{"record":{"id":"e54f66d0885bc916","repo":"Tencent/APIJSON","slug":"abstractverifier-enable-verify-role-false","errorCode":null,"errorMessage":"AbstractVerifier.ENABLE_VERIFY_ROLE == false 时不支持校验角色权限！如需支持则设置 AbstractVerifier.ENABLE_VERIFY_ROLE = true ！","messagePattern":"AbstractVerifier\\.ENABLE_VERIFY_ROLE == false 时不支持校验角色权限！如需支持则设置 AbstractVerifier\\.ENABLE_VERIFY_ROLE = true ！","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":500,"severity":"error","filePath":"APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java","lineNumber":261,"sourceCode":"\n\t\t//导致内部调用且放行校验(needVerifyLogin, needVerifyRole)也抛异常\n\t\t//\t\tif (visitorId == null) {\n\t\t//\t\t\tthrow new NullPointerException(TAG + \".setVisitor visitorId == null !!! 可能导致权限校验失效，引发安全问题！\");\n\t\t//\t\t}\n\n\t\treturn this;\n\t}\n\n\n\t/**验证权限是否通过\n\t * @param config\n\t * @return\n\t * @throws Exception\n\t */\n\t@Override\n\tpublic boolean verifyAccess(SQLConfig<T, M, L> config) throws Exception {\n\t\tif (ENABLE_VERIFY_ROLE == false) {\n\t\t\tthrow new UnsupportedOperationException(\"AbstractVerifier.ENABLE_VERIFY_ROLE == false \" +\n                    \"时不支持校验角色权限！如需支持则设置 AbstractVerifier.ENABLE_VERIFY_ROLE = true ！\");\n\t\t}\n\n\t\tString table = config == null ? null : config.getTable();\n\t\tif (table == null) {\n\t\t\treturn true;\n\t\t}\n\n\t\tString role = config.getRole();\n\t\tif (role == null) {\n\t\t\trole = UNKNOWN;\n\t\t}\n\t\telse {\n\t\t\tif (ROLE_MAP.containsKey(role) == false) {\n\t\t\t\tSet<String> NAMES = ROLE_MAP.keySet();\n\t\t\t\tthrow new IllegalArgumentException(\"角色 \" + role + \" 不存在！\" +\n                        \"只能是[\" + StringUtil.get(NAMES.toArray()) + \"]中的一种！\");\n\t\t\t}","sourceCodeStart":243,"sourceCodeEnd":279,"githubUrl":"https://github.com/Tencent/APIJSON/blob/5284052872898eddc449a58f629e5c8d588b8e22/APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java#L243-L279","documentation":"AbstractVerifier.verifyAccess() throws UnsupportedOperationException when role-permission verification is invoked while the static flag ENABLE_VERIFY_ROLE is false. The library guards the whole role-access path behind this feature switch so that projects that manage permissions themselves can disable the machinery. Any request whose SQLConfig reaches verifyAccess (i.e. Parser#needVerify is on) will fail immediately until the flag is enabled.","triggerScenarios":"A request is executed with a role set (e.g. \"role\":\"OWNER\" or any role key) on a table object while AbstractVerifier.ENABLE_VERIFY_ROLE is left at its default false; verifyAccess(config) is entered and the first guard throws before the table/role are even inspected.","commonSituations":"New APIJSON integration where the demo/application subclass forgot to call AbstractVerifier.ENABLE_VERIFY_ROLE = true in static init; upgrading APIJSON where the flag defaulted to false and custom verifier setup code was dropped; copying framework unit tests that rely on role checks into a project without the flag.","solutions":["Set AbstractVerifier.ENABLE_VERIFY_ROLE = true once at application startup (e.g. in the static initializer of your Verifier subclass or application entry point) before any request is parsed.","If you do not want APIJSON role checking, remove/stripe role keys (\"role\") from request table objects so verifyAccess is never asked to verify roles.","Ensure only one place flips the flag and that it runs before the first request (order of static initializers matters in multi-module projects)."],"exampleFix":"// before\npublic class MyVerifier extends AbstractVerifier<Long> {\n    static {\n        AbstractVerifier.ENABLE_VERIFY_CONTENT = true; // role flag forgotten\n    }\n}\n\n// after\npublic class MyVerifier extends AbstractVerifier<Long> {\n    static {\n        AbstractVerifier.ENABLE_VERIFY_ROLE = true;      // enable role checks\n        AbstractVerifier.ENABLE_VERIFY_CONTENT = true;\n    }\n}","handlingStrategy":"validation","validationCode":"// before handling any request, assert the feature switches your requests rely on\nif (!AbstractVerifier.ENABLE_VERIFY_ROLE && requestUsesRoleKeys(requestJson)) {\n    throw new IllegalStateException(\"Role keys present but ENABLE_VERIFY_ROLE is false; enable the flag at startup.\");\n}","typeGuard":null,"tryCatchPattern":"catch (UnsupportedOperationException e) { log.error(\"Verifier feature flag disabled: {}\", e.getMessage()); return 501 with e.getMessage(); }","preventionTips":["Enable ENABLE_VERIFY_ROLE/ENABLE_VERIFY_CONTENT in one static initializer and unit-test that it is true after class load.","Fail fast at startup: assert required flags in an @PostConstruct before serving traffic."],"tags":["apijson","configuration","permissions","feature-flag"],"backgroundTag":null,"analyzedSha":"5284052872898eddc449a58f629e5c8d588b8e22","analyzedAt":"2026-08-14T15:15:29.577Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}