{"record":{"id":"cd77a906eaf72df6","repo":"paascloud/paascloud-master","slug":"uac10015003","errorCode":"UAC10015003","errorMessage":"操作越权, 启用子节点, 必须先启用父节点","messagePattern":"操作越权, 启用子节点, 必须先启用父节点","errorType":"error_code","errorClass":"UacBizException","httpStatus":null,"severity":"error","filePath":"paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/UacGroupServiceImpl.java","lineNumber":130,"sourceCode":"\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10011023);\n\t\t}\n\t\tif (groupUser.getGroupId().equals(uacGroup.getId()) && UacGroupStatusEnum.ENABLE.getStatus() == group.getStatus()) {\n\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10011023);\n\t\t}\n\t\tuacGroup.setGroupName(group.getGroupName());\n\t\tuacGroup.setGroupCode(group.getGroupCode());\n\t\tuacGroup.setVersion(group.getVersion() + 1);\n\t\tint result = uacGroupMapper.updateByPrimaryKeySelective(uacGroup);\n\t\t// 获取当前所选组织的所有子节点\n\t\tList<GroupZtreeVo> childUacGroupList = this.getGroupTree(uacGroup.getId());\n\t\t// 批量修改组织状态\n\t\tif (PublicUtil.isNotEmpty(childUacGroupList)) {\n\t\t\tUacGroup childGroup;\n\t\t\tfor (GroupZtreeVo uacGroup1 : childUacGroupList) {\n\t\t\t\tif (UacGroupStatusEnum.ENABLE.getStatus() == status) {\n\t\t\t\t\tUacGroup parentGroup = uacGroupMapper.selectByPrimaryKey(uacGroup1.getpId());\n\t\t\t\t\tif (parentGroup.getStatus() == UacGroupStatusEnum.DISABLE.getStatus()) {\n\t\t\t\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10015003);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tchildGroup = new UacGroup();\n\t\t\t\tchildGroup.setStatus(uacGroup.getStatus());\n\t\t\t\tchildGroup.setId(uacGroup1.getId());\n\t\t\t\tresult = uacGroupMapper.updateByPrimaryKeySelective(childGroup);\n\t\t\t\tif (result < 1) {\n\t\t\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10015006, uacGroup1.getId());\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn result;\n\t}\n\n\t@Override\n\tpublic int deleteUacGroupById(Long id) {\n\n\t\tPreconditions.checkArgument(id != null, \"组织id为空\");","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/paascloud/paascloud-master/blob/781281a9503332ed3cef44ea618349d14230a127/paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/UacGroupServiceImpl.java#L112-L148","documentation":"UAC10015003 (\"操作越权, 启用子节点, 必须先启用父节点\") is thrown when enabling a child group whose parent group is still DISABLE. The hierarchy invariant requires a parent to be enabled before its children, so the operation is rejected as an out-of-order privilege/state operation.","triggerScenarios":"Calling updateUacGroupStatusById(childGroupId, ENABLE) where the child has a parent (uacGroup1.getpId()) whose status is UacGroupStatusEnum.DISABLE.","commonSituations":"Bulk-enable scripts iterating children before parents; restoring a subtree from a dump with parents still disabled; UI enabling leaf nodes directly from a ztree without checking parent state.","solutions":["Enable the parent group first, then the child (top-down order)","Catch UacBizException UAC10015003 and prompt the user to enable the parent organization first","In batch operations, sort groups by depth (parent before child) before enabling"],"exampleFix":"// before\nuacGroupService.updateUacGroupStatusById(childGroupId, UacGroupStatusEnum.ENABLE.getStatus());\n// after\nUacGroup parent = uacGroupMapper.selectByPrimaryKey(child.getPid());\nif (parent.getStatus() == UacGroupStatusEnum.DISABLE.getStatus()) {\n    uacGroupService.updateUacGroupStatusById(parent.getId(), UacGroupStatusEnum.ENABLE.getStatus()); // enable parent first\n}\nuacGroupService.updateUacGroupStatusById(childGroupId, UacGroupStatusEnum.ENABLE.getStatus());","handlingStrategy":"try-catch","validationCode":"UacGroup parent = uacGroupMapper.selectByPrimaryKey(childGroup.getPid());\nif (parent != null && parent.getStatus() == UacGroupStatusEnum.DISABLE.getStatus()) {\n    throw new IllegalStateException(\"Enable parent first\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    uacGroupService.updateUacGroupStatusById(childId, UacGroupStatusEnum.ENABLE.getStatus());\n} catch (UacBizException e) {\n    if (ErrorCodeEnum.UAC10015003.getCode().equals(e.getCode())) { /* enable parent first, then retry */ }\n    else throw e;\n}","preventionTips":["Enable parents before children in all batch/restore flows","Sort group operations by tree depth","Surface the hierarchy rule in the admin UI"],"tags":["hierarchy","state-transition","organization","business-exception"],"backgroundTag":"invalid-state-transition","analyzedSha":"781281a9503332ed3cef44ea618349d14230a127","analyzedAt":"2026-09-10T10:59:02.070Z","contentChangedAt":"2026-09-10T10:59:02.070Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}