{"record":{"id":"17762af662f3f031","repo":"jeecgboot/JeecgBoot","slug":"error-17762a","errorCode":null,"errorMessage":"您不是当前组织的创建者，无法删除用户！","messagePattern":"您不是当前组织的创建者，无法删除用户！","errorType":"exception","errorClass":"JeecgBootException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantServiceImpl.java","lineNumber":972,"sourceCode":"    }\n\n    @Override\n    public List<SysTenant> getTenantListByUserId(String userId) {\n        return tenantMapper.getTenantListByUserId(userId);\n    }\n\n    @Override\n    public void deleteUser(SysUser sysUser, Integer tenantId) {\n        //被删除人的用户id\n        String userId = sysUser.getId();\n        //被删除人的密码\n        String password = sysUser.getPassword();\n        //当前登录用户\n        LoginUser user = (LoginUser) SecurityUtils.getSubject().getPrincipal();\n        //step1 判断当前用户是否为当前租户的创建者才可以删除\n        SysTenant sysTenant = this.getById(tenantId);\n        if(null == sysTenant || !user.getUsername().equals(sysTenant.getCreateBy())){\n            throw new JeecgBootException(\"您不是当前组织的创建者，无法删除用户！\");\n        }\n        //step2 判断除了当前组织之外是否还有加入了其他组织\n        LambdaQueryWrapper<SysUserTenant> query = new LambdaQueryWrapper<>();\n        query.eq(SysUserTenant::getUserId,userId);\n        query.ne(SysUserTenant::getTenantId,tenantId);\n        List<SysUserTenant> sysUserTenants = userTenantMapper.selectList(query);\n        if(CollectionUtils.isNotEmpty(sysUserTenants)){\n            throw new JeecgBootException(\"该用户还存在于其它组织中，无法删除用户！\");\n        }\n        //step3 验证创建时间和密码\n        SysUser sysUserData = userService.getById(userId);\n        this.verifyCreateTimeAndPassword(sysUserData,password);\n        //step4 真实删除用户\n        userService.deleteUser(userId);\n        userService.removeLogicDeleted(Collections.singletonList(userId));\n    }\n\n    /**","sourceCodeStart":954,"sourceCodeEnd":990,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantServiceImpl.java#L954-L990","documentation":"Thrown by SysTenantServiceImpl.deleteUser at step1. Before any deletion it loads the SysTenant row by tenantId and requires that the current logged-in user's username exactly equals sysTenant.createBy. If the tenant does not exist or the current user is not its recorded creator, deletion is refused.","triggerScenarios":"POST to the delete-tenant-user endpoint with a tenantId for which the current user is not the creator, or a tenantId that does not exist (returns null, also trips the guard).","commonSituations":"A tenant admin (non-creator) tries to remove a member; the tenant was created by a user whose username was since renamed; tenantId from the request is wrong/zero; multi-tenant context switched so SecurityUtils principal no longer matches createBy.","solutions":["Verify the current login user's username equals sys_tenant.create_by for the given tenantId before calling deleteUser.","Ensure the request sends the correct tenantId (the organization the user is actually being removed from).","If the creator was renamed, update sys_tenant.create_by to the current creator username, or perform deletion as that original creator.","Confirm the tenant row exists - a null sysTenant also triggers this message."],"exampleFix":"// guard before calling deleteUser\nSysTenant t = sysTenantService.getById(tenantId);\nif (t == null || !currentUser.getUsername().equals(t.getCreateBy())) {\n    return Result.error(\"无权操作：仅组织创建者可删除用户\");\n}\nsysTenantService.deleteUser(sysUser, tenantId);","handlingStrategy":"validation","validationCode":"LoginUser me = (LoginUser) SecurityUtils.getSubject().getPrincipal();\nSysTenant t = sysTenantService.getById(tenantId);\nif (t == null || !me.getUsername().equals(t.getCreateBy())) {\n    return Result.error(\"仅组织创建者可执行此操作\");\n}","typeGuard":"boolean isCreator(SysTenant t, LoginUser u) {\n  return t != null && u != null && u.getUsername() != null && u.getUsername().equals(t.getCreateBy());\n}","tryCatchPattern":"try { sysTenantService.deleteUser(sysUser, tenantId); }\ncatch (JeecgBootException e) {\n  if (e.getMessage().contains(\"创建者\")) return Result.error(\"无权操作\");\n  throw e;\n}","preventionTips":["Check createBy equality before calling delete.","Surface creator info in the UI so non-creators see the action disabled.","Keep sys_tenant.create_by in sync if creators are renamed."],"tags":["authorization","tenant","user-management","permission"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}