jeecgboot/JeecgBoot · critical · JeecgBootException

admin角色，不允许删除！

Error message

admin角色，不允许删除！

What it means

Thrown by SysRoleServiceImpl.checkAdminRoleRejectDel when a query for roles with roleCode='admin' among the IDs to delete returns count > 0. This JeecgBootException prevents deletion of the system's built-in admin role, which is critical for system access. The method splits the comma-separated ids string and queries for any admin-role matches.

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysRoleServiceImpl.java:116

        sysUserMapper.deleteBathRolePermissionRelation(roleIds);
        //3.删除角色
        this.removeByIds(Arrays.asList(roleIds));
        return true;
    }

    @Override
    public Long getRoleCountByTenantId(String id, Integer tenantId) {
        return sysRoleMapper.getRoleCountByTenantId(id,tenantId);
    }

    @Override
    public void checkAdminRoleRejectDel(String ids) {
        LambdaQueryWrapper<SysRole> query = new  LambdaQueryWrapper<>();
        query.in(SysRole::getId,Arrays.asList(ids.split(SymbolConstant.COMMA)));
        query.eq(SysRole::getRoleCode,"admin");
        Long adminRoleCount = sysRoleMapper.selectCount(query);
        if(adminRoleCount>0){
            throw new JeecgBootException("admin角色，不允许删除！");
        }
    }
}

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Exclude the admin role from the delete selection in the frontend UI (disable its checkbox).
2. Filter out roleCode='admin' before calling checkAdminRoleRejectDel.
3. If legitimate admin role management is needed, use a dedicated role-management endpoint, not the batch delete.
4. Log which ID(s) triggered the rejection for audit purposes.

Example fix

// before
public void checkAdminRoleRejectDel(String ids) {
    query.in(SysRole::getId, Arrays.asList(ids.split(",")));
    query.eq(SysRole::getRoleCode, "admin");
    Long count = sysRoleMapper.selectCount(query);
    if (count > 0) {
        throw new JeecgBootException("admin角色，不允许删除！");
    }
}

// after — frontend excludes admin role from batch delete
const deletableRoles = selectedRoles.filter(r => r.roleCode !== 'admin');
if (deletableRoles.length < selectedRoles.length) {
    ElMessage.warning('admin角色不允许删除，已自动排除');
}
await api.deleteRoles(deletableRoles.map(r => r.id).join(','));

// Filter out admin role before batch delete
List<String> safeIds = roleList.stream()
    .filter(r -> !"admin".equals(r.getRoleCode()))
    .map(SysRole::getId)
    .collect(Collectors.toList());
if (safeIds.isEmpty()) {
    return Result.error("没有可删除的角色(admin角色不允许删除)");
}
service.checkAdminRoleRejectDel(String.join(",", safeIds));

public boolean containsNoAdminRole(List<SysRole> roles) {
    return roles.stream().noneMatch(r -> "admin".equals(r.getRoleCode()));
}

try {
    service.checkAdminRoleRejectDel(ids);
} catch (JeecgBootException e) {
    if (e.getMessage().contains("admin角色")) {
        return Result.error("admin角色不允许删除，请取消选择后重试");
    }
    throw e;
}

When it happens

Trigger: Calling checkAdminRoleRejectDel with a comma-separated list of role IDs that includes the admin role's ID. The query filters by roleCode='admin' using an IN clause on the split IDs.

Common situations: User selects 'all roles' in a batch-delete UI that includes the admin role; a script or migration attempts to clean up all roles; the admin role ID is accidentally included in a bulk delete request.

Related errors

• 表名不合法，存在SQL注入风险!--->{table}
• 字段不合法，存在SQL注入风险!--->{field}
• token不能为空!
• token非法无效!
• 下载失败，存在非法文件类型：{suffix}

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/bcafcb9d37d42ea5. Report an issue: GitHub.