{"record":{"id":"e14990eeb5cce548","repo":"Tencent/APIJSON","slug":"admin-admin-thro","errorCode":null,"errorMessage":"不支持 ADMIN 角色！如果要支持就在子类重写这个方法来校验 ADMIN 角色，不通过则 throw IllegalAccessException!","messagePattern":"不支持 ADMIN 角色！如果要支持就在子类重写这个方法来校验 ADMIN 角色，不通过则 throw IllegalAccessException!","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java","lineNumber":494,"sourceCode":"\t\tif (visitorId instanceof Number) {\n\t\t\tif (((Number) visitorId).longValue() <= 0) {\n\t\t\t\tthrow new NotLoggedInException(\"未登录或登录过期，请登录后再操作！\");\n\t\t\t}\n\t\t}\n\t\telse if (visitorId instanceof String) {\n\t\t\tif (StringUtil.isEmpty(visitorId, true)) {\n\t\t\t\tthrow new NotLoggedInException(\"未登录或登录过期，请登录后再操作！\");\n\t\t\t}\n\t\t}\n\t\telse {\n\t\t\tthrow new UnsupportedDataTypeException(\"visitorId 只能是 Long 或 String 类型！\");\n\t\t}\n\n\t}\n\n\t@Override\n\tpublic void verifyAdmin() throws Exception {\n\t\tthrow new UnsupportedOperationException(\"不支持 ADMIN 角色！如果要支持就在子类重写这个方法\" +\n                \"来校验 ADMIN 角色，不通过则 throw IllegalAccessException!\");\n\t}\n\n\n\t/**验证是否重复\n\t * FIXME 这个方法实际上没有被使用\n\t * @param table\n\t * @param key\n\t * @param value\n\t * @throws Exception\n\t */\n\t@Override\n\tpublic void verifyRepeat(String table, String key, Object value) throws Exception {\n\t\tverifyRepeat(table, key, value, 0);\n\t}\n\t/**验证是否重复\n\t * FIXME 这个方法实际上没有被使用，而且与 Structure.verifyRepeat 代码重复度比较高，需要简化\n\t * @param table","sourceCodeStart":476,"sourceCodeEnd":512,"githubUrl":"https://github.com/Tencent/APIJSON/blob/5284052872898eddc449a58f629e5c8d588b8e22/APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java#L476-L512","documentation":"AbstractVerifier.verifyAdmin() unconditionally throws UnsupportedOperationException — the base ORM does not know how to identify an admin. When a request's role is ADMIN, verifyRole()'s ADMIN case calls verifyAdmin(), so supporting the ADMIN role requires a subclass to override this method and throw IllegalAccessException on failure (or call super() to deny).","triggerScenarios":"A request sends \"role\":\"ADMIN\" against a deployment whose Verifier class did not override verifyAdmin(); the ADMIN switch case in verifyRole reaches the default implementation and it throws.","commonSituations":"New project reused AbstractVerifier (or a demo verifier) without admin logic; admin check was removed during refactor; version upgrade replaced the verifier configuration with the base class.","solutions":["Override verifyAdmin() in your Verifier subclass: check the visitor against your admin list/permission service, and throw IllegalAccessException when not an admin.","Until implemented, do not send role ADMIN from clients — use roles your verifier actually supports.","Optionally gate admin endpoints behind a fixed secret key in a dedicated controller, as the code comment suggests (e.g. /get/admin + secret, Parser#needVerify)."],"exampleFix":"// before\npublic class MyVerifier extends AbstractVerifier<Long> { } // no override\n\n// after\n@Override\npublic void verifyAdmin() throws Exception {\n    if (visitorId == null || ADMIN_IDS.contains(((Number) visitorId).longValue()) == false) {\n        throw new IllegalAccessException(\"非管理员，禁止操作！\");\n    }\n}","handlingStrategy":"fallback","validationCode":"// guard before issuing admin requests: does this deployment support ADMIN at all?\nif (verifier.getClass().getMethod(\"verifyAdmin\").getDeclaringClass() == AbstractVerifier.class) {\n    clientError(\"ADMIN role not supported by this deployment\");\n}","typeGuard":"boolean adminSupported(Verifier v) { return !(v instanceof AbstractVerifier) || overridesVerifyAdmin(v.getClass()); }","tryCatchPattern":"catch (UnsupportedOperationException e) { 501 Not Implemented for role ADMIN; message should tell ops to override verifyAdmin() in the Verifier subclass.","preventionTips":["Override verifyAdmin() in every verifier subclass from day one, even if it always denies.","Smoke-test each role your clients use against the deployed verifier in CI."],"tags":["apijson","permissions","admin-role","extension-point"],"backgroundTag":null,"analyzedSha":"5284052872898eddc449a58f629e5c8d588b8e22","analyzedAt":"2026-08-14T15:15:29.577Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}