elunez/eladmin · error · BadRequestException

角色权限不足

Error message

角色权限不足

What it means

Thrown by UserController.checkLevel (line 207), the private helper for user create/update. It compares the current user's minimum role level against the highest level among the target user's assigned roles (roleService.findByRoles(resources.getRoles())); currentLevel > optLevel rejects the write. Level semantics: lower number = more privilege — you cannot create/edit a user whose roles out-rank yours.

Source

Thrown at eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java:207

        String password = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,user.getPassword());
        UserDto userDto = userService.findByName(SecurityUtils.getCurrentUsername());
        if(!passwordEncoder.matches(password, userDto.getPassword())){
            throw new BadRequestException("密码错误");
        }
        verificationCodeService.validated(CodeEnum.EMAIL_RESET_EMAIL_CODE.getKey() + user.getEmail(), code);
        userService.updateEmail(userDto.getUsername(),user.getEmail());
        return new ResponseEntity<>(HttpStatus.OK);
    }

    /**
     * 如果当前用户的角色级别低于创建用户的角色级别，则抛出权限不足的错误
     * @param resources /
     */
    private void checkLevel(User resources) {
        Integer currentLevel =  Collections.min(roleService.findByUsersId(SecurityUtils.getCurrentUserId()).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));
        Integer optLevel = roleService.findByRoles(resources.getRoles());
        if (currentLevel > optLevel) {
            throw new BadRequestException("角色权限不足");
        }
    }
}

View on GitHub (pinned to 55fbf70595)

Solutions

1. Remove roles whose level is below (more privileged than) your own minimum from the request's roles set.
2. Request the operation be performed by a level-1 admin if the high-privilege role assignment is legitimate.
3. Check the front-end role dropdown to only offer roles at or below the current user's level.

// Mirror UserController.checkLevel client-side
const myMin = Math.min(...store.state.user.roles.map(r => r.level));
const optMin = Math.min(...form.roles.map(r => r.level));
if (myMin > optMin) {
  notifyError('角色权限不足：不能分配高于自己级别的角色');
  return;
}
await axios.post('/api/users', form);

const rolesAllowed = (myMin, roles) => Math.min(...roles.map(r => r.level)) >= myMin;

Catch the 400 on user create/update; strip offending roles and let the user re-select.

When it happens

Trigger: A level-3 admin assigning a level-1 role to a new/edited user; updating a user and leaving roles that include a role above your own in the payload; findByRoles returning the minimum (most privileged) level of the submitted role set, so even one high role trips the check.

Common situations: Delegated admins managing users that were originally provisioned with super-admin roles; front-end role selector pre-loading all roles including level-1; attempts to escalate by editing one's own or another's roles.

Related errors

• 角色权限不足，不能删除：{username}
• 权限不足，你的角色级别：{min}，低于操作的角色级别：{level}
• 不能修改他人资料
• 修改失败，旧密码错误
• 新密码不能与旧密码相同

AI-assisted analysis of elunez/eladmin@55fbf70595 (2026-08-14). Data as JSON: /api/errors/472d1f2db0f3b2fe. Report an issue: GitHub.