flipped-aurora/gin-vue-admin · error

添加失败,请勿跨级操作

Error message

添加失败,请勿跨级操作

What it means

Raised by MenuService.AddMenuAuthority when assigning a menu tree to an authority: for each selected top-level menu, the service verifies the caller's own authority actually contains that menu ID. If a selected menu is not within the caller's assigned menus, the operation is rejected as an illegal cross-level grant and the transaction aborts before SetMenuAuthority runs.

Source

Thrown at server/service/system/sys_menu.go:276

		var authorityMenus []system.SysAuthorityMenu
		err = global.GVA_DB.WithContext(ctx).Where("sys_authority_authority_id = ?", adminAuthorityID).Find(&authorityMenus).Error
		if err != nil {
			return err
		}
		for i := range authorityMenus {
			menuIds = append(menuIds, authorityMenus[i].MenuId)
		}

		for i := range menus {
			hasMenu := false
			for j := range menuIds {
				idStr := strconv.Itoa(int(menus[i].ID))
				if idStr == menuIds[j] {
					hasMenu = true
				}
			}
			if !hasMenu {
				return errors.New("添加失败,请勿跨级操作")
			}
		}
	}

	err = AuthorityServiceApp.SetMenuAuthority(ctx, &auth)
	return err
}

//@author: [piexlmax](https://github.com/piexlmax)
//@function: GetMenuAuthority
//@description: 查看当前角色树
//@param: info *request.GetAuthorityId
//@return: menus []system.SysMenu, err error

func (menuService *MenuService) GetMenuAuthority(ctx context.Context, info *request.GetAuthorityId) (menus []system.SysMenu, err error) {
	var baseMenu []system.SysBaseMenu
	var SysAuthorityMenus []system.SysAuthorityMenu
	err = global.GVA_DB.WithContext(ctx).Where("sys_authority_authority_id = ?", info.AuthorityId).Find(&SysAuthorityMenus).Error

View on GitHub (pinned to 3136500ef3)

Solutions

1. Ensure the request only includes menu IDs that belong to the calling authority's menu set.
2. Re-login / refresh the menu list so the frontend uses current authority menus.
3. Use a super-admin (authority 888) account to assign top-level or newly created menus.
4. Check sys_authority_menus for the operator role to confirm which IDs are legal.

Example fix

// before (hand-crafted request granting unowned menu 42)
await setMenuAuthority({ authorityId: '9528', authorityMenus: [{ menuId: 42 }] })
// after: only pass menus from the caller's own assignment
const own = ownAuthorityMenus.map(m => m.menuId)
const legal = targets.filter(id => own.includes(id))
await setMenuAuthority({ authorityId: '9528', authorityMenus: legal.map(id => ({ menuId: id })) })

const ownIds = new Set(ownAuthorityMenus.map(m => m.menuId))
const illegal = selectedMenuIds.filter(id => !ownIds.has(id))
if (illegal.length) {
  alert(`以下菜单超出当前账号可分配范围: ${illegal.join(',')}`)
  return
}

try {
  await menuApi.setMenuAuthority(payload)
} catch (e) {
  if (String(e.msg).includes('请勿跨级操作')) {
    await reloadAssignableMenus() // resync to caller's legal menu set
  } else throw e
}

When it happens

Trigger: Calling AddMenuAuthority (POST /menu/MenuAuthority) with authorityMenus containing menu IDs that the current (privileged) authority does not itself possess — e.g. hand-crafted requests or stale frontend state selecting menus outside the admin's own scope.

Common situations: Manually constructed API requests trying to grant menus beyond the operator's rights; frontend sending full menu tree IDs instead of only the authority's assignable subset; data drift where the operator role lost menus it previously could assign.

Related errors

• 父菜单已被其他角色的首页占用，请先释放父菜单的首页权限
• 存在重复name，请修改name
• 父菜单不存在
• 岗位ID不能为空
• 该岗位下存在用户,不允许删除

AI-assisted analysis of flipped-aurora/gin-vue-admin@3136500ef3 (2026-08-31). Data as JSON: /api/errors/c999e9a55a306a60. Report an issue: GitHub.