elunez/eladmin · error · BadRequestException

角色权限不足

Error message

角色权限不足

What it means

Thrown by UserController.checkLevel (line 207), the private helper for user create/update. It compares the current user's minimum role level against the highest level among the target user's assigned roles (roleService.findByRoles(resources.getRoles())); currentLevel > optLevel rejects the write. Level semantics: lower number = more privilege — you cannot create/edit a user whose roles out-rank yours.

Solutions

1. Remove roles whose level is below (more privileged than) your own minimum from the request's roles set.
2. Request the operation be performed by a level-1 admin if the high-privilege role assignment is legitimate.
3. Check the front-end role dropdown to only offer roles at or below the current user's level.

// Mirror UserController.checkLevel client-side
const myMin = Math.min(...store.state.user.roles.map(r => r.level));
const optMin = Math.min(...form.roles.map(r => r.level));
if (myMin > optMin) {
  notifyError('角色权限不足：不能分配高于自己级别的角色');
  return;
}
await axios.post('/api/users', form);

const rolesAllowed = (myMin, roles) => Math.min(...roles.map(r => r.level)) >= myMin;

Catch the 400 on user create/update; strip offending roles and let the user re-select.

When it happens

Trigger: A level-3 admin assigning a level-1 role to a new/edited user; updating a user and leaving roles that include a role above your own in the payload; findByRoles returning the minimum (most privileged) level of the submitted role set, so even one high role trips the check.

Common situations: Delegated admins managing users that were originally provisioned with super-admin roles; front-end role selector pre-loading all roles including level-1; attempts to escalate by editing one's own or another's roles.

Related errors

• 角色权限不足，不能删除：
• 权限不足，你的角色级别： ，低于操作的角色级别：
• 不能修改他人资料
• 修改失败，旧密码错误
• 新密码不能与旧密码相同

AI-assisted analysis of elunez/eladmin@55fbf70595 (2026-08-14). Data as JSON: /api/errors/472d1f2db0f3b2fe. Report an issue: GitHub.

Appendix: source

Thrown at eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java:207

        String password = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,user.getPassword());
        UserDto userDto = userService.findByName(SecurityUtils.getCurrentUsername());
        if(!passwordEncoder.matches(password, userDto.getPassword())){
            throw new BadRequestException("密码错误");
        }
        verificationCodeService.validated(CodeEnum.EMAIL_RESET_EMAIL_CODE.getKey() + user.getEmail(), code);
        userService.updateEmail(userDto.getUsername(),user.getEmail());
        return new ResponseEntity<>(HttpStatus.OK);
    }

    /**
     * 如果当前用户的角色级别低于创建用户的角色级别，则抛出权限不足的错误
     * @param resources /
     */
    private void checkLevel(User resources) {
        Integer currentLevel =  Collections.min(roleService.findByUsersId(SecurityUtils.getCurrentUserId()).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));
        Integer optLevel = roleService.findByRoles(resources.getRoles());
        if (currentLevel > optLevel) {
            throw new BadRequestException("角色权限不足");
        }
    }
}

View on GitHub (pinned to 55fbf70595)