Tencent/WeKnora · error

cannot revoke the last remaining system administrator

Error message

cannot revoke the last remaining system administrator

What it means

Sentinel ErrLastSystemAdmin returned inside the revoke transaction when, after the change, the system-admin count would drop to 1 or below — the platform must keep at least one system administrator. The transaction aborts and the handler maps it to 400.

Source

Thrown at internal/application/repository/user.go:18

package repository

import (
	"context"
	"errors"

	"github.com/Tencent/WeKnora/internal/types"
	"github.com/Tencent/WeKnora/internal/types/interfaces"
	"gorm.io/gorm"
	"gorm.io/gorm/clause"
)

var (
	ErrUserNotFound       = errors.New("user not found")
	ErrUserAlreadyExists  = errors.New("user already exists")
	ErrTokenNotFound      = errors.New("token not found")
	ErrCannotRevokeSelf   = errors.New("cannot revoke your own system admin privileges")
	ErrLastSystemAdmin    = errors.New("cannot revoke the last remaining system administrator")
	ErrUserNotSystemAdmin = errors.New("user is not a system administrator")
)

// userRepository implements user repository interface
type userRepository struct {
	db *gorm.DB
}

// NewUserRepository creates a new user repository
func NewUserRepository(db *gorm.DB) interfaces.UserRepository {
	return &userRepository{db: db}
}

// CreateUser creates a user
func (r *userRepository) CreateUser(ctx context.Context, user *types.User) error {
	// users.tenant_id is nullable in both PostgreSQL and SQLite. GORM would
	// otherwise serialise the uint64 zero value as 0, which violates the
	// PostgreSQL FK and loses the distinction between "not provisioned yet"

View on GitHub (pinned to 988cbb0330)

Solutions

1. Promote another user to system admin first, then retry the revocation
2. Keep at least one system admin; refuse the operation otherwise

When it happens

Trigger: Thrown at internal/application/repository/user.go:18 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/35b330ca52dfcfaf. Report an issue: GitHub.