{"record":{"id":"3de5601b586d2d53","repo":"elunez/eladmin","slug":"username","errorCode":null,"errorMessage":"角色权限不足，不能删除：{username}","messagePattern":"角色权限不足，不能删除：(.+?)","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java","lineNumber":148,"sourceCode":"    @PutMapping(value = \"center\")\n    public ResponseEntity<Object> centerUser(@Validated(User.Update.class) @RequestBody User resources){\n        if(!resources.getId().equals(SecurityUtils.getCurrentUserId())){\n            throw new BadRequestException(\"不能修改他人资料\");\n        }\n        userService.updateCenter(resources);\n        return new ResponseEntity<>(HttpStatus.NO_CONTENT);\n    }\n\n    @Log(\"删除用户\")\n    @ApiOperation(\"删除用户\")\n    @DeleteMapping\n    @PreAuthorize(\"@el.check('user:del')\")\n    public ResponseEntity<Object> deleteUser(@RequestBody Set<Long> ids){\n        for (Long id : ids) {\n            Integer currentLevel =  Collections.min(roleService.findByUsersId(SecurityUtils.getCurrentUserId()).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));\n            Integer optLevel =  Collections.min(roleService.findByUsersId(id).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));\n            if (currentLevel > optLevel) {\n                throw new BadRequestException(\"角色权限不足，不能删除：\" + userService.findById(id).getUsername());\n            }\n        }\n        userService.delete(ids);\n        return new ResponseEntity<>(HttpStatus.OK);\n    }\n\n    @ApiOperation(\"修改密码\")\n    @PostMapping(value = \"/updatePass\")\n    public ResponseEntity<Object> updateUserPass(@RequestBody UserPassVo passVo) throws Exception {\n        String oldPass = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,passVo.getOldPass());\n        String newPass = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,passVo.getNewPass());\n        UserDto user = userService.findByName(SecurityUtils.getCurrentUsername());\n        if(!passwordEncoder.matches(oldPass, user.getPassword())){\n            throw new BadRequestException(\"修改失败，旧密码错误\");\n        }\n        if(passwordEncoder.matches(newPass, user.getPassword())){\n            throw new BadRequestException(\"新密码不能与旧密码相同\");\n        }","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/elunez/eladmin/blob/55fbf705956949697dbd68bf9003776609d3d029/eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java#L130-L166","documentation":"Thrown by UserController.deleteUser (line 148) on DELETE /api/users when, for any id in the set, the current user's minimum role level is numerically greater (less privileged) than the target's minimum level. eladmin level semantics: lower number = higher privilege; you may only delete users whose best level is weaker than or equal to yours.","triggerScenarios":"A level-3 admin deleting a user who has a level-1/level-2 role; batch delete where one id in the set belongs to a super-admin; trying to delete the built-in admin account from a lower-privileged operator.","commonSituations":"Delegated admins hitting the ceiling of their role level; mass-delete of expired accounts that includes a system/ops account with a high-privilege role; confusion from the inverted numeric scale (currentLevel > optLevel means YOU are weaker).","solutions":["Split the batch: delete only users whose minimum level >= your own minimum level; escalate the rest to a higher-privilege admin.","Downgrade the target user's roles first (if business-appropriate), then delete.","Have a level-1 admin perform the full batch delete."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Filter batch to deletable ids before calling DELETE /api/users\nconst myMin = Math.min(...store.state.user.roles.map(r => r.level));\nconst deletable = [];\nfor (const u of selectedUsers) {\n  const targetMin = Math.min(...u.roles.map(r => r.level));\n  if (myMin <= targetMin) deletable.push(u.id);\n}\nif (deletable.length) await axios.delete('/api/users', { data: deletable });","typeGuard":"const canDeleteUser = (myMin, targetMin) => myMin <= targetMin;","tryCatchPattern":"Per-user errors abort the whole batch server-side; catch the 400, show which username blocked it, and retry with the filtered set.","preventionTips":["Pre-check levels in the user list UI and disable delete for out-ranked rows.","Batch calls are all-or-nothing here — filter client-side first."],"tags":["authorization","rbac","eladmin","user","delete","level"],"backgroundTag":null,"analyzedSha":"55fbf705956949697dbd68bf9003776609d3d029","analyzedAt":"2026-08-14T11:56:12.758Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}