{"record":{"id":"472d1f2db0f3b2fe","repo":"elunez/eladmin","slug":"error-472d1f","errorCode":null,"errorMessage":"角色权限不足","messagePattern":"角色权限不足","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java","lineNumber":207,"sourceCode":"        String password = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,user.getPassword());\n        UserDto userDto = userService.findByName(SecurityUtils.getCurrentUsername());\n        if(!passwordEncoder.matches(password, userDto.getPassword())){\n            throw new BadRequestException(\"密码错误\");\n        }\n        verificationCodeService.validated(CodeEnum.EMAIL_RESET_EMAIL_CODE.getKey() + user.getEmail(), code);\n        userService.updateEmail(userDto.getUsername(),user.getEmail());\n        return new ResponseEntity<>(HttpStatus.OK);\n    }\n\n    /**\n     * 如果当前用户的角色级别低于创建用户的角色级别，则抛出权限不足的错误\n     * @param resources /\n     */\n    private void checkLevel(User resources) {\n        Integer currentLevel =  Collections.min(roleService.findByUsersId(SecurityUtils.getCurrentUserId()).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));\n        Integer optLevel = roleService.findByRoles(resources.getRoles());\n        if (currentLevel > optLevel) {\n            throw new BadRequestException(\"角色权限不足\");\n        }\n    }\n}\n","sourceCodeStart":189,"sourceCodeEnd":211,"githubUrl":"https://github.com/elunez/eladmin/blob/55fbf705956949697dbd68bf9003776609d3d029/eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java#L189-L211","documentation":"Thrown by UserController.checkLevel (line 207), the private helper for user create/update. It compares the current user's minimum role level against the highest level among the target user's assigned roles (roleService.findByRoles(resources.getRoles())); currentLevel > optLevel rejects the write. Level semantics: lower number = more privilege — you cannot create/edit a user whose roles out-rank yours.","triggerScenarios":"A level-3 admin assigning a level-1 role to a new/edited user; updating a user and leaving roles that include a role above your own in the payload; findByRoles returning the minimum (most privileged) level of the submitted role set, so even one high role trips the check.","commonSituations":"Delegated admins managing users that were originally provisioned with super-admin roles; front-end role selector pre-loading all roles including level-1; attempts to escalate by editing one's own or another's roles.","solutions":["Remove roles whose level is below (more privileged than) your own minimum from the request's roles set.","Request the operation be performed by a level-1 admin if the high-privilege role assignment is legitimate.","Check the front-end role dropdown to only offer roles at or below the current user's level."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Mirror UserController.checkLevel client-side\nconst myMin = Math.min(...store.state.user.roles.map(r => r.level));\nconst optMin = Math.min(...form.roles.map(r => r.level));\nif (myMin > optMin) {\n  notifyError('角色权限不足：不能分配高于自己级别的角色');\n  return;\n}\nawait axios.post('/api/users', form);","typeGuard":"const rolesAllowed = (myMin, roles) => Math.min(...roles.map(r => r.level)) >= myMin;","tryCatchPattern":"Catch the 400 on user create/update; strip offending roles and let the user re-select.","preventionTips":["Filter the role multi-select to roles at or below the current user's level.","Load the current user's level once at login and reuse it for all guards."],"tags":["authorization","rbac","eladmin","user","level"],"backgroundTag":null,"analyzedSha":"55fbf705956949697dbd68bf9003776609d3d029","analyzedAt":"2026-08-14T11:56:12.758Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}