iflytek/astron-agent · error · BusinessException

INSUFFICIENT_PERMISSIONS

INSUFFICIENT_PERMISSIONS

Error message

INSUFFICIENT_PERMISSIONS

What it means

INSUFFICIENT_PERMISSIONS in submitIfRequired is thrown when the requester's space role resolves to null, i.e. the user is not a member of the effective space. Without a role the service cannot authorize the publish submission and fails closed.

Solutions

  1. Add the user to the space with an appropriate role.
  2. Verify the correct effectiveSpaceId is resolved and sent.
  3. Ensure the requester uid matches the authenticated user.
  4. Re-submit once membership is granted.
Defensive patterns

Strategy: validation

Validate before calling

SpaceRoleEnum role = spaceUserService.getRole(effectiveSpaceId, requesterUid);
if (role == null) {
    // requester not a member of this space; join space or fix spaceId
    return;
}
publishApprovalService.submitIfRequired(submitDto);

Try / catch

try {
    publishApprovalService.submitIfRequired(submitDto);
} catch (BusinessException e) {
    if ("INSUFFICIENT_PERMISSIONS".equals(String.valueOf(e.getCode()))) {
        // verify space membership, show access error
    }
}

Prevention

When it happens

Trigger: Submitting a publish approval where spaceUserService.getRole(effectiveSpaceId, requesterUid) returns null (non-member of that space).

Common situations: User removed from the space before submitting; request carries a spaceId the user was never added to; UI sends the wrong spaceId after a space switch.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/aa7f5847e6b75592. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/publish/impl/PublishApprovalServiceImpl.java:73

    private final SpaceService spaceService;
    private final SpaceUserService spaceUserService;
    private final ChatBotBaseMapper chatBotBaseMapper;
    private final WorkflowMapper workflowMapper;
    private final AppMstService appMstService;
    private final List<PublishApprovalExecutor> publishApprovalExecutors;

    @Override
    public PublishApprovalDecisionDto submitIfRequired(PublishApprovalSubmitDto submitDto) {
        Long effectiveSpaceId = resolveEffectiveSpaceId(submitDto);
        submitDto.setSpaceId(effectiveSpaceId);
        normalizePublishSnapshotSpaceId(submitDto);
        if (effectiveSpaceId == null) {
            return directDecision();
        }

        SpaceRoleEnum currentRole = spaceUserService.getRole(effectiveSpaceId, submitDto.getRequesterUid());
        if (currentRole == null) {
            throw new BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS);
        }
        if (isOwnerOrAdmin(currentRole)) {
            return directDecision();
        }

        if (PublishApprovalActionEnum.OFFLINE == submitDto.getPublishAction()) {
            throw new BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS);
        }

        if (!isApprovalEnabledPublishType(submitDto.getPublishType())) {
            return directDecision();
        }

        SpaceTypeEnum spaceType = resolveSpaceType(effectiveSpaceId);
        validateApprovalTarget(submitDto);
        PublishApproval approval = buildApproval(submitDto, spaceType);
        PublishApproval existing = findActiveApproval(approval);
        if (existing != null) {

View on GitHub (pinned to 5e758547a8)