elunez/eladmin · error · BadRequestException

角色权限不足，不能删除：{username}

Error message

角色权限不足，不能删除：{username}

What it means

Thrown by UserController.deleteUser (line 148) on DELETE /api/users when, for any id in the set, the current user's minimum role level is numerically greater (less privileged) than the target's minimum level. eladmin level semantics: lower number = higher privilege; you may only delete users whose best level is weaker than or equal to yours.

Source

Thrown at eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java:148

    @PutMapping(value = "center")
    public ResponseEntity<Object> centerUser(@Validated(User.Update.class) @RequestBody User resources){
        if(!resources.getId().equals(SecurityUtils.getCurrentUserId())){
            throw new BadRequestException("不能修改他人资料");
        }
        userService.updateCenter(resources);
        return new ResponseEntity<>(HttpStatus.NO_CONTENT);
    }

    @Log("删除用户")
    @ApiOperation("删除用户")
    @DeleteMapping
    @PreAuthorize("@el.check('user:del')")
    public ResponseEntity<Object> deleteUser(@RequestBody Set<Long> ids){
        for (Long id : ids) {
            Integer currentLevel =  Collections.min(roleService.findByUsersId(SecurityUtils.getCurrentUserId()).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));
            Integer optLevel =  Collections.min(roleService.findByUsersId(id).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));
            if (currentLevel > optLevel) {
                throw new BadRequestException("角色权限不足，不能删除：" + userService.findById(id).getUsername());
            }
        }
        userService.delete(ids);
        return new ResponseEntity<>(HttpStatus.OK);
    }

    @ApiOperation("修改密码")
    @PostMapping(value = "/updatePass")
    public ResponseEntity<Object> updateUserPass(@RequestBody UserPassVo passVo) throws Exception {
        String oldPass = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,passVo.getOldPass());
        String newPass = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,passVo.getNewPass());
        UserDto user = userService.findByName(SecurityUtils.getCurrentUsername());
        if(!passwordEncoder.matches(oldPass, user.getPassword())){
            throw new BadRequestException("修改失败，旧密码错误");
        }
        if(passwordEncoder.matches(newPass, user.getPassword())){
            throw new BadRequestException("新密码不能与旧密码相同");
        }

View on GitHub (pinned to 55fbf70595)

Solutions

1. Split the batch: delete only users whose minimum level >= your own minimum level; escalate the rest to a higher-privilege admin.
2. Downgrade the target user's roles first (if business-appropriate), then delete.
3. Have a level-1 admin perform the full batch delete.

// Filter batch to deletable ids before calling DELETE /api/users
const myMin = Math.min(...store.state.user.roles.map(r => r.level));
const deletable = [];
for (const u of selectedUsers) {
  const targetMin = Math.min(...u.roles.map(r => r.level));
  if (myMin <= targetMin) deletable.push(u.id);
}
if (deletable.length) await axios.delete('/api/users', { data: deletable });

const canDeleteUser = (myMin, targetMin) => myMin <= targetMin;

Per-user errors abort the whole batch server-side; catch the 400, show which username blocked it, and retry with the filtered set.

When it happens

Trigger: A level-3 admin deleting a user who has a level-1/level-2 role; batch delete where one id in the set belongs to a super-admin; trying to delete the built-in admin account from a lower-privileged operator.

Common situations: Delegated admins hitting the ceiling of their role level; mass-delete of expired accounts that includes a system/ops account with a high-privilege role; confusion from the inverted numeric scale (currentLevel > optLevel means YOU are weaker).

Related errors

• 角色权限不足
• 权限不足，你的角色级别：{min}，低于操作的角色级别：{level}
• 不能修改他人资料
• 所选部门存在用户关联，请解除后再试！
• 修改失败，旧密码错误

AI-assisted analysis of elunez/eladmin@55fbf70595 (2026-08-14). Data as JSON: /api/errors/3de5601b586d2d53. Report an issue: GitHub.