{"record":{"id":"d341cc8f0251a504","repo":"yikart/AiToEarn","slug":"1-d341cc","errorCode":null,"errorMessage":"需要管理员权限1","messagePattern":"需要管理员权限1","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"project/aitoearn-electron/server/src/auth/manager.guard.ts","lineNumber":57,"sourceCode":"    ]);\n\n    if (!isManager || isPublic) {\n      return true;\n    }\n\n    const request = context.switchToHttp().getRequest();\n    const token = this.extractTokenFromHeader(request);\n    if (!token) {\n      throw new UnauthorizedException('token不存在,需要管理员权限');\n    }\n\n    try {\n      const payload = await this.jwtService.verifyAsync(token, {\n        secret: process.env.AUTH_SECRET,\n      });\n\n      if (!payload.isManager) {\n        throw new UnauthorizedException('需要管理员权限1');\n      }\n\n      request['user'] = payload;\n    } catch {\n      throw new UnauthorizedException('需要管理员权限2');\n    }\n    return true;\n  }\n\n  private extractTokenFromHeader(request: Request): string | undefined {\n    const [type, token] = request.headers.authorization?.split(' ') ?? [];\n    return type === 'Bearer' ? token : undefined;\n  }\n}\n","sourceCodeStart":39,"sourceCodeEnd":72,"githubUrl":"https://github.com/yikart/AiToEarn/blob/d3aa8bea5b146a8675607cf0144d891aad3e9683/project/aitoearn-electron/server/src/auth/manager.guard.ts#L39-L72","documentation":"ManagerGuard verifies the JWT successfully but throws '需要管理员权限1' when the payload lacks the isManager claim (or it is falsy). The token is valid, but its owner is not a manager, so the admin route is denied.","triggerScenarios":"A regular (non-manager) user's valid JWT hits a route guarded by ManagerGuard; or a token issued without isManager: true in the sign payload.","commonSituations":"Testing with a normal user token against admin endpoints; manager flag not set at login/token-signing time; role changes not reflected until token refresh; tokens from another environment lacking the claim.","solutions":["Obtain a token from a manager account (isManager: true in payload).","Ensure the login/signing code includes isManager in the JWT payload for managers.","Re-issue the token after promoting a user to manager.","Confirm the token belongs to the intended environment with correct role data."],"exampleFix":"// before\njwtService.sign({ sub: user.id });\n// after\njwtService.sign({ sub: user.id, isManager: user.isManager });","handlingStrategy":"validation","validationCode":"function isManagerToken(token) {\n  try {\n    const payload = JSON.parse(atob(token.replace('Bearer ', '').split('.')[1]));\n    return payload.isManager === true;\n  } catch { return false; }\n}\nif (!isManagerToken(myToken)) throw new Error('当前账号不是管理员');","typeGuard":"function isManagerPayload(p) {\n  return typeof p === 'object' && p !== null && p.isManager === true;\n}","tryCatchPattern":"try {\n  await adminApi.call(managerToken);\n} catch (e) {\n  if (e?.response?.status === 401 && e.message.includes('需要管理员权限1')) {\n    throw new Error('请使用管理员账号登录，当前 token 不含 isManager 权限');\n  } else throw e;\n}","preventionTips":["Sign manager JWTs with isManager: true explicitly.","Re-issue tokens after role promotion — old tokens keep old claims.","Use separate manager credentials for admin tooling, not normal user tokens.","Decode the payload locally to verify isManager before calling admin APIs."],"tags":["jwt","auth","rbac","forbidden","guard"],"backgroundTag":"insufficient-permissions","analyzedSha":"d3aa8bea5b146a8675607cf0144d891aad3e9683","analyzedAt":"2026-08-31T14:19:24.185Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}