{"record":{"id":"557a7e6eeb197e08","repo":"jeecgboot/JeecgBoot","slug":"error-557a7e","errorCode":null,"errorMessage":"你不是当前租户的组织账户管理员或超级管理员，无法进行此操作！","messagePattern":"你不是当前租户的组织账户管理员或超级管理员，无法进行此操作！","errorType":"exception","errorClass":"JeecgBootBizTipException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantPackServiceImpl.java","lineNumber":493,"sourceCode":"            sysTenantPackMapper.updateById(pack);\n            //同步默认套餐报下的所有用户已\n            if (oConvertUtils.isNotEmpty(sysTenantPack.getIzSysn()) && CommonConstant.STATUS_1.equals(sysTenantPack.getIzSysn())) {\n                this.addPackUserByPackTenantId(pack.getTenantId(), pack.getId());\n            }\n        }\n    }\n\n\n    /**\n     * 是否为拥有管理用户权限【accountAdmin，superAdmin】\n     * @param tenantId\n     */\n    @Override\n    public void izHaveManageUserAuth(String tenantId) {\n        LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();\n        long count = sysTenantPackMapper.izHaveManageUserAuth(tenantId,sysUser.getId());\n        if(count == 0){\n            throw new JeecgBootBizTipException(\"你不是当前租户的组织账户管理员或超级管理员，无法进行此操作！\");\n        }\n    }\n}\n","sourceCodeStart":475,"sourceCodeEnd":497,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantPackServiceImpl.java#L475-L497","documentation":"Thrown by SysTenantPackServiceImpl.izHaveManageUserAuth after querying sysTenantPackMapper.izHaveManageUserAuth(tenantId, currentUserId) returns count 0. The method is a gatekeeper: only accountAdmin or superAdmin roles within the target tenant may perform user-management operations. JeecgBootBizTipException is used (not JeecgBootException) so the message surfaces directly to the API consumer as a tip.","triggerScenarios":"Calling any user-management endpoint (add/remove/invite users in a tenant pack) when the authenticated user holds neither the account-admin nor super-admin role for the specified tenantId. The check runs server-side even if the UI hid the button.","commonSituations":"A regular member of a tenant tries to call the management API directly; a superAdmin from tenant A operates on tenant B without being in B's pack; role assignment was revoked but the user's session/token is still valid; tenantId mismatch (operator passed the wrong tenant).","solutions":["Confirm the current user is assigned the accountAdmin or superAdmin role within the target tenant via the tenant pack user list.","If operating cross-tenant, ensure the admin is added to the target tenant's pack first.","Check that the tenantId sent in the request matches the tenant the user actually administers.","Re-authenticate / refresh the token after a role change so the new permissions take effect."],"exampleFix":"// before\nsysTenantPackService.izHaveManageUserAuth(targetTenantId);\n\n// after\nLoginUser me = (LoginUser) SecurityUtils.getSubject().getPrincipal();\n// verify locally before calling, or catch the tip and show a friendly message\ntry {\n    sysTenantPackService.izHaveManageUserAuth(targetTenantId);\n} catch (JeecgBootBizTipException e) {\n    if (e.getMessage().contains(\"管理员\")) {\n        return Result.error(\"您无权管理该组织用户，请联系组织管理员授权。\");\n    }\n    throw e;\n}","handlingStrategy":"try-catch","validationCode":"LoginUser me = (LoginUser) SecurityUtils.getSubject().getPrincipal();\nlong cnt = sysTenantPackMapper.izHaveManageUserAuth(targetTenantId, me.getId());\nif (cnt == 0) {\n    return Result.error(\"无管理用户权限，请联系组织管理员\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    sysTenantPackService.izHaveManageUserAuth(tenantId);\n} catch (JeecgBootBizTipException e) {\n    if (e.getMessage().contains(\"管理员\")) {\n        return Result.error(\"权限不足：需要组织账户管理员或超级管理员身份\");\n    }\n    throw e;\n}","preventionTips":["Cache the user's admin-tenant list on login and gate UI actions by it.","Refresh tokens after role changes.","Pass the correct tenantId — cross-tenant admin calls fail this check."],"tags":["authorization","tenant","rbac","jeecg-boot"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}