YunaiV/ruoyi-vue-pro · error · NullPointerException

LoginUser(%d) Table(%s/%s) 未返回数据权限

Error message

LoginUser(%d) Table(%s/%s) 未返回数据权限

What it means

yudao's DeptDataPermissionRule builds a dept-scoped data-permission expression. For an ADMIN user it calls permissionApi.getDeptDataPermission(userId); if the API returns null (no rule matched, no dept assigned), the rule cannot compose any SQL condition and throws NullPointerException to fail loudly rather than silently granting/denying all rows. tableName and tableAlias are included for context.

Source

Thrown at yudao-framework/yudao-spring-boot-starter-biz-data-permission/src/main/java/cn/iocoder/yudao/framework/datapermission/core/rule/dept/DeptDataPermissionRule.java:109

    public Expression getExpression(String tableName, Alias tableAlias) {
        // 只有有登陆用户的情况下，才进行数据权限的处理
        LoginUser loginUser = SecurityFrameworkUtils.getLoginUser();
        if (loginUser == null) {
            return null;
        }
        // 只有管理员类型的用户，才进行数据权限的处理
        if (ObjectUtil.notEqual(loginUser.getUserType(), UserTypeEnum.ADMIN.getValue())) {
            return null;
        }

        // 获得数据权限
        DeptDataPermissionRespDTO deptDataPermission = loginUser.getContext(CONTEXT_KEY, DeptDataPermissionRespDTO.class);
        // 从上下文中拿不到，则调用逻辑进行获取
        if (deptDataPermission == null) {
            deptDataPermission = permissionApi.getDeptDataPermission(loginUser.getId());
            if (deptDataPermission == null) {
                log.error("[getExpression][LoginUser({}) 获取数据权限为 null]", JsonUtils.toJsonString(loginUser));
                throw new NullPointerException(String.format("LoginUser(%d) Table(%s/%s) 未返回数据权限",
                        loginUser.getId(), tableName, tableAlias.getName()));
            }
            // 添加到上下文中，避免重复计算
            loginUser.setContext(CONTEXT_KEY, deptDataPermission);
        }

        // 情况一，如果是 ALL 可查看全部，则无需拼接条件
        if (deptDataPermission.getAll()) {
            return null;
        }

        // 情况二，即不能查看部门，又不能查看自己，则说明 100% 无权限
        if (CollUtil.isEmpty(deptDataPermission.getDeptIds())
            && Boolean.FALSE.equals(deptDataPermission.getSelf())) {
            return new EqualsTo(null, null); // WHERE null = null，可以保证返回的数据为空
        }

        // 情况三，拼接 Dept 和 User 的条件，最后组合

View on GitHub (pinned to 0418084e22)

Solutions

1. Ensure the admin user is bound to a dept and that DeptDataPermission records exist for the target table.
2. If null is legitimately 'no data', fix permissionApi to return a default (empty/all=false) DeptDataPermissionRespDTO instead of null.
3. Disable the dept-data-permission rule for tables where it should not apply.

Example fix

// before
DeptDataPermissionRespDTO perm = permissionApi.getDeptDataPermission(userId);
if (perm == null) throw new NullPointerException(...);
// after: default to no-access instead of NPE
DeptDataPermissionRespDTO perm = permissionApi.getDeptDataPermission(userId);
if (perm == null) perm = new DeptDataPermissionRespDTO().setAll(false);

DeptDataPermissionRespDTO perm = permissionApi.getDeptDataPermission(loginUser.getId());
if (perm == null) perm = new DeptDataPermissionRespDTO().setAll(false).setDeptIds(Collections.emptySet());

static boolean hasDataPermission(DeptDataPermissionRespDTO p) { return p != null && (p.getAll() || p.getDeptIds()!=null || p.getSelf()); }

try { return rule.getExpression(tableName, tableAlias, root, mapper); }
catch (NullPointerException e) { return null; /* treat as no restriction / no access per policy */ }

When it happens

Trigger: An admin user has no dept binding and no 'all' permission configured for the table; the permission RPC returns null due to a backend bug or missing seed data; the dept-data-permission rule is enabled for a table the user has no permission record for.

Common situations: Fresh install without seeding dept/role-permission data; misconfigured data-permission rule referencing a table with no permission rows; permissionApi cache miss returning null.

Related errors

• 错误的用户类型
• AreaUtils 初始化失败
• IPUtils 初始化失败
• TenantContextHolder 不存在租户编号！可参考文档：{}
• 900

AI-assisted analysis of YunaiV/ruoyi-vue-pro@0418084e22 (2026-08-14). Data as JSON: /api/errors/5196da9245c716ef. Report an issue: GitHub.