Tencent/APIJSON · error · IllegalAccessException

{} = {} 的 {} 不允许 {} 用户的 {} 请求！

Error message

{} = {} 的 {} 不允许 {} 用户的 {} 请求！

What it means

For the CONTACT role, verifyRole() gathers the list of userIds the visitor is allowed to touch (their contact list) and validates every id the request supplies as a where-condition on the visitor id key. A Number id that is <= 0, or whose Long value is not contained in the permitted list, throws IllegalAccessException. The message names the visitor id key, the offending id, the table, role and method.

Source

Thrown at APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java:395

			if (requestId != null) {
				if (requestIdArray == null) {
					requestIdArray = createJSONArray();
				}
				requestIdArray.add(requestId);
			}

			if (requestIdArray == null) { // 可能是 @ 得到 || requestIdArray.isEmpty()) { // 请求未声明 key:id 或 key{}:[...] 条件，自动补全
				config.putWhere(visitorIdKey+"{}", parseArray(list), true); // key{}:[] 有效，SQLConfig<T, M, L> 里 throw NotExistException
			}
			else { // 请求已声明 key:id 或 key{}:[] 条件，直接验证
				for (Object id : requestIdArray) {
					if (id == null) {
						continue;
					}

					if (id instanceof Number) { // 不能准确地判断 Long，可能是 Integer
						if (((Number) id).longValue() <= 0 || list.contains(Long.valueOf("" + id)) == false) { // Integer等转为 Long 才能正确判断，强转崩溃
							throw new IllegalAccessException(visitorIdKey + " = " + id + " 的 " + table
									+ " 不允许 " + role + " 用户的 " + method.name() + " 请求！");
						}
					}
					else if (id instanceof String) {
						if (StringUtil.isEmpty(id) || list.contains(id) == false) {
							throw new IllegalAccessException(visitorIdKey + " = " + id + " 的 " + table
									+ " 不允许 " + role + " 用户的 " + method.name() + " 请求！");
						}
					}
					else {
						throw new UnsupportedDataTypeException(table + ".id 类型错误，类型必须是 Long/String！");
					}
				}
			}
			break;
		case OWNER:
			if (config.getMethod() == POST) {
				List<String> c = config.getColumn();

View on GitHub (pinned to 5284052872)

Solutions

1. Ensure the referenced id belongs to the current visitor's contact list (insert/refresh the contact/relation row) before issuing the request.
2. Send the request with an appropriate role (e.g. OWNER with own id, or ADMIN if the caller is an admin) instead of CONTACT.
3. Remove the id condition and let APIJSON auto-complete it: when no key:id / key{}:[...] is declared, the code adds key{}: [permitted list] itself.
4. Guard on the client: fetch the permitted contact ids first and only send conditions built from that set.

Example fix

// before
{
  "User": { "id": 123, "role": "CONTACT" },
  "tag": "User"
}
// 123 not in visitor's contact list -> IllegalAccessException

// after: omit the condition, let the server scope it
{
  "User": { "role": "CONTACT" },
  "tag": "User"
}

// before sending: fetch permitted contact ids and validate numeric conditions
List<Long> permitted = contactService.listContactIds(visitorId);
if (!permitted.contains(targetUserId) || targetUserId <= 0) {
    clientError("target id not in your contacts");
}

boolean isValidContactId(Object id, List<Object> permitted) { return id instanceof Number && ((Number) id).longValue() > 0 && permitted.contains(Long.valueOf(String.valueOf(id))); }

catch (IllegalAccessException e) when message contains "不允许" -> 403; tell the user the record is outside their contact scope; do not auto-retry.

When it happens

Trigger: A request with "role":"CONTACT" carries e.g. "userId": 123 in the where clause, but the visitor's contact list (rows linking visitor to contacts) does not contain 123 — or the id is 0/negative; the Number branch of the id loop throws.

Common situations: Stale client caching a userId whose contact relationship was deleted; front-end lets users type arbitrary ids; test fixtures that assume a contact relationship which was never inserted; Integer ids compared as Long so the code normalizes via Long.valueOf("" + id) and the relationship table simply lacks that row.

Related errors

• AbstractVerifier.ENABLE_VERIFY_ROLE == false 时不支持校验角色权限！如需支持
• {} 不允许 {} 用户的 {} 请求！
• 不支持 ADMIN 角色！如果要支持就在子类重写这个方法来校验 ADMIN 角色，不通过则 throw IllegalA
• Value for key '" + key + "' is not a Map: " + value.getClass
• Value for key '" + key + "' is not a List: " + value.getClas

AI-assisted analysis of Tencent/APIJSON@5284052872 (2026-08-14). Data as JSON: /api/errors/eb00f083e27ecae8. Report an issue: GitHub.