What causes "用户不具备该角色权限" in flipped-aurora/gin-vue-admin?

Grant the desired role to the user (role management page or insert into user_authority), then retry.

用户不具备该角色权限

Error message

用户不具备该角色权限

What it means

CreateApiToken only issues tokens for authority (role) IDs the user actually holds. After preloading Authorities, it checks both the many-to-many authorities and the user's default AuthorityId; if apiToken.AuthorityID matches neither, it returns "用户不具备该角色权限". This prevents minting a token with privileges the user never had.

Source

Thrown at server/service/system/sys_api_token.go:30

)

type ApiTokenService struct{}

func (apiVersion *ApiTokenService) CreateApiToken(ctx context.Context, apiToken system.SysApiToken, days int) (string, error) {
	var user system.SysUser
	if err := global.GVA_DB.WithContext(ctx).Preload("Authorities").Where("id = ?", apiToken.UserID).First(&user).Error; err != nil {
		return "", errors.New("用户不存在")
	}

	hasAuth := false
	for _, auth := range user.Authorities {
		if auth.AuthorityId == apiToken.AuthorityID {
			hasAuth = true
			break
		}
	}
	if !hasAuth && user.AuthorityId != apiToken.AuthorityID {
		return "", errors.New("用户不具备该角色权限")
	}

	j := &utils.JWT{SigningKey: []byte(global.GVA_CONFIG.JWT.SigningKey)} // 唯一不同的部分是过期时间

	expireTime := time.Duration(days) * 24 * time.Hour
	if days == -1 {
		expireTime = 100 * 365 * 24 * time.Hour
	}

	bf, _ := utils.ParseDuration(global.GVA_CONFIG.JWT.BufferTime)

	claims := sysReq.CustomClaims{
		BaseClaims: sysReq.BaseClaims{
			UUID:        user.UUID,
			ID:          user.ID,
			Username:    user.Username,
			NickName:    user.NickName,
			AuthorityId: apiToken.AuthorityID,

View on GitHub (pinned to 3136500ef3)

Solutions

Grant the desired role to the user (role management page or insert into user_authority), then retry.
Request the token with an AuthorityID the user already holds (check the user's role list).
If the user should have the role by default, set sys_users.authority_id to the requested AuthorityID as well.

Example fix

// before
svc.CreateApiToken(ctx, system.SysApiToken{UserID: 5, AuthorityID: 9528}, 30) // user 5 has 888 only

// after: grant role first, then mint
global.GVA_DB.WithContext(ctx).Exec("INSERT INTO user_authority (sys_user_id, sys_authority_authority_id) VALUES (5, 9528)")
token, err := svc.CreateApiToken(ctx, system.SysApiToken{UserID: 5, AuthorityID: 9528}, 30)

Defensive patterns

Strategy: validation

Validate before calling

const user = (await getUserById({ id: form.userId })).data.user
const holds = user.authorities.some(a => a.authorityId === form.authorityId) || user.authorityId === form.authorityId
if (!holds) throw new Error('该用户不具备角色 ' + form.authorityId + '，不能为其签发此角色 token')

Try / catch

try {
  const token = await createApiToken(form)
} catch (e) {
  if (String(e?.msg).includes('用户不具备该角色权限')) {
    ElMessage.error('请先在角色管理中为该用户授予目标角色，再签发 token')
  } else { throw e }
}

Prevention

Always fetch the user's current role list before minting a token for a specific authority.
Re-verify role assignments in scripts after any role-management change (roles may have been revoked).
Use constants/config for authority IDs and validate them against the role table, not free-typed numbers.
Prefer minting tokens with the user's default authorityId when a specific role is not required.

When it happens

Trigger: Requesting a token with an AuthorityID that is not among the user's Authorities and is not the user's default AuthorityId — e.g. asking for authority 9528 when the target user only has 8881.

Common situations: Automated scripts copying a role ID from another user; role was revoked from the account after a script was written; typo or stale constant for the authority ID; DB where the user_authority join rows were wiped by a migration.

Related errors

AI-assisted analysis of flipped-aurora/gin-vue-admin@3136500ef3 (2026-08-31). Data as JSON: /api/errors/a00a3a5422e58f1c. Report an issue: GitHub.