iflytek/astron-agent · warning · BusinessException

UNAUTHORIZED

UNAUTHORIZED

Error message

UNAUTHORIZED

What it means

RequestContextUtil.getUID reads the authenticated user id from the current HttpServletRequest attribute set by JwtClaimsFilter. It throws BusinessException(UNAUTHORIZED) when there is no bound request or the USER_ID_ATTRIBUTE is missing/blank — i.e. the call is not backed by a valid, JWT-authenticated session.

Solutions

1. Ensure the call happens within an authenticated HTTP request (token present and validated by JwtClaimsFilter)
2. Check the endpoint is not bypassing the JWT filter (filter chain/interceptor registration)
3. For async/background code, capture and pass the uid explicitly instead of reading request context
4. In tests, seed RequestContextHolder with a MockHttpServletRequest carrying USER_ID_ATTRIBUTE

Example fix

// before
String uid = RequestContextUtil.getUID(); // throws UNAUTHORIZED in async task
// after
String uid = currentUserId != null ? currentUserId : RequestContextUtil.getUID(); // pass uid into async context explicitly

HttpServletRequest req = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()) != null ? ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest() : null;
boolean authed = req != null && StringUtils.isNotBlank((String) req.getAttribute(JwtClaimsFilter.USER_ID_ATTRIBUTE));

static boolean hasAuthenticatedUser() { ServletRequestAttributes a = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes(); return a != null && StringUtils.isNotBlank((String) a.getRequest().getAttribute(JwtClaimsFilter.USER_ID_ATTRIBUTE)); }

try { String uid = RequestContextUtil.getUID(); } catch (BusinessException e) { if (e.getCode() == ResponseEnum.UNAUTHORIZED) { return ResponseEntity.status(401).build(); } throw e; }

When it happens

Trigger: Calling getUID outside an HTTP request context (async task, scheduler, startup), or inside a request whose JWT was missing, invalid, or whose filter did not populate USER_ID_ATTRIBUTE (blank uid).

Common situations: Invoking console services from background threads/MessageListeners; calling an endpoint excluded from the JWT filter chain; expired or tampered token rejected upstream but handler still runs; tests calling the util without RequestContextHolder setup.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• UNAUTHORIZED
• response.data.message
• User UID cannot be null
• Timed out acquiring distributed lock, please try again later
• Current user does not exist

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/ae88e9deed1f3b18. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/commons/src/main/java/com/iflytek/astron/console/commons/util/RequestContextUtil.java:24

import com.iflytek.astron.console.commons.exception.BusinessException;
import org.apache.commons.lang3.StringUtils;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;

import jakarta.servlet.http.HttpServletRequest;

public final class RequestContextUtil {

    private RequestContextUtil() {}

    public static String getUID() {
        HttpServletRequest request = getCurrentRequest();
        if (request == null) {
            throw new BusinessException(ResponseEnum.UNAUTHORIZED);
        }
        String uid = (String) request.getAttribute(JwtClaimsFilter.USER_ID_ATTRIBUTE);
        if (StringUtils.isBlank(uid)) {
            throw new BusinessException(ResponseEnum.UNAUTHORIZED);
        }
        return uid;
    }

    public static UserInfo getUserInfo() {
        HttpServletRequest request = getCurrentRequest();
        if (request == null) {
            throw new BusinessException(ResponseEnum.UNAUTHORIZED);
        }
        Object userInfoObj = request.getAttribute(JwtClaimsFilter.USER_INFO_ATTRIBUTE);
        if (userInfoObj instanceof UserInfo userInfo) {
            return userInfo;
        } else {
            throw new BusinessException(ResponseEnum.UNAUTHORIZED);
        }
    }

    public static HttpServletRequest getCurrentRequest() {

View on GitHub (pinned to 5e758547a8)