What causes "PERMISSION_NOT_BELONG_SPACE" in iflytek/astron-agent?

Switch to a space the current user is a member of before debugging

PERMISSION_NOT_BELONG_SPACE

PERMISSION_NOT_BELONG_SPACE

Error message

PERMISSION_NOT_BELONG_SPACE

What it means

The botDebug SSE endpoint refuses requests when a space context is active but the user is not a member of that space (SpaceInfoUtil.checkUserBelongSpace() is false). It completes the emitter with the localized I18n message for ResponseEnum.PERMISSION_NOT_BELONG_SPACE. This is a tenancy/authorization guard preventing users from debugging bots in spaces they do not belong to.

Solutions

Switch to a space the current user is a member of before debugging
Re-check space membership (re-fetch user/space info) and refresh the space context in the client
If membership was just granted, re-login or refresh the token so membership is reflected
Verify the space-selection header/cookie matches the intended workspace

Example fix

// before
debugBot({ botId, workflows, ... }); // uses stale space header
// after
await refreshSpaceContext(); // re-sync current space from server
if (!currentSpace.isMember) { promptSpaceSwitch(); return; }
debugBot({ botId, workflows, ... });

Defensive patterns

Strategy: try-catch

Validate before calling

const spaces = await getUserSpaces();
if (!spaces.some(s => s.id === currentSpaceId)) { promptSpaceSwitch(); return; }

Type guard

function isMemberOfSpace(user, spaceId) { return user != null && Array.isArray(user.spaces) && user.spaces.some(s => s.id === spaceId); }

Try / catch

sse.onerror = () => { if (lastError === 'PERMISSION_NOT_BELONG_SPACE') promptSpaceSwitch(); };

Prevention

Re-sync active space after membership changes
Listen for space-switch events across tabs and update context
Never hardcode spaceIds in debug calls

When it happens

Trigger: Calling the botDebug endpoint with a spaceId resolved from the request context (SpaceInfoUtil.getSpaceId() != null) while the authenticated user is not a member of that space.

Common situations: User switched space in another tab leaving a stale space header/context; account removed from the space but the client kept the space selected; debugging a bot by hardcoding another team's spaceId; token/identity mismatch after membership revocation.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/0af6867777ebb59c. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/hub/src/main/java/com/iflytek/astron/console/hub/controller/chat/ChatMessageController.java:427

        debugChatReqDto.setDebugSessionId(debugRequest.getDebugSessionId());
        debugChatReqDto.setPrompt(debugRequest.getPrompt());
        debugChatReqDto.setMessages(messageList);
        debugChatReqDto.setUid(uid);
        debugChatReqDto.setOpenedTool(debugRequest.getOpenedTool());
        debugChatReqDto.setMcpServerUrls(debugRequest.getMcpServerUrls());
        debugChatReqDto.setSkills(debugRequest.getSkills());
        debugChatReqDto.setTools(debugRequest.getTools());
        debugChatReqDto.setWorkflows(debugRequest.getWorkflows());
        debugChatReqDto.setModel(debugRequest.getModel());
        debugChatReqDto.setModelId(debugRequest.getModelId());
        debugChatReqDto.setMaasDatasetList(maasDatasetList);
        debugChatReqDto.setPersonalityConfig(debugRequest.getPersonalityConfig());

        Long spaceId = SpaceInfoUtil.getSpaceId();
        if (spaceId != null && !SpaceInfoUtil.checkUserBelongSpace()) {
            log.warn("Reject bot debug request from non-member, uid: {}, spaceId: {}", uid, spaceId);
            SseEmitterUtil.completeWithError(sseEmitter,
                    I18nUtil.getMessage(ResponseEnum.PERMISSION_NOT_BELONG_SPACE.getMessageKey()));
            return sseEmitter;
        }
        debugChatReqDto.setSpaceId(spaceId);
        if (!agentWorkflowRuntimeService.checkWorkflowsAccessible(uid, spaceId, debugRequest.getWorkflows())) {
            SseEmitterUtil.completeWithError(sseEmitter, "Workflow not accessible");
            return sseEmitter;
        }

        try {
            sendStartSignal(sseEmitter, sseId,
                    new ChatContext(uid, 0L, debugRequest.getBotId() == null ? 0 : debugRequest.getBotId()));
            botChatService.debugChatMessageBot(debugChatReqDto, sseEmitter, sseId);
            return sseEmitter;
        } catch (Exception e) {
            log.error("Bot debug error, sseId: {}", sseId, e);
            SseEmitterUtil.completeWithError(sseEmitter, "Chat service exception: " + e.getMessage());
            return sseEmitter;
        }

View on GitHub (pinned to 5e758547a8)