What causes "权限不足，你的角色级别：{min}，低于操作的角色级别：{level}" in elunez/eladmin?

Set the role's level to a value >= your own minimum level (e.g. if your min is 2, you may only create levels 2-999).

elunez/eladmin · error · BadRequestException

权限不足，你的角色级别：{min}，低于操作的角色级别：{level}

Error message

权限不足，你的角色级别：{min}，低于操作的角色级别：{level}

What it means

Thrown by RoleController.checkLevel (line 155) during role create/update/level-sensitive operations when the caller's own minimum role level is numerically higher (less privileged) than the level being written. In eladmin a SMALLER number means MORE privilege; the check `level == null || level < min` rejects assigning a level above your own or leaving it null.

Source

Thrown at eladmin-system/src/main/java/me/zhengjie/modules/system/rest/RoleController.java:155

        // 验证是否被用户关联
        roleService.verification(ids);
        roleService.delete(ids);
        return new ResponseEntity<>(HttpStatus.OK);
    }

    /**
     * 获取用户的角色级别
     * @return /
     */
    private int getLevels(){
        List<Integer> levels = roleService.findByUsersId(SecurityUtils.getCurrentUserId()).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList());
        return Collections.min(levels);
    }

    private void checkLevel(Integer level){
        int min = getLevels();
        if(level == null || level < min){
            throw new BadRequestException("权限不足，你的角色级别：" + min + "，低于操作的角色级别：" + level);
        }
    }
}

View on GitHub (pinned to 55fbf70595)

Solutions

Set the role's level to a value >= your own minimum level (e.g. if your min is 2, you may only create levels 2-999).
Include the level field in the request body — omitting it trips the null branch.
Have a top-level (level 1) admin perform the operation if a higher-privilege role is genuinely needed.

Example fix

// before: level-3 user tries to create a level-1 role
{ "name": "super", "level": 1 }
// after: stays at or below own privilege
{ "name": "limited", "level": 3 }

Defensive patterns

Strategy: validation

Validate before calling

// Client-side mirror of RoleController.checkLevel
const myMinLevel = Math.min(...store.state.user.roles.map(r => r.level));
if (form.level == null || form.level < myMinLevel) {
  notifyError(`角色级别必须 >= ${myMinLevel}`);
  return;
}
await axios.post('/api/roles', form);

Type guard

const levelAllowed = (level, myMin) => level != null && level >= myMin;

Try / catch

Catch BadRequestException on role create/update; treat as permanent — surface the server's level numbers and pre-fill a valid level.

Prevention

Restrict the level input's min to the current user's own minimum level.
Remember lower number = higher privilege when reading the message.
Always send level in the role payload.

When it happens

Trigger: A level-5 admin creating/updating a role with level 2 (or any level below their own minimum); POST /api/roles with no level field in the JSON (level == null branch); editing a role whose level the current user could never have granted.

Common situations: Operators misreading the inverted scale and trying to 'raise' a role's privilege by increasing the number; new deployments where a non-super-admin tests role management; front-end sending an incomplete role payload so level is null.

Related errors

AI-assisted analysis of elunez/eladmin@55fbf70595 (2026-08-14). Data as JSON: /api/errors/bcfdddb34a4bb623. Report an issue: GitHub.