iflytek/astron-agent · error · BusinessException

INSUFFICIENT_PERMISSIONS

INSUFFICIENT_PERMISSIONS

Error message

ResponseEnum.INSUFFICIENT_PERMISSIONS

What it means

SkillFileService.assertExplicitScope additionally verifies space membership: when a spaceId is supplied, the uid must have a role in that space (via spaceUserService.getRole). If the space user service is unavailable or returns null (user not a member), BusinessException(INSUFFICIENT_PERMISSIONS) is thrown, blocking access to another space's skill files.

Solutions

  1. Add the user to the target space (grant a role) via space management, then retry.
  2. Verify the uid actually belongs to spaceId; use the user's own space instead.
  3. If membership was revoked intentionally, obtain access through a member of the space.
  4. In tests/local runs, ensure spaceUserService is injected rather than left null.

Example fix

// before
skillFileService.updateContent(reqWithOtherSpaceId); // INSUFFICIENT_PERMISSIONS

// after
spaceUserService.addMember(spaceId, uid, Role.MEMBER); // grant access first
skillFileService.updateContent(reqWithOtherSpaceId);
Defensive patterns

Strategy: validation

Validate before calling

if (spaceId != null && spaceUserService.getRole(spaceId, uid) == null) {
  throw new IllegalStateException("user " + uid + " has no role in space " + spaceId);
}

Try / catch

try {
  skillFileService.updateContent(req);
} catch (BusinessException e) {
  if ("INSUFFICIENT_PERMISSIONS".equals(e.getCode())) {
    // request space access or fall back to the user's own space
  } else throw e;
}

Prevention

When it happens

Trigger: Calling a SkillFileService operation with a spaceId where the authenticated uid has no membership/role in that space (spaceUserService.getRole(spaceId, uid) == null), or the spaceUserService bean is missing (SkillFileService.java:513).

Common situations: Users sharing skill-file ids across teams/spaces and accessing them with their own account; revoked membership where the client still holds old space ids; misconfigured Spring context where the SpaceUserService dependency isn't wired in a test/manual bean setup.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/9d82b956bdacb1f8. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/skill/SkillFileService.java:513

        if (spaceId != null) {
            wrapper.eq(SkillFile::getSpaceId, spaceId);
        } else {
            if (StringUtils.isBlank(uid)) {
                throw new BusinessException(ResponseEnum.UNAUTHORIZED);
            }
            wrapper.isNull(SkillFile::getSpaceId).eq(SkillFile::getUid, uid);
        }
        return wrapper;
    }

    private void assertExplicitScope(String uid, Long spaceId) {
        if (StringUtils.isBlank(uid)) {
            throw new BusinessException(ResponseEnum.UNAUTHORIZED);
        }
        if (spaceId != null
                && (spaceUserService == null
                        || spaceUserService.getRole(spaceId, uid) == null)) {
            throw new BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS);
        }
    }

    private SkillFile getScopedEntry(Long id) {
        if (id == null) {
            throw new BusinessException(ResponseEnum.PARAM_ERROR);
        }
        SkillFile entry = getOne(scopeQuery().eq(SkillFile::getId, id), false);
        if (entry == null) {
            throw new BusinessException(ResponseEnum.PARAM_ERROR);
        }
        return entry;
    }

    private void assertParentFolder(Long parentId) {
        if (parentId == 0L) {
            return;
        }

View on GitHub (pinned to 5e758547a8)