{"record":{"id":"b5d1460b47ee040f","repo":"paascloud/paascloud-master","slug":"uac10011034","errorCode":"UAC10011034","errorMessage":"ErrorCodeEnum.UAC10011034","messagePattern":"ErrorCodeEnum\\.UAC10011034","errorType":"error_code","errorClass":"UacBizException","httpStatus":null,"severity":"warning","filePath":"paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/UacUserServiceImpl.java","lineNumber":295,"sourceCode":"\t@Override\n\tpublic void bindUserRoles(BindUserRolesDto bindUserRolesDto, LoginAuthDto authResDto) {\n\n\t\tif (bindUserRolesDto == null) {\n\t\t\tlogger.error(\"参数不能为空\");\n\t\t\tthrow new IllegalArgumentException(\"参数不能为空\");\n\t\t}\n\n\t\tLong operUserId = bindUserRolesDto.getUserId();\n\t\tLong loginUserId = authResDto.getUserId();\n\t\tList<Long> roleIdList = bindUserRolesDto.getRoleIdList();\n\n\t\tif (null == operUserId) {\n\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10011001);\n\t\t}\n\n\t\t// 任何用户不能操作admin用户\n\t\tif (Objects.equals(operUserId, GlobalConstant.Sys.SUPER_MANAGER_USER_ID)) {\n\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10011034);\n\t\t}\n\n\t\tUacUser user = this.queryByUserId(operUserId);\n\n\t\tif (user == null) {\n\t\t\tlogger.error(\"找不到用户信息 operUserId={}\", operUserId);\n\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10011003, operUserId);\n\t\t}\n\n\t\tif (PublicUtil.isNotEmpty(roleIdList) && roleIdList.contains(GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID)) {\n\t\t\tlogger.error(\"操作超级管理员角色 userId={}\", loginUserId);\n\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10011023);\n\t\t}\n\n\t\t// 1. 先取消对该角色的用户绑定(不包含超级管理员用户)\n\t\tList<UacRoleUser> userRoles = uacRoleUserService.listByUserId(operUserId);\n\n\t\tif (PublicUtil.isNotEmpty(userRoles)) {","sourceCodeStart":277,"sourceCodeEnd":313,"githubUrl":"https://github.com/paascloud/paascloud-master/blob/781281a9503332ed3cef44ea618349d14230a127/paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/UacUserServiceImpl.java#L277-L313","documentation":"UacBizException with ErrorCodeEnum.UAC10011034 (\"不允许操作admin用户\") is thrown by UacUserServiceImpl.bindUserRoles when the target operUserId equals GlobalConstant.Sys.SUPER_MANAGER_USER_ID. The built-in super-admin (admin) account is protected: no user may change its role bindings.","triggerScenarios":"Calling bindUserRoles with the super-admin's userId as the target of role modification.","commonSituations":"Bulk role-assignment scripts iterating all users including admin; UI list not excluding the admin account from role editing; imported user data reusing the reserved admin id.","solutions":["Exclude the super-admin userId (GlobalConstant.Sys.SUPER_MANAGER_USER_ID) from any role-editing UI or batch job","Catch UacBizException code 10011034 and skip/show 'cannot modify admin user'","Filter the target list: Objects.equals(id, SUPER_MANAGER_USER_ID) → skip"],"exampleFix":"// before\nfor (Long uid : userIds) {\n    bindRoles(uid, roleIds);\n}\n// after\nfor (Long uid : userIds) {\n    if (Objects.equals(uid, GlobalConstant.Sys.SUPER_MANAGER_USER_ID)) continue;\n    bindRoles(uid, roleIds);\n}","handlingStrategy":"validation","validationCode":"if (Objects.equals(dto.getUserId(), GlobalConstant.Sys.SUPER_MANAGER_USER_ID)) {\n    throw new BusinessException(\"admin user is protected\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    uacUserService.bindUserRoles(dto, authResDto);\n} catch (UacBizException e) {\n    if (e.getCode() == 10011034) { /* skip protected admin user */ }\n    else throw e;\n}","preventionTips":["Exclude the super-admin id from editable user lists","Skip admin in batch role-assignment loops"],"tags":["authorization","protected-account","role-binding"],"backgroundTag":"permission-denied","analyzedSha":"781281a9503332ed3cef44ea618349d14230a127","analyzedAt":"2026-09-10T10:59:02.070Z","contentChangedAt":"2026-09-10T10:59:02.070Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}