Tencent/APIJSON · error · UnsupportedOperationException

不支持 ADMIN 角色！如果要支持就在子类重写这个方法来校验 ADMIN 角色，不通过则 throw IllegalA

Error message

不支持 ADMIN 角色！如果要支持就在子类重写这个方法来校验 ADMIN 角色，不通过则 throw IllegalAccessException!

What it means

AbstractVerifier.verifyAdmin() unconditionally throws UnsupportedOperationException — the base ORM does not know how to identify an admin. When a request's role is ADMIN, verifyRole()'s ADMIN case calls verifyAdmin(), so supporting the ADMIN role requires a subclass to override this method and throw IllegalAccessException on failure (or call super() to deny).

Source

Thrown at APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java:494

		if (visitorId instanceof Number) {
			if (((Number) visitorId).longValue() <= 0) {
				throw new NotLoggedInException("未登录或登录过期，请登录后再操作！");
			}
		}
		else if (visitorId instanceof String) {
			if (StringUtil.isEmpty(visitorId, true)) {
				throw new NotLoggedInException("未登录或登录过期，请登录后再操作！");
			}
		}
		else {
			throw new UnsupportedDataTypeException("visitorId 只能是 Long 或 String 类型！");
		}

	}

	@Override
	public void verifyAdmin() throws Exception {
		throw new UnsupportedOperationException("不支持 ADMIN 角色！如果要支持就在子类重写这个方法" +
                "来校验 ADMIN 角色，不通过则 throw IllegalAccessException!");
	}


	/**验证是否重复
	 * FIXME 这个方法实际上没有被使用
	 * @param table
	 * @param key
	 * @param value
	 * @throws Exception
	 */
	@Override
	public void verifyRepeat(String table, String key, Object value) throws Exception {
		verifyRepeat(table, key, value, 0);
	}
	/**验证是否重复
	 * FIXME 这个方法实际上没有被使用，而且与 Structure.verifyRepeat 代码重复度比较高，需要简化
	 * @param table

View on GitHub (pinned to 5284052872)

Solutions

Override verifyAdmin() in your Verifier subclass: check the visitor against your admin list/permission service, and throw IllegalAccessException when not an admin.
Until implemented, do not send role ADMIN from clients — use roles your verifier actually supports.
Optionally gate admin endpoints behind a fixed secret key in a dedicated controller, as the code comment suggests (e.g. /get/admin + secret, Parser#needVerify).

Example fix

// before
public class MyVerifier extends AbstractVerifier<Long> { } // no override

// after
@Override
public void verifyAdmin() throws Exception {
    if (visitorId == null || ADMIN_IDS.contains(((Number) visitorId).longValue()) == false) {
        throw new IllegalAccessException("非管理员，禁止操作！");
    }
}

Defensive patterns

Strategy: fallback

Validate before calling

// guard before issuing admin requests: does this deployment support ADMIN at all?
if (verifier.getClass().getMethod("verifyAdmin").getDeclaringClass() == AbstractVerifier.class) {
    clientError("ADMIN role not supported by this deployment");
}

Type guard

boolean adminSupported(Verifier v) { return !(v instanceof AbstractVerifier) || overridesVerifyAdmin(v.getClass()); }

Try / catch

catch (UnsupportedOperationException e) { 501 Not Implemented for role ADMIN; message should tell ops to override verifyAdmin() in the Verifier subclass.

Prevention

Override verifyAdmin() in every verifier subclass from day one, even if it always denies.
Smoke-test each role your clients use against the deployed verifier in CI.

When it happens

Trigger: A request sends "role":"ADMIN" against a deployment whose Verifier class did not override verifyAdmin(); the ADMIN switch case in verifyRole reaches the default implementation and it throws.

Common situations: New project reused AbstractVerifier (or a demo verifier) without admin logic; admin check was removed during refactor; version upgrade replaced the verifier configuration with the base class.

Related errors

AI-assisted analysis of Tencent/APIJSON@5284052872 (2026-08-14). Data as JSON: /api/errors/e14990eeb5cce548. Report an issue: GitHub.