jeecgboot/JeecgBoot · error · JeecgBootException

您不是当前组织的管理员，无法删除用户！

Error message

您不是当前组织的管理员，无法删除用户！

What it means

deleteUserByPassword throws (step1) when sysTenantPackUserMapper.izHaveBuyAuth(currentUserId, tenantId) returns null or 0 — the operator is neither super-admin nor account-admin for the tenant, so they lack authority to delete a user from it. This is the first guard in the delete-user flow.

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantServiceImpl.java:903

        sysTenantPackUserMapper.deletePackUserByTenantIds(tenantIdList);
        //2.删除产品包对应的菜单权限
        sysPackPermissionMapper.deletePackPermByTenantIds(tenantIdList);
        //3.删除产品包
        sysTenantPackMapper.deletePackByTenantIds(tenantIdList);
    }

    @Override
    public void deleteUserByPassword(SysUser sysUser, Integer tenantId) {
        //被删除人的用户id
        String userId = sysUser.getId();
        //被删除人的密码
        String password = sysUser.getPassword();
        //当前登录用户
        LoginUser user = (LoginUser) SecurityUtils.getSubject().getPrincipal();
        //step1 判断当前用户是否为当前租户的管理员(只有超级管理员和账号管理员可以删除)
        Long isHaveAdmin = sysTenantPackUserMapper.izHaveBuyAuth(user.getId(), tenantId);
        if(null == isHaveAdmin || 0 == isHaveAdmin){
            throw new JeecgBootException("您不是当前组织的管理员，无法删除用户！");
        }
        //step2 离职状态下，并且无其他组织情况下，可以删除
        SysUserTenant sysUserTenant = userTenantMapper.getUserTenantByTenantId(userId, tenantId);
        if(null == sysUserTenant || !CommonConstant.USER_TENANT_QUIT.equals(sysUserTenant.getStatus())){
            throw new JeecgBootException("用户没有离职，不允许删除！"); 
        }
        List<Integer> tenantIdsByUserId = userTenantMapper.getTenantIdsByUserId(userId);
        if(CollectionUtils.isNotEmpty(tenantIdsByUserId) && tenantIdsByUserId.size()>0){
            throw new JeecgBootException("用户尚有未退出的组织，无法删除！");
        }
        //step3 当天创建的用户和创建人可以删除
        SysUser sysUserData = userService.getById(userId);
        if(!sysUserData.getCreateBy().equals(user.getUsername())){
            throw new JeecgBootException("您不是该用户的创建人，无法删除！");
        }
        
        // 代码逻辑说明: 【QQYUN-11839】删除用户，需要输入被删除用户的密码，这逻辑对吗？不应该是管理员的密码吗---
        this.verifyCreateTimeAndPassword(sysUserData,password);

View on GitHub (pinned to 96fb33f5ec)

Solutions

  1. Ensure the operator holds superAdmin or accountAdmin role in the target tenant (check tenant pack user assignments).
  2. Verify the tenantId in the request matches a tenant the operator administers.
  3. Re-login / refresh token after role changes.
  4. Frontend should hide the delete action for non-admins and surface a clear permission message.

Example fix

// before
tenantService.deleteUserByPassword(targetUser, tenantId);

// after
Long auth = sysTenantPackUserMapper.izHaveBuyAuth currentUser().getId(), tenantId);
if (auth == null || auth == 0) {
    return Result.error("无权限：需要组织管理员身份");
}
tenantService.deleteUserByPassword(targetUser, tenantId);
Defensive patterns

Strategy: validation

Validate before calling

Long auth = sysTenantPackUserMapper.izHaveBuyAuth(currentUser().getId(), tenantId);
if (auth == null || auth == 0) {
    return Result.error("需要组织管理员权限");
}

Try / catch

try {
    tenantService.deleteUserByPassword(targetUser, tenantId);
} catch (JeecgBootException e) {
    if (e.getMessage().contains("管理员")) {
        return Result.error("无删除权限：仅组织管理员可操作");
    }
    throw e;
}

Prevention

When it happens

Trigger: Calling deleteUserByPassword while authenticated as a user without admin rights in the target tenant. The check runs server-side regardless of UI button visibility.

Common situations: A non-admin invokes the delete API directly; admin rights were revoked but the token is still valid; operating on the wrong tenantId; the operator is admin in one tenant but tries to delete a user from another.

Related errors

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/0821160f275a6de4. Report an issue: GitHub.