What causes "{} = {} 的 {} 不允许 {} 用户的 {} 请求！" in Tencent/APIJSON?

Ensure the referenced id belongs to the current visitor's contact list (insert/refresh the contact/relation row) before issuing the request.

Tencent/APIJSON · error · IllegalAccessException

= 的不允许用户的请求！

Error message

{} = {} 的 {} 不允许 {} 用户的 {} 请求！

What it means

For the CONTACT role, verifyRole() gathers the list of userIds the visitor is allowed to touch (their contact list) and validates every id the request supplies as a where-condition on the visitor id key. A Number id that is <= 0, or whose Long value is not contained in the permitted list, throws IllegalAccessException. The message names the visitor id key, the offending id, the table, role and method.

Solutions

Ensure the referenced id belongs to the current visitor's contact list (insert/refresh the contact/relation row) before issuing the request.
Send the request with an appropriate role (e.g. OWNER with own id, or ADMIN if the caller is an admin) instead of CONTACT.
Remove the id condition and let APIJSON auto-complete it: when no key:id / key{}:[...] is declared, the code adds key{}: [permitted list] itself.
Guard on the client: fetch the permitted contact ids first and only send conditions built from that set.

Example fix

// before
{
  "User": { "id": 123, "role": "CONTACT" },
  "tag": "User"
}
// 123 not in visitor's contact list -> IllegalAccessException

// after: omit the condition, let the server scope it
{
  "User": { "role": "CONTACT" },
  "tag": "User"
}

Defensive patterns

Strategy: validation

Validate before calling

// before sending: fetch permitted contact ids and validate numeric conditions
List<Long> permitted = contactService.listContactIds(visitorId);
if (!permitted.contains(targetUserId) || targetUserId <= 0) {
    clientError("target id not in your contacts");
}

Type guard

boolean isValidContactId(Object id, List<Object> permitted) { return id instanceof Number && ((Number) id).longValue() > 0 && permitted.contains(Long.valueOf(String.valueOf(id))); }

Try / catch

catch (IllegalAccessException e) when message contains "不允许" -> 403; tell the user the record is outside their contact scope; do not auto-retry.

Prevention

Build id conditions only from server-returned contact lists, not user input.
Prefer omitting the condition and letting the server scope results automatically.

When it happens

Trigger: A request with "role":"CONTACT" carries e.g. "userId": 123 in the where clause, but the visitor's contact list (rows linking visitor to contacts) does not contain 123 — or the id is 0/negative; the Number branch of the id loop throws.

Common situations: Stale client caching a userId whose contact relationship was deleted; front-end lets users type arbitrary ids; test fixtures that assume a contact relationship which was never inserted; Integer ids compared as Long so the code normalizes via Long.valueOf("" + id) and the relationship table simply lacks that row.

Related errors

AI-assisted analysis of Tencent/APIJSON@5284052872 (2026-08-14). Data as JSON: /api/errors/eb00f083e27ecae8. Report an issue: GitHub.

Appendix: source

Thrown at APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java:395

			if (requestId != null) {
				if (requestIdArray == null) {
					requestIdArray = createJSONArray();
				}
				requestIdArray.add(requestId);
			}

			if (requestIdArray == null) { // 可能是 @ 得到 || requestIdArray.isEmpty()) { // 请求未声明 key:id 或 key{}:[...] 条件，自动补全
				config.putWhere(visitorIdKey+"{}", parseArray(list), true); // key{}:[] 有效，SQLConfig<T, M, L> 里 throw NotExistException
			}
			else { // 请求已声明 key:id 或 key{}:[] 条件，直接验证
				for (Object id : requestIdArray) {
					if (id == null) {
						continue;
					}

					if (id instanceof Number) { // 不能准确地判断 Long，可能是 Integer
						if (((Number) id).longValue() <= 0 || list.contains(Long.valueOf("" + id)) == false) { // Integer等转为 Long 才能正确判断，强转崩溃
							throw new IllegalAccessException(visitorIdKey + " = " + id + " 的 " + table
									+ " 不允许 " + role + " 用户的 " + method.name() + " 请求！");
						}
					}
					else if (id instanceof String) {
						if (StringUtil.isEmpty(id) || list.contains(id) == false) {
							throw new IllegalAccessException(visitorIdKey + " = " + id + " 的 " + table
									+ " 不允许 " + role + " 用户的 " + method.name() + " 请求！");
						}
					}
					else {
						throw new UnsupportedDataTypeException(table + ".id 类型错误，类型必须是 Long/String！");
					}
				}
			}
			break;
		case OWNER:
			if (config.getMethod() == POST) {
				List<String> c = config.getColumn();

View on GitHub (pinned to 5284052872)

= 的 不允许 用户的 请求！