flipped-aurora/gin-vue-admin · error

分配API权限失败: %w

Error message

分配API权限失败: %w

What it means

Wrap of an upstream error from POST /casbin/updateCasbin when writing the updated policy list for a role. The read succeeded and appendPolicyIfMissing detected a new path/method pair, but the write failed.

Source

Thrown at server/mcp/role_api_assigner.go:89

		method = value
	}

	path, method = normalizePolicy(path, method)
	currentResp, err := postUpstream[map[string][]systemReq.CasbinInfo](ctx, "/casbin/getPolicyPathByAuthorityId", map[string]any{
		"authorityId": authorityID,
	})
	if err != nil {
		return nil, fmt.Errorf("获取角色当前API权限失败: %w", err)
	}

	current := currentResp.Data["paths"]
	updated, added := appendPolicyIfMissing(current, path, method)
	if added {
		if _, err = postUpstream[map[string]any](ctx, "/casbin/updateCasbin", map[string]any{
			"authorityId": authorityID,
			"casbinInfos": updated,
		}); err != nil {
			return nil, fmt.Errorf("分配API权限失败: %w", err)
		}
	}

	msg := "权限已存在，无需重复分配"
	if added {
		msg = fmt.Sprintf("成功为角色 %d 分配权限 %s %s", authorityID, method, path)
	}

	return textResultWithJSON("角色API权限分配结果：", roleAPIAssignResponse{
		Success:       true,
		Message:       msg,
		AuthorityID:   authorityID,
		Path:          path,
		Method:        method,
		Added:         added,
		AlreadyExists: !added,
		TotalPolicies: len(updated),
	})

View on GitHub (pinned to 3136500ef3)

Solutions

1. Read the wrapped cause for the exact upstream rejection reason
2. Verify the API path+method exists in the backend API list before assigning
3. Confirm the authorityId still exists and the token has write access
4. Retry once backend health is confirmed

apis, err := client.ListAPIs(ctx)
if err != nil { return err }
known := map[string]bool{}
for _, a := range apis { known[a.Method+" "+a.Path] = true }
if !known[method+" "+path] {
    return fmt.Errorf("API %s %s is not registered", method, path)
}

_, err := assigner.Handle(ctx, args)
if err != nil {
    if strings.Contains(err.Error(), "分配API权限失败") {
        // write-phase failure: the read succeeded, so the role exists;
        // inspect the wrapped cause and retry idempotently if network/5xx
    }
    return err
}

When it happens

Trigger: Handle posts the full updated casbinInfos to /casbin/updateCasbin and the upstream returns an error — network, auth, invalid authorityId, or a policy entry the backend rejects (e.g. API path not registered).

Common situations: Target path/method not present in the backend API registry; role deleted concurrently; MCP token lacking casbin write permission; transient backend outage.

Related errors

• 获取角色当前API权限失败: %w
• 获取角色当前API权限失败: %w
• 批量分配API权限失败: %w
• function bucket.DeleteObjects() failed, err:
• function bucket.ListObjects() failed, err:

AI-assisted analysis of flipped-aurora/gin-vue-admin@3136500ef3 (2026-08-31). Data as JSON: /api/errors/dab5bced6000751a. Report an issue: GitHub.