{"record":{"id":"800ce2ad5fbc14fd","repo":"paascloud/paascloud-master","slug":"uac10011023","errorCode":"UAC10011023","errorMessage":"UAC10011023","messagePattern":"UAC10011023","errorType":"error_code","errorClass":"UacBizException","httpStatus":null,"severity":"error","filePath":"paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/UacGroupServiceImpl.java","lineNumber":112,"sourceCode":"\t\t\tzTreeVo = new GroupZtreeVo();\n\t\t\tzTreeVo.setId(vo.getId());\n\t\t\ttotalList.add(zTreeVo);\n\t\t}\n\n\t\tUacGroupUser uacGroupUser = new UacGroupUser();\n\t\tuacGroupUser.setUserId(loginAuthDto.getUserId());\n\t\tUacGroupUser groupUser = uacGroupUserMapper.selectOne(uacGroupUser);\n\t\t// 查询当前登陆人所在的组织信息\n\t\tUacGroup currentUserUacGroup = uacGroupMapper.selectByPrimaryKey(groupUser.getGroupId());\n\t\t// 查询当前登陆人能禁用的所有子节点\n\t\tList<GroupZtreeVo> childGroupList = this.getGroupTree(currentUserUacGroup.getId());\n\t\t// 计算不能禁用的组织= 所有的组织 - 禁用的所有子节点\n\t\ttotalList.removeAll(childGroupList);\n\t\t// 判断所选的组织是否在不能禁用的列表里\n\t\tGroupZtreeVo zTreeVo1 = new GroupZtreeVo();\n\t\tzTreeVo1.setId(group.getId());\n\t\tif (totalList.contains(zTreeVo1)) {\n\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10011023);\n\t\t}\n\t\tif (groupUser.getGroupId().equals(uacGroup.getId()) && UacGroupStatusEnum.ENABLE.getStatus() == group.getStatus()) {\n\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10011023);\n\t\t}\n\t\tuacGroup.setGroupName(group.getGroupName());\n\t\tuacGroup.setGroupCode(group.getGroupCode());\n\t\tuacGroup.setVersion(group.getVersion() + 1);\n\t\tint result = uacGroupMapper.updateByPrimaryKeySelective(uacGroup);\n\t\t// 获取当前所选组织的所有子节点\n\t\tList<GroupZtreeVo> childUacGroupList = this.getGroupTree(uacGroup.getId());\n\t\t// 批量修改组织状态\n\t\tif (PublicUtil.isNotEmpty(childUacGroupList)) {\n\t\t\tUacGroup childGroup;\n\t\t\tfor (GroupZtreeVo uacGroup1 : childUacGroupList) {\n\t\t\t\tif (UacGroupStatusEnum.ENABLE.getStatus() == status) {\n\t\t\t\t\tUacGroup parentGroup = uacGroupMapper.selectByPrimaryKey(uacGroup1.getpId());\n\t\t\t\t\tif (parentGroup.getStatus() == UacGroupStatusEnum.DISABLE.getStatus()) {\n\t\t\t\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10015003);","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/paascloud/paascloud-master/blob/781281a9503332ed3cef44ea618349d14230a127/paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/UacGroupServiceImpl.java#L94-L130","documentation":"UAC10011023 is thrown when attempting to disable a group that is not allowed to be disabled: either the group appears in the computed 'cannot-disable' list (all groups minus disabled child nodes) or the current user's own bound group would be affected while enabled. It protects group hierarchy and user binding invariants.","triggerScenarios":"Calling updateUacGroupStatusById(groupId, DISABLE) where the group is an ancestor whose subtree is not fully disabled, or where groupUser.getGroupId() equals the target uacGroup id and the group is currently ENABLE.","commonSituations":"Admin tries to disable a parent organization while its children (and thus descendants) are still enabled; an admin tries to disable the organization they themselves belong to; UI allows selecting parent nodes without checking subtree status.","solutions":["Disable child groups first, bottom-up, before disabling the parent","If the intent is to disable the current user's own group, operate with a different account or explicitly handle this restriction","Catch UacBizException UAC10011023 and show 'disable child nodes first' guidance in the UI"],"exampleFix":"// before\nuacGroupService.updateUacGroupStatusById(parentGroupId, UacGroupStatusEnum.DISABLE.getStatus());\n// after\nfor (Long childId : getAllChildGroupIds(parentGroupId)) { // disable leaves first\n    uacGroupService.updateUacGroupStatusById(childId, UacGroupStatusEnum.DISABLE.getStatus());\n}\nuacGroupService.updateUacGroupStatusById(parentGroupId, UacGroupStatusEnum.DISABLE.getStatus());","handlingStrategy":"try-catch","validationCode":"// before disabling, ensure no enabled children remain\nList<UacGroup> children = uacGroupMapper.select(new UacGroup().setPid(groupId));\nboolean anyEnabled = children.stream().anyMatch(c -> c.getStatus() == UacGroupStatusEnum.ENABLE.getStatus());\nif (anyEnabled) { throw new IllegalStateException(\"Disable children first\"); }","typeGuard":null,"tryCatchPattern":"try {\n    uacGroupService.updateUacGroupStatusById(groupId, UacGroupStatusEnum.DISABLE.getStatus());\n} catch (UacBizException e) {\n    if (ErrorCodeEnum.UAC10011023.getCode().equals(e.getCode())) { /* prompt: disable children / use another account */ }\n    else throw e;\n}","preventionTips":["Disable hierarchies bottom-up; enable them top-down","Never let users modify the status of their own bound group in the UI","Expand the full subtree before offering delete/disable actions"],"tags":["hierarchy","state-transition","organization","business-exception"],"backgroundTag":"invalid-state-transition","analyzedSha":"781281a9503332ed3cef44ea618349d14230a127","analyzedAt":"2026-09-10T10:59:02.070Z","contentChangedAt":"2026-09-10T10:59:02.070Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}