Tencent/APIJSON · error · UnsupportedOperationException

AbstractVerifier.ENABLE_VERIFY_ROLE == false 时不支持校验角色权限！如需支持

Error message

AbstractVerifier.ENABLE_VERIFY_ROLE == false 时不支持校验角色权限！如需支持则设置 AbstractVerifier.ENABLE_VERIFY_ROLE = true ！

What it means

AbstractVerifier.verifyAccess() throws UnsupportedOperationException when role-permission verification is invoked while the static flag ENABLE_VERIFY_ROLE is false. The library guards the whole role-access path behind this feature switch so that projects that manage permissions themselves can disable the machinery. Any request whose SQLConfig reaches verifyAccess (i.e. Parser#needVerify is on) will fail immediately until the flag is enabled.

Source

Thrown at APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java:261

		//导致内部调用且放行校验(needVerifyLogin, needVerifyRole)也抛异常
		//		if (visitorId == null) {
		//			throw new NullPointerException(TAG + ".setVisitor visitorId == null !!! 可能导致权限校验失效，引发安全问题！");
		//		}

		return this;
	}


	/**验证权限是否通过
	 * @param config
	 * @return
	 * @throws Exception
	 */
	@Override
	public boolean verifyAccess(SQLConfig<T, M, L> config) throws Exception {
		if (ENABLE_VERIFY_ROLE == false) {
			throw new UnsupportedOperationException("AbstractVerifier.ENABLE_VERIFY_ROLE == false " +
                    "时不支持校验角色权限！如需支持则设置 AbstractVerifier.ENABLE_VERIFY_ROLE = true ！");
		}

		String table = config == null ? null : config.getTable();
		if (table == null) {
			return true;
		}

		String role = config.getRole();
		if (role == null) {
			role = UNKNOWN;
		}
		else {
			if (ROLE_MAP.containsKey(role) == false) {
				Set<String> NAMES = ROLE_MAP.keySet();
				throw new IllegalArgumentException("角色 " + role + " 不存在！" +
                        "只能是[" + StringUtil.get(NAMES.toArray()) + "]中的一种！");
			}

View on GitHub (pinned to 5284052872)

Solutions

Set AbstractVerifier.ENABLE_VERIFY_ROLE = true once at application startup (e.g. in the static initializer of your Verifier subclass or application entry point) before any request is parsed.
If you do not want APIJSON role checking, remove/stripe role keys ("role") from request table objects so verifyAccess is never asked to verify roles.
Ensure only one place flips the flag and that it runs before the first request (order of static initializers matters in multi-module projects).

Example fix

// before
public class MyVerifier extends AbstractVerifier<Long> {
    static {
        AbstractVerifier.ENABLE_VERIFY_CONTENT = true; // role flag forgotten
    }
}

// after
public class MyVerifier extends AbstractVerifier<Long> {
    static {
        AbstractVerifier.ENABLE_VERIFY_ROLE = true;      // enable role checks
        AbstractVerifier.ENABLE_VERIFY_CONTENT = true;
    }
}

Defensive patterns

Strategy: validation

Validate before calling

// before handling any request, assert the feature switches your requests rely on
if (!AbstractVerifier.ENABLE_VERIFY_ROLE && requestUsesRoleKeys(requestJson)) {
    throw new IllegalStateException("Role keys present but ENABLE_VERIFY_ROLE is false; enable the flag at startup.");
}

Try / catch

catch (UnsupportedOperationException e) { log.error("Verifier feature flag disabled: {}", e.getMessage()); return 501 with e.getMessage(); }

Prevention

Enable ENABLE_VERIFY_ROLE/ENABLE_VERIFY_CONTENT in one static initializer and unit-test that it is true after class load.
Fail fast at startup: assert required flags in an @PostConstruct before serving traffic.

When it happens

Trigger: A request is executed with a role set (e.g. "role":"OWNER" or any role key) on a table object while AbstractVerifier.ENABLE_VERIFY_ROLE is left at its default false; verifyAccess(config) is entered and the first guard throws before the table/role are even inspected.

Common situations: New APIJSON integration where the demo/application subclass forgot to call AbstractVerifier.ENABLE_VERIFY_ROLE = true in static init; upgrading APIJSON where the flag defaulted to false and custom verifier setup code was dropped; copying framework unit tests that rely on role checks into a project without the flag.

Related errors

AI-assisted analysis of Tencent/APIJSON@5284052872 (2026-08-14). Data as JSON: /api/errors/e54f66d0885bc916. Report an issue: GitHub.