId);
// after (caller lists only its own scoped tasks first)
List<WorkflowAutomationTask> mine = automationService
    .pageTasks(scopedTaskQuery())
    .getRecords();
WorkflowAutomationTask task = automationService.task(mine.get(0).getId());

boolean canAccess = Objects.equals(task.getUid(), currentUid)
    || (currentSpaceId != null && Objects.equals(task.getSpaceId(), currentSpaceId));
if (!canAccess) throw new AccessDeniedException(task.getId());

static boolean isOwnTask(WorkflowAutomationTask t, String uid, Long spaceId) {
    return spaceId != null
        ? Objects.equals(t.getSpaceId(), spaceId)
        : Objects.equals(t.getUid(), uid);
}

When it happens

Trigger: Calling task(id) or pageRuns(...) for an automation task owned by a different user, or from a different space than the one resolved via SpaceInfoUtil.getSpaceId(); also hitting a task after switching spaces or after the task was moved/reassigned to another owner.

Common situations: A user shares a workflow URL/id with a colleague who tries to view its runs; an admin operating without a space context inspects another tenant's task; a stale frontend session still points at the old space after the user switched workspaces.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• INSUFFICIENT_PERMISSIONS
• PERMISSION_NOT_BELONG_SPACE
• 最近访问空间不存在
• USER_NO_APPROVEL
• INSUFFICIENT_PERMISSIONS

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/2554a5897d125d14. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowAutomationService.java:263

        if (!isPublished(workflow)) {
            throw new BusinessException(ResponseEnum.WORKFLOW_NOT_PUBLISH);
        }
        dataPermissionCheckTool.checkWorkflowBelong(workflow, SpaceInfoUtil.getSpaceId());
        return workflow;
    }

    private WorkflowAutomationTask requireTask(Long id) {
        WorkflowAutomationTask task = getById(id);
        if (task == null || Boolean.TRUE.equals(task.getDeleted())) {
            throw new BusinessException(ResponseEnum.DATA_NOT_EXIST);
        }
        Long spaceId = SpaceInfoUtil.getSpaceId();
        String uid = UserInfoManagerHandler.getUserId();
        boolean denied = spaceId == null
                ? !Objects.equals(task.getUid(), uid)
                : !Objects.equals(task.getSpaceId(), spaceId);
        if (denied) {
            throw new BusinessException(ResponseEnum.EXCEED_AUTHORITY);
        }
        return task;
    }

    private LambdaQueryWrapper<WorkflowAutomationTask> scopedTaskQuery() {
        LambdaQueryWrapper<WorkflowAutomationTask> wrapper = Wrappers.lambdaQuery(WorkflowAutomationTask.class);
        Long spaceId = SpaceInfoUtil.getSpaceId();
        if (spaceId == null) {
            wrapper.eq(WorkflowAutomationTask::getUid, UserInfoManagerHandler.getUserId());
        } else {
            wrapper.eq(WorkflowAutomationTask::getSpaceId, spaceId);
        }
        return wrapper;
    }

    private String normalizeInputParams(String inputParams) {
        String normalized = StringUtils.defaultIfBlank(inputParams, "{}");
        try {

View on GitHub (pinned to 5e758547a8)