iflytek/astron-agent · error · BusinessException

INSUFFICIENT_PERMISSIONS

INSUFFICIENT_PERMISSIONS

Error message

INSUFFICIENT_PERMISSIONS

What it means

applyCurrentArtifactScope throws INSUFFICIENT_PERMISSIONS when the current user has no role (spaceUserService.getRole returns null) in the active space obtained from SpaceInfoUtil.getSpaceId(). The scoping layer refuses to even scope the query, so users who are not members of the space cannot see or touch its workflow artifacts. If no space is active, the fallback scopes by uid instead and no role check applies.

Solutions

1. Ask a space admin to add the user to the space (or grant the required role) via space management
2. Switch the console to a space the user actually belongs to and retry
3. Verify membership via the space user/role API before calling artifact endpoints
4. If membership exists but getRole still returns null, check space/role service data consistency and cache staleness

Example fix

// before: user not in space 42 -> INSUFFICIENT_PERMISSIONS
SpaceContext.setSpaceId(42);
artifactService.listArtifacts(workflowId);
// after: switch to a space the user belongs to
Long mySpace = spaceUserService.findSpacesFor(uid).get(0);
SpaceContext.setSpaceId(mySpace);
artifactService.listArtifacts(workflowId);

// Check space membership before artifact calls
String role = spaceApi.getRole(spaceId, currentUid);
if (role == null)
    throw new PermissionDeniedException("User " + currentUid + " has no role in space " + spaceId);

boolean canAccessSpace(String uid, Long spaceId) {
    return spaceId != null && spaceApi.getRole(spaceId, uid) != null;
}

try {
    artifactApi.listArtifacts(workflowId);
} catch (BusinessException e) {
    if ("INSUFFICIENT_PERMISSIONS".equals(e.getCode())) {
        throw new SpaceMembershipRequiredException(spaceId, e);
    }
    throw e;
}

When it happens

Trigger: Calling artifact list/get/delete APIs while the active spaceId belongs to a space the user was never added to; user removed from the space after the UI was loaded; switching space context without re-fetching permissions.

Common situations: Sharing artifact links across teams without adding the recipient to the space; revoked membership but cached frontend state; switching spaces in the console while an old request is in flight.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• INSUFFICIENT_PERMISSIONS
• BOT_NOT_EXISTS
• EXCEED_AUTHORITY
• EXCEED_AUTHORITY
• INSUFFICIENT_PERMISSIONS

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/c0f51adb308c2895. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowArtifactService.java:394

    }

    private LambdaQueryWrapper<WorkflowArtifact> scopeQuery(Long workflowId) {
        LambdaQueryWrapper<WorkflowArtifact> wrapper = Wrappers.lambdaQuery(WorkflowArtifact.class)
                .eq(WorkflowArtifact::getWorkflowId, workflowId)
                .eq(WorkflowArtifact::getDeleted, Boolean.FALSE);
        applyCurrentArtifactScope(wrapper);
        return wrapper;
    }

    private void applyCurrentArtifactScope(LambdaQueryWrapper<WorkflowArtifact> wrapper) {
        String currentUid = UserInfoManagerHandler.getUserId();
        Long spaceId = SpaceInfoUtil.getSpaceId();
        if (StringUtils.isBlank(currentUid)) {
            throw new BusinessException(ResponseEnum.UNAUTHORIZED);
        }
        if (spaceId != null) {
            if (spaceUserService.getRole(spaceId, currentUid) == null) {
                throw new BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS);
            }
            wrapper.eq(WorkflowArtifact::getSpaceId, spaceId);
        } else {
            wrapper.isNull(WorkflowArtifact::getSpaceId)
                    .eq(WorkflowArtifact::getUid, currentUid);
        }
    }

    private void assertWorkflowVisible(Long workflowId) {
        Workflow workflow = workflowMapper.selectOne(Wrappers.lambdaQuery(Workflow.class)
                .eq(Workflow::getId, workflowId)
                .eq(Workflow::getDeleted, Boolean.FALSE)
                .last("limit 1"));
        if (workflow == null) {
            throw new BusinessException(ResponseEnum.WORKFLOW_NOT_EXIST);
        }
        dataPermissionCheckTool.checkWorkflowVisible(workflow, SpaceInfoUtil.getSpaceId());
    }

View on GitHub (pinned to 5e758547a8)