{"record":{"id":"4563169e93cb6464","repo":"jeecgboot/JeecgBoot","slug":"error-456316","errorCode":null,"errorMessage":"您不是该用户的创建人，无法删除！","messagePattern":"您不是该用户的创建人，无法删除！","errorType":"exception","errorClass":"JeecgBootException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantServiceImpl.java","lineNumber":917,"sourceCode":"        LoginUser user = (LoginUser) SecurityUtils.getSubject().getPrincipal();\n        //step1 判断当前用户是否为当前租户的管理员(只有超级管理员和账号管理员可以删除)\n        Long isHaveAdmin = sysTenantPackUserMapper.izHaveBuyAuth(user.getId(), tenantId);\n        if(null == isHaveAdmin || 0 == isHaveAdmin){\n            throw new JeecgBootException(\"您不是当前组织的管理员，无法删除用户！\");\n        }\n        //step2 离职状态下，并且无其他组织情况下，可以删除\n        SysUserTenant sysUserTenant = userTenantMapper.getUserTenantByTenantId(userId, tenantId);\n        if(null == sysUserTenant || !CommonConstant.USER_TENANT_QUIT.equals(sysUserTenant.getStatus())){\n            throw new JeecgBootException(\"用户没有离职，不允许删除！\"); \n        }\n        List<Integer> tenantIdsByUserId = userTenantMapper.getTenantIdsByUserId(userId);\n        if(CollectionUtils.isNotEmpty(tenantIdsByUserId) && tenantIdsByUserId.size()>0){\n            throw new JeecgBootException(\"用户尚有未退出的组织，无法删除！\");\n        }\n        //step3 当天创建的用户和创建人可以删除\n        SysUser sysUserData = userService.getById(userId);\n        if(!sysUserData.getCreateBy().equals(user.getUsername())){\n            throw new JeecgBootException(\"您不是该用户的创建人，无法删除！\");\n        }\n        \n        // 代码逻辑说明: 【QQYUN-11839】删除用户，需要输入被删除用户的密码，这逻辑对吗？不应该是管理员的密码吗---\n        this.verifyCreateTimeAndPassword(sysUserData,password);\n\n        //step5 逻辑删除用户\n        userService.deleteUser(userId);\n        //step6 真实删除用户\n        userService.removeLogicDeleted(Collections.singletonList(userId));\n    }\n\n    /**\n     * 验证创建时间和密码\n     * \n     * @param sysUser\n     * @param password\n     */\n    private void verifyCreateTimeAndPassword(SysUser sysUser,String password) {","sourceCodeStart":899,"sourceCodeEnd":935,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantServiceImpl.java#L899-L935","documentation":"deleteUserByPassword throws (step3) when sysUserData.createBy does not equal the current operator's username — only the user who created the target account may delete it. This restricts deletion to the original creator as an accountability measure.","triggerScenarios":"An admin (who has tenant authority and the user is resigned) attempts deletion, but they are not the user recorded in sys_user.create_by. Even a super-admin fails this check if they didn't create the account.","commonSituations":"Admin inherits a user created by a predecessor; the account was created by an automated/system user; username casing mismatch in the createBy comparison; operator confusion about who created the account.","solutions":["Have the original creator (sys_user.create_by) perform the deletion, or have them delegate.","If the creator is unavailable, an admin with DB access can update create_by or remove the row directly (with audit logging).","Verify exact username match including case when comparing createBy.","Consider relaxing this rule via configuration if org policy allows broader admin deletion."],"exampleFix":"// before\ntenantService.deleteUserByPassword(targetUser, tenantId);\n\n// after\nSysUser data = userService.getById(targetUser.getId());\nif (!data.getCreateBy().equals(currentUser().getUsername())) {\n    return Result.error(\"仅账号创建人（\" + data.getCreateBy() + \"）可删除该用户\");\n}\ntenantService.deleteUserByPassword(targetUser, tenantId);","handlingStrategy":"try-catch","validationCode":"SysUser data = userService.getById(userId);\nif (data == null || !data.getCreateBy().equals(currentUser().getUsername())) {\n    return Result.error(\"仅创建人可删除该用户\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    tenantService.deleteUserByPassword(targetUser, tenantId);\n} catch (JeecgBootException e) {\n    if (e.getMessage().contains(\"创建人\")) {\n        return Result.error(\"仅账号创建人可删除，当前创建人：\" + data.getCreateBy());\n    }\n    throw e;\n}","preventionTips":["Surface the createBy value so the operator knows who can delete.","Ensure exact (case-sensitive) username match in comparisons.","Escalate to DB-level handling if the creator is unavailable and policy permits."],"tags":["authorization","user-deletion","business-rule","jeecg-boot"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}