{"record":{"id":"0821160f275a6de4","repo":"jeecgboot/JeecgBoot","slug":"error-082116","errorCode":null,"errorMessage":"您不是当前组织的管理员，无法删除用户！","messagePattern":"您不是当前组织的管理员，无法删除用户！","errorType":"exception","errorClass":"JeecgBootException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantServiceImpl.java","lineNumber":903,"sourceCode":"        sysTenantPackUserMapper.deletePackUserByTenantIds(tenantIdList);\n        //2.删除产品包对应的菜单权限\n        sysPackPermissionMapper.deletePackPermByTenantIds(tenantIdList);\n        //3.删除产品包\n        sysTenantPackMapper.deletePackByTenantIds(tenantIdList);\n    }\n\n    @Override\n    public void deleteUserByPassword(SysUser sysUser, Integer tenantId) {\n        //被删除人的用户id\n        String userId = sysUser.getId();\n        //被删除人的密码\n        String password = sysUser.getPassword();\n        //当前登录用户\n        LoginUser user = (LoginUser) SecurityUtils.getSubject().getPrincipal();\n        //step1 判断当前用户是否为当前租户的管理员(只有超级管理员和账号管理员可以删除)\n        Long isHaveAdmin = sysTenantPackUserMapper.izHaveBuyAuth(user.getId(), tenantId);\n        if(null == isHaveAdmin || 0 == isHaveAdmin){\n            throw new JeecgBootException(\"您不是当前组织的管理员，无法删除用户！\");\n        }\n        //step2 离职状态下，并且无其他组织情况下，可以删除\n        SysUserTenant sysUserTenant = userTenantMapper.getUserTenantByTenantId(userId, tenantId);\n        if(null == sysUserTenant || !CommonConstant.USER_TENANT_QUIT.equals(sysUserTenant.getStatus())){\n            throw new JeecgBootException(\"用户没有离职，不允许删除！\"); \n        }\n        List<Integer> tenantIdsByUserId = userTenantMapper.getTenantIdsByUserId(userId);\n        if(CollectionUtils.isNotEmpty(tenantIdsByUserId) && tenantIdsByUserId.size()>0){\n            throw new JeecgBootException(\"用户尚有未退出的组织，无法删除！\");\n        }\n        //step3 当天创建的用户和创建人可以删除\n        SysUser sysUserData = userService.getById(userId);\n        if(!sysUserData.getCreateBy().equals(user.getUsername())){\n            throw new JeecgBootException(\"您不是该用户的创建人，无法删除！\");\n        }\n        \n        // 代码逻辑说明: 【QQYUN-11839】删除用户，需要输入被删除用户的密码，这逻辑对吗？不应该是管理员的密码吗---\n        this.verifyCreateTimeAndPassword(sysUserData,password);","sourceCodeStart":885,"sourceCodeEnd":921,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantServiceImpl.java#L885-L921","documentation":"deleteUserByPassword throws (step1) when sysTenantPackUserMapper.izHaveBuyAuth(currentUserId, tenantId) returns null or 0 — the operator is neither super-admin nor account-admin for the tenant, so they lack authority to delete a user from it. This is the first guard in the delete-user flow.","triggerScenarios":"Calling deleteUserByPassword while authenticated as a user without admin rights in the target tenant. The check runs server-side regardless of UI button visibility.","commonSituations":"A non-admin invokes the delete API directly; admin rights were revoked but the token is still valid; operating on the wrong tenantId; the operator is admin in one tenant but tries to delete a user from another.","solutions":["Ensure the operator holds superAdmin or accountAdmin role in the target tenant (check tenant pack user assignments).","Verify the tenantId in the request matches a tenant the operator administers.","Re-login / refresh token after role changes.","Frontend should hide the delete action for non-admins and surface a clear permission message."],"exampleFix":"// before\ntenantService.deleteUserByPassword(targetUser, tenantId);\n\n// after\nLong auth = sysTenantPackUserMapper.izHaveBuyAuth currentUser().getId(), tenantId);\nif (auth == null || auth == 0) {\n    return Result.error(\"无权限：需要组织管理员身份\");\n}\ntenantService.deleteUserByPassword(targetUser, tenantId);","handlingStrategy":"validation","validationCode":"Long auth = sysTenantPackUserMapper.izHaveBuyAuth(currentUser().getId(), tenantId);\nif (auth == null || auth == 0) {\n    return Result.error(\"需要组织管理员权限\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    tenantService.deleteUserByPassword(targetUser, tenantId);\n} catch (JeecgBootException e) {\n    if (e.getMessage().contains(\"管理员\")) {\n        return Result.error(\"无删除权限：仅组织管理员可操作\");\n    }\n    throw e;\n}","preventionTips":["Gate the delete UI by the user's admin role in the tenant.","Refresh tokens after role changes.","Confirm the tenantId matches a tenant the operator administers."],"tags":["authorization","tenant","user-deletion","rbac","jeecg-boot"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}